DASCTF-11月挑战赛-re
一、babytea
一道魔改了tea加密的题，把部分的加密放到了except块里，ida在f5反编译的时候不会编译except块的内容，所以一开始看的时候没有发现什么，到后来才看到
先放到ida里查看
过程很简单，就是对输入进行分组tea加密然后进行校验，点进去查看
点进去发现就是简单的tea加密，但是其实代码里的try exception块没有显示出来
在汇编里，可以看到except块，程序的流程就是触发异常，执行except块里的内容
根据汇编代码写出魔改后的tea加密算法
void encrypt(DWORD* v, DWORD* k,DWORD Xor1,DWORD Xor2) { uint32_t v0=v[0], v1=v[1], sum=0, i; /* set up */ uint32_t delta=0x9e3779b1; /* a key schedule constant */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ //第一处魔改 v0 = v0 ^ Xor1; v1 = v1 ^ Xor2; for (i=0; i < 32; i++) { /* basic cycle start */ sum += delta; //第二处魔改 if (sum >> 0x1f == 0) { sum ^= 0x124567; } v0 += ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1); v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3); } /* end cycle */ //第三处魔改，每次会修改Xor1 和 Xor2 的值 Xor1 = v0; Xor2 = v1; v[0]=v0; v[1]=v1; }
完整C++代码
#include <stdio.h> #include<windows.h> #include <stdint.h> void encrypt(DWORD* v, DWORD* k,DWORD Xor1,DWORD Xor2) { uint32_t v0=v[0], v1=v[1], sum=0, i; /* set up */ uint32_t delta=0x9e3779b1; /* a key schedule constant */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ //第一处魔改 v0 = v0 ^ Xor1; v1 = v1 ^ Xor2; for (i=0; i < 32; i++) { /* basic cycle start */ sum += delta; //第二处魔改 if (sum >> 0x1f == 0) { sum ^= 0x124567; } v0 += ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1); v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3); } /* end cycle */ //第三处魔改，每次会修改Xor1 和 Xor2 的值 Xor1 = v0; Xor2 = v1; v[0]=v0; v[1]=v1; } //解密函数 void decrypt (DWORD* v, DWORD* k,DWORD Xor1,DWORD Xor2) { DWORD v0=v[0], v1=v[1], i; DWORD delta=0x9e3779b1; DWORD tmp = 0; DWORD sum[0x20] = {0}; for(int i = 0;i < 32;i++) { tmp += delta; if ((tmp >> 0x1f) == 0) { tmp ^= 0x1234567; } sum[i] = tmp; } DWORD k0=k[0], k1=k[1], k2=k[2], k3=k[3]; for (i=0; i<32; i++) { v1 -= ((v0<<4) + k2) ^ (v0 + sum[31-i]) ^ ((v0>>5) + k3); v0 -= ((v1<<4) + k0) ^ (v1 + sum[31-i]) ^ ((v1>>5) + k1); } v0 = v0 ^ Xor1; v1 = v1 ^ Xor2; v[0]=v0; v[1]=v1; } int main() { unsigned int Xor0[8] = {0x1234567,0x5E27B530,0xE3516A8F,0xD83DFA09}; unsigned int Xor1[8] = {0x89ABCDEF,0xBDBEF7F3,0x5D836CFE,0x8EFC737A}; // DWORD k[4]={0x01234567,0x89abcdef,0xfedcba98,0x76543210}; DWORD k[4]={0x67452301,0xEFCDAB89,0x98BADCFE,0x10325476}; // DWORD v[2] = {0x43534144,0x307b4654}; // DWORD enc[8] = {0x30b5275e,0xf3f7bebd,0x8f6a16e3,0xfe6c835d,0x09fa3dd8,0x7a73fc8e,0xa353a855,0xc54e567a}; DWORD enc[8] = {0x5E27B530,0xBDBEF7F3,0xE3516A8F,0x5D836CFE,0xD83DFA09,0x8EFC737A,0x55A853A3,0x7A564EC5}; // encrypt(v,k); // printf("加后的数据：%x %x\n",v[0],v[1]); for(int i = 0;i < 4;i++) { decrypt(enc+(2*i), k,Xor0[i],Xor1[i]); printf("解密后的数据：%x %x\n",enc[i*2],enc[i*2+1]); } /* 解密后的数据：64303036 7530795f 解密后的数据：3433725f 5f796c6c 解密后的数据：77306e6b 3433375f 解密后的数据：646e345f 6833355f */ char flag[] = {0x36,0x30,0x30,0x64,0x5f,0x79,0x30,0x75,0x5f,0x72,0x33,0x34,0x6c,0x6c,0x79,0x5f,0x6b,0x6e,0x30,0x77,0x5f,0x37,0x33,0x34,0x5f,0x34,0x6e,0x64,0x5f,0x35,0x33,0x68}; for(int i = 0;i < 24;i++) { printf("%c",flag[i]); } return 0; }
二、babysmc
一道smc的题目，
大致的执行流程是先根据输入的第一个数和最后一个数解密两个函数，然后将输入进行轮转，最后分前后进行校验
自解密函数的密钥有两种方法可以得到，一种使用capstone爆破，另一种是直接猜，因为这是32位exe，所以函数的第一个字节大概率是0x55，猜到就可以直接得到密钥
也可使用capstone爆破，这里给出capstone的代码
from struct import * from capstone import * code = "76A8CFA0CF3782DF1D612310E6AA66DF49294923AE66D373CB50182323A0E72FAE6ED372CB64DCDCDCA0E727E466CF23232323C82AA876CFA0E122AA76CFA05ECF29503DA8662F73A86E2B72A876CF2C956736D3A82FA6A31D6123DCF2A0E72BC8F0A86EDF10EECBCD0C2323A8C67EE076A8CF759B2723232348EB2F992223232348E120A8762B2C95272148F3249B2223232348E326A8562B2C9527254AE39C23232320F39B2223232348E328A8562B2C9527254AE39623232320F39B22232323F2C3A8562B2C95272548E33120F39B2223232348E325A8562B2C95272548E35F20F39B22232323E2C323A8562B2C95272548E30A20F39B2223232348E323A8" xcode = bytes.fromhex(code) print(hex(len(xcode))) for XOr in range(20,126): x32code = b"" for j in range(len(xcode)): x32code += pack("B",xcode[j] ^ XOr) CP = Cs(CS_ARCH_X86, CS_MODE_32) for p in CP.disasm(x32code, 0x04017C0): # if XOr == 0x21: if p.address > 0x04017C0 + 0x90 : print(f"{hex(XOr)} => ") print() for q in CP.disasm(x32code, 0x04017C0): print("0x%x:\t%s\t%s" %(q.address, q.mnemonic, q.op_str)) break
这是前一个函数的密钥的爆破
接着往后看，输入校验的函数点进入发现是解方程
前两天刚学了z3，可以用z3解出来，这里前半部分输入的校验函数是要进行解密的，但是我解密完，ida无法识别那个函数，弄了好久也没把方程弄出来，最后找tlsn要的方程
解完方程得到答案，把解再经过10次轮换，就可得到flag，轮换的顺序是固定的，把ida里生成轮换顺序的代码跑一遍就可以得到，
最后给出z3和轮换的代码
from z3 import * dword_422000_0 = 0x2A81A dword_422000_1 = 0x28D44 dword_422000_2 = 0x22653 dword_422000_3 = 0x2E993 dword_422000_4 = 0x249B5 dword_422000_5 = 0x24265 dword_422000_6 = 0x3253D dword_422000_7 = 0x2D77B dword_422000_8 = 0x282C8 dword_422000_9 = 0x22892 dword_422000_10= 0x2BD54 dword_422000_11= 0x2482E dword_422000_12= 0x24C1F dword_422000_13= 0x28127 dword_422000_14= 0x1E62E dword_422000_15= 0x1F009 s = Solver() input_0,input_1,input_2,input_3,input_4,input_5,input_6,input_7,input_8,input_9,input_10,input_11,input_12,input_13,input_14,input_15 = Ints('input_0 input_1 input_2 input_3 input_4 input_5 input_6 input_7 input_8 input_9 input_10 input_11 input_12 input_13 input_14 input_15') s.add(dword_422000_12==199*input_9+98*input_7+192*input_8+23*input_12+79*input_14+77*input_10+185*input_13+135*input_15+119*input_4+54*input_0+41*input_1+124*input_6+18*input_2+181*input_11+191*input_5+7*input_3) s.add(dword_422000_3==210*input_11+26*input_15+169*input_0+177*input_13+input_6+205*input_8+223*input_10+32*input_5+225*input_3+61*input_14+72*input_1+186*input_9+253*input_12+205*input_2+49*input_4+232*input_7) s.add(dword_422000_13==192*input_3+22*input_10+175*input_1+184*input_7+116*input_15+70*input_13+153*input_14+119*input_0+217*input_6+123*input_5+17*input_2+244*input_12+116*input_8+46*input_4+19*input_9+130*input_11) s.add(dword_422000_7==41*input_12+71*input_7+185*input_1+69*input_11+142*input_8+221*input_5+24*input_3+208*input_6+41*input_9+159*input_2+231*input_14+235*input_13+225*input_0+(input_4*64)+162*input_10+134*input_15) s.add(dword_422000_11==36*input_12+220*input_4+110*input_13+45*input_7+123*input_9+133*input_1+101*input_5+137*input_10+102*input_0+227*input_14+94*input_15+18*input_2+22*input_6+189*input_11+218*input_8) s.add(dword_422000_15==86*input_11+31*input_9+229*input_6+27*input_3+6*input_12+13*input_10+158*input_1+89*input_7+35*input_15+126*input_8+165*input_13+220*input_0+138*input_5+100*input_4+84*input_14+175*input_2) s.add(dword_422000_8==7*input_1+28*input_8+131*input_10+6*input_6+254*input_0+130*input_13+124*input_3+55*input_12+157*input_14+175*input_5+140*input_4+241*input_9+11*input_11+211*input_2+121*input_7+200*input_15) s.add(dword_422000_6==195*input_14+197*input_13+218*input_7+83*input_1+98*input_2+70*input_10+229*input_15+148*input_11+195*input_0+94*input_6+211*input_12+220*input_9+81*input_5+253*input_8+78*input_4+4*input_3) s.add(dword_422000_14==3*input_4+136*input_7+156*input_3+189*input_1+244*input_12+157*input_15+83*input_9+6*input_0+113*input_6+63*input_14+35*input_2+22*input_8+26*input_10+62*input_11+98*input_5+110*input_13) s.add(dword_422000_4==96*input_4+248*input_8+191*input_9+194*input_2+154*input_1+31*input_6+157*input_7+248*input_13+81*input_15+56*input_10+52*input_0+94*input_12+212*input_5+83*input_3+83*input_14+158*input_11) s.add(dword_422000_1==67*input_4+220*input_2+123*input_11+168*input_5+23*input_12+148*input_7+127*input_10+194*input_1+132*input_8+44*input_0+60*input_13+98*input_15+38*input_14+245*input_9+159*input_6+146*input_3) s.add(dword_422000_5==132*input_3+10*input_7+95*input_0+83*input_10+99*input_1+77*input_12+195*input_2+47*input_6+38*input_13+178*input_8+74*input_4+86*input_11+208*input_9+240*input_14+120*input_5+43*input_15) s.add(dword_422000_9==172*input_1+110*input_2+92*input_7+126*input_15+91*input_0+77*input_6+207*input_5+249*input_11+240*input_12+129*input_10+6*input_13+100*input_3+input_14+76*input_9+127*input_4+4*input_8) s.add(dword_422000_10==46*input_15+37*input_0+3*input_3+72*input_6+116*input_7+186*input_1+221*input_14+236*input_4+79*input_2+175*input_10+184*input_9+160*input_11+227*input_12+99*input_8+71*input_13+4*input_5) s.add(dword_422000_0==203*input_3+31*input_0+11*input_14+149*input_7+215*input_5+206*input_1+245*input_6+9*input_11+16*input_10+241*input_13+110*input_8+175*input_2+38*input_4+227*input_9+208*input_12+8*input_15) s.add(dword_422000_2==132*input_3+119*input_14+26*input_8+24*input_6+121*input_11+235*input_2+228*input_12+34*input_5+37*input_15+24*input_9+145*input_13+199*input_4+173*input_10+58*input_0+246*input_7+199*input_1) if s.check() == sat: ans = s.model() print(ans) else: print("no ans!") a1 = [90,1,186,72,45,51,43,42,72,113,51,186,51,179,43,114] byte1 = [0xd1,0x9c,0x68,0xc0,0x13,0xac,0x48,0x32,0xa3,0xba,0x4c,0xe7,0x6d,0xc8,0x1c,0xab,0xe2,0x7a,0x42,0xe1,0x7b,0x16,0x67,0x3,0xae,0x7e,0xaa,0x38,0x22,0x2,0x39,0x51,0xc7,0x79,0xd7,0xcb,0xef,0x62,0x98,0xdc,0x53,0x72,0x89,0xa5,0x4b,0xc6,0x86,0xf6,0xfc,0x77,0x5a,0xf5,0x2e,0x3d,0xb2,0xfe,0x59,0x27,0x80,0x63,0xdd,0x1a,0x12,0x5e,0xed,0xb0,0xbc,0xc4,0x5f,0x11,0xc9,0x9,0xc5,0x75,0x96,0xa,0x2f,0x0,0x17,0x81,0x14,0x47,0xbb,0x9d,0x8e,0x3c,0xd6,0xa1,0xe0,0xa2,0x26,0x5d,0x8,0x6e,0x4e,0xf1,0xcf,0x73,0x8a,0x90,0xb,0xb3,0x3e,0xb6,0x1f,0xc3,0xb7,0xda,0x8d,0x5,0xee,0x18,0x93,0x3a,0x6a,0x8c,0x43,0x8f,0xeb,0xe9,0x5b,0x29,0x37,0x1e,0x46,0x33,0x31,0xfb,0x35,0x34,0x61,0x4,0xe,0x2b,0x74,0xf9,0x8b,0x2c,0x20,0xc,0x7c,0x28,0x5c,0xca,0xe6,0x6b,0xd8,0x30,0xe4,0x21,0x44,0x70,0x6,0xa6,0x60,0x41,0x84,0x10,0x95,0x4f,0x64,0x83,0xd2,0x9a,0xbe,0xaf,0x9f,0x7,0xc1,0xb8,0x3b,0x65,0xcc,0x57,0xb5,0xd9,0x92,0xde,0xd,0xe3,0xf3,0xa4,0xbd,0x6f,0xd3,0x25,0x88,0x71,0xff,0xa9,0x36,0xb1,0x78,0x24,0x69,0xad,0x19,0xbf,0xfd,0xcd,0x4a,0xea,0x87,0x91,0xa8,0x66,0x82,0x50,0xf,0x99,0x45,0xf2,0xd5,0x9b,0x94,0x7d,0xce,0xdb,0xb9,0x52,0xe5,0xf4,0x1,0x7f,0xd4,0x15,0x2d,0x3f,0x1d,0xa7,0xc2,0xfa,0x40,0xe8,0xa0,0x55,0x6c,0xf7,0x1b,0x58,0x85,0x56,0x9e,0xec,0x97,0x23,0xf0,0x4d,0xd0,0xf8,0x2a,0x49,0xb4,0x76,0x54,0xdf] byte2 = [0x38,0x5a,0xc7,0x98,0x15,0x6a,0xc9,0x28,0x33,0xea,0xf4,0xd9,0xdb,0x77,0xb8,0x49,0x1b,0x79,0xf5,0xfd,0x3e,0xa2,0xde,0x17,0xc4,0x5e,0xe5,0x11,0xb6,0x1d,0x86,0xf9,0x90,0x78,0x8a,0x14,0x12,0xb1,0xc2,0x21,0xf1,0x2,0x58,0xa1,0x23,0xc,0xad,0xa5,0x50,0x48,0x1e,0x6d,0xf8,0x96,0x9d,0x19,0x0,0xbd,0x26,0xce,0xa7,0x24,0x2e,0x39,0x7b,0xfa,0x5f,0xcc,0x1a,0xb,0x40,0xf,0x4b,0x82,0xe2,0x97,0x10,0x2a,0xfc,0x3b,0xb2,0x66,0x27,0x54,0x7,0xe3,0x8,0xa3,0xa6,0xed,0x62,0x13,0x9c,0x20,0x1,0x92,0xe8,0xae,0xbe,0xe1,0xa,0x41,0x94,0x80,0xa9,0x2f,0x29,0x70,0x35,0x16,0xf7,0x6b,0xfe,0x9e,0xd,0xd3,0x7f,0x1f,0xa0,0x32,0xd2,0x52,0x5,0x76,0x89,0x9b,0x7a,0x8f,0x99,0xef,0xcf,0x51,0xe,0xec,0x59,0x5c,0x37,0xd5,0x8e,0x31,0x34,0x2d,0x93,0x25,0x1c,0xc8,0x5b,0x47,0x9f,0x3,0x67,0x7e,0x42,0x7d,0x3a,0xaa,0x57,0xda,0x9a,0xab,0x74,0x72,0xe4,0xb7,0x5d,0xcd,0x87,0x46,0x2b,0x43,0xf3,0xd0,0x85,0x55,0xbb,0xd4,0xc6,0x61,0x56,0x4,0x65,0x7c,0x88,0xc3,0x73,0xbc,0xeb,0xdd,0x4d,0xe0,0xe6,0xc0,0x63,0x8d,0xf2,0x81,0xf6,0xa8,0x3d,0x3f,0xa4,0xe9,0x4a,0xb5,0xf0,0xca,0x8b,0x2c,0xd7,0xac,0xc5,0xc1,0xbf,0x53,0xd1,0x6f,0x6,0xe7,0xd6,0x9,0x95,0x44,0x71,0xb9,0x83,0x4c,0x22,0xaf,0xb4,0x75,0x36,0x30,0xcb,0xee,0x91,0x45,0x8c,0x4e,0x6e,0x6c,0x4f,0x84,0xba,0xff,0x64,0xb3,0x60,0xfb,0xb0,0x18,0xd8,0xdf,0x3c,0x68,0xdc,0x69] byte3 = [0x91, 0x67, 0x1A, 0xBE, 0xAB, 0xC2, 0x85, 0xD5, 0xDA, 0xCC, 0xF7, 0x5B, 0x54, 0x61, 0x05, 0xDF, 0x02, 0x70, 0x65, 0x69, 0x9A, 0x7A, 0x09, 0x92, 0x5D, 0x2A, 0xA7, 0x37, 0xFF, 0x19, 0xE6, 0x99, 0xF3, 0x1E, 0xBD, 0x82, 0x48, 0x3C, 0xE8, 0xC8, 0x66, 0x17, 0xB7, 0xA9, 0xC5, 0x4E, 0x33, 0x84, 0x45, 0xD3, 0x8B, 0x49, 0x50, 0x43, 0x8F, 0xCD, 0x73, 0x29, 0x04, 0xDC, 0x01, 0x0C, 0xDD, 0x2E, 0xFB, 0x6E, 0x0F, 0x24, 0x57, 0xE9, 0xC9, 0x7D, 0xB3, 0x40, 0x4B, 0x56, 0x6C, 0x68, 0xE2, 0x22, 0xF6, 0x80, 0xAA, 0x95, 0xD4, 0x97, 0x94, 0x21, 0x53, 0xD1, 0xE3, 0x59, 0xD2, 0xED, 0x41, 0x4D, 0x74, 0xA3, 0xA0, 0x32, 0x0D, 0xFC, 0x46, 0x34, 0xFA, 0xB1, 0x5E, 0xC6, 0x71, 0xC0, 0xE0, 0x3F, 0x13, 0x12, 0xD7, 0xEE, 0xF8, 0x26, 0xE1, 0x25, 0x88, 0x77, 0xB0, 0x8D, 0x6A, 0xEA, 0x0E, 0xD6, 0x3E, 0x03, 0x64, 0xBF, 0x8C, 0x96, 0xD9, 0xA4, 0x42, 0xAD, 0xFD, 0x16, 0x5A, 0xE4, 0x06, 0x9D, 0x07, 0x87, 0x5F, 0xAF, 0xDB, 0xC1, 0x93, 0x1C, 0xF1, 0xDE, 0xA6, 0x3A, 0xF4, 0x2C, 0x1B, 0x39, 0xE7, 0x4A, 0xC7, 0x35, 0xFE, 0x0A, 0x62, 0xF0, 0xCA, 0xEC, 0x27, 0x52, 0x23, 0x7F, 0xA5, 0x79, 0x7C, 0x75, 0x86, 0xEB, 0x60, 0xA8, 0xF5, 0x1F, 0x20, 0xC3, 0x63, 0x5C, 0x72, 0x18, 0xE5, 0x51, 0xAC, 0xB9, 0x90, 0x9F, 0x4C, 0xB2, 0xCB, 0x00, 0x6F, 0x28, 0xA1, 0xB6, 0x9B, 0xD0, 0x7B, 0x36, 0x4F, 0x9C, 0xCF, 0x98, 0x8A, 0x0B, 0x78, 0xB4, 0x7E, 0x2B, 0xEF, 0x58, 0xB5, 0xBA, 0x55, 0xB8, 0x10, 0x2F, 0x44, 0xAE, 0x89, 0x08, 0xC4, 0x3B, 0x9E, 0xF9, 0x6D, 0xF2, 0x15, 0x1D, 0x30, 0x47, 0x8E, 0x31, 0x2D, 0xD8, 0x6B, 0x3D, 0x11, 0x14, 0xA2, 0x83, 0xCE, 0xBB, 0x81, 0xBC, 0x76, 0x38] byte4 = [0xE8, 0x22, 0x64, 0x9F, 0xC5, 0xD5, 0x25, 0xC9, 0x5D, 0xDF, 0xA1, 0x74, 0xCB, 0x57, 0xF7, 0xF0, 0xBD, 0x56, 0xFF, 0x33, 0x79, 0xFE, 0x87, 0xB6, 0xB1, 0x54, 0x10, 0x95, 0x8A, 0xEC, 0x7B, 0x48, 0x84, 0x3D, 0x30, 0xEF, 0x86, 0xFA, 0x97, 0x1C, 0xDC, 0xA9, 0x5A, 0xF3, 0x67, 0x18, 0x83, 0x72, 0x06, 0xB9, 0xF5, 0x05, 0x68, 0x59, 0xF2, 0xE4, 0x88, 0x5E, 0x14, 0x17, 0x11, 0x9C, 0xAB, 0xDE, 0xEB, 0x7D, 0x62, 0x9B, 0xD6, 0xF4, 0x01, 0x29, 0xBC, 0xC0, 0x69, 0xA2, 0x2B, 0x0D, 0x1D, 0x98, 0x6A, 0xBE, 0x65, 0x09, 0xF8, 0x96, 0xB4, 0x6E, 0x63, 0xE3, 0x34, 0x2D, 0xCE, 0x0A, 0xCD, 0xAA, 0x21, 0xCC, 0xE7, 0xA5, 0xDB, 0xD8, 0x03, 0xDD, 0xB2, 0x1F, 0x9D, 0x9E, 0x0E, 0x8F, 0x8B, 0xCA, 0x92, 0x0B, 0xA7, 0x5B, 0xD2, 0xCF, 0x47, 0x07, 0x04, 0xAE, 0x3B, 0xA8, 0x7C, 0x73, 0xF9, 0x35, 0xEE, 0x7A, 0xB0, 0xBA, 0x85, 0x46, 0x3E, 0x81, 0xC7, 0x40, 0x37, 0x15, 0x3A, 0x19, 0xE0, 0x1E, 0x28, 0x4A, 0x4F, 0x8C, 0xD4, 0x51, 0x2E, 0x94, 0x89, 0x2A, 0x0F, 0x7E, 0xE1, 0xC8, 0x5F, 0x4E, 0x6D, 0xF6, 0x49, 0xB8, 0x55, 0x60, 0x82, 0x20, 0x36, 0xC1, 0x0C, 0x1B, 0xC4, 0x00, 0xE5, 0xA3, 0x2C, 0xE9, 0xC2, 0xF1, 0x23, 0x3F, 0xC3, 0xB5, 0x8D, 0xD7, 0x42, 0xFC, 0x50, 0x13, 0xBB, 0x61, 0x9A, 0x44, 0xE6, 0x91, 0x2F, 0x70, 0xC6, 0x6F, 0xD1, 0x27, 0x43, 0x08, 0xDA, 0xFD, 0x52, 0x71, 0x77, 0xED, 0xE2, 0xAD, 0x16, 0x8E, 0x12, 0x4C, 0x31, 0x3C, 0x39, 0x78, 0x90, 0xBF, 0x1A, 0x76, 0x75, 0x41, 0x99, 0xD0, 0x80, 0xB7, 0x66, 0x24, 0xD3, 0x7F, 0x4B, 0x45, 0x5C, 0x53, 0x4D, 0x26, 0x32, 0xA0, 0xFB, 0xB3, 0x38, 0x6B, 0xAF, 0xA6, 0xD9, 0x02, 0xA4, 0xEA, 0x6C, 0xAC, 0x58, 0x93] byte5 = [0xB0, 0x28, 0x0B, 0x89, 0x4B, 0xA4, 0xBE, 0x1A, 0x8F, 0x6C, 0xCF, 0xB2, 0xB5, 0xFE, 0xFB, 0x59, 0x2D, 0x29, 0x39, 0x62, 0x97, 0xAA, 0xD7, 0x7D, 0x94, 0x2C, 0xFC, 0x5D, 0xB4, 0x7C, 0x8A, 0x82, 0xD3, 0xA7, 0xBA, 0xDF, 0x21, 0xE6, 0xA2, 0xD0, 0xE8, 0xF0, 0x67, 0x3A, 0xB9, 0x98, 0xF9, 0xAE, 0xD1, 0x56, 0xD8, 0xCA, 0x10, 0xEA, 0x92, 0xA8, 0x75, 0x7E, 0x65, 0xA9, 0xAF, 0x51, 0xC9, 0x8E, 0xD4, 0x77, 0xE4, 0x49, 0x06, 0x61, 0x9E, 0x24, 0xD9, 0x9B, 0x11, 0x05, 0x1D, 0x96, 0x9A, 0xB1, 0xE0, 0x83, 0xE1, 0x1C, 0xCD, 0xF3, 0x38, 0xB3, 0x57, 0x50, 0xF4, 0xAC, 0xEB, 0x14, 0xA5, 0x46, 0xF6, 0x93, 0xAD, 0x7B, 0x30, 0xEF, 0x79, 0x17, 0x47, 0xDA, 0xC0, 0xDD, 0xDE, 0xDC, 0x5A, 0x76, 0x3B, 0x31, 0x0D, 0x0E, 0x86, 0xF1, 0x71, 0xFA, 0x0C, 0x00, 0xA3, 0xBF, 0x64, 0x37, 0x22, 0xD2, 0x69, 0x5C, 0xC6, 0x16, 0x9F, 0x5E, 0x7A, 0x1E, 0x27, 0x60, 0x6E, 0xF8, 0x8C, 0xEE, 0xC2, 0x74, 0x81, 0x8B, 0x33, 0x03, 0xBD, 0x2A, 0x0A, 0x68, 0x6B, 0x3F, 0x4C, 0xC3, 0x15, 0x04, 0x3D, 0x63, 0xF5, 0xAB, 0xCC, 0x3C, 0x53, 0x20, 0x66, 0xC4, 0xC1, 0x23, 0xE7, 0x25, 0x55, 0xC7, 0xED, 0xB7, 0xBC, 0xCB, 0x8D, 0x09, 0xCE, 0x52, 0xBB, 0xE2, 0xC5, 0xB6, 0x26, 0x12, 0x2F, 0x99, 0x58, 0x40, 0x6D, 0xA1, 0x3E, 0x48, 0x85, 0xA6, 0xF2, 0x0F, 0x43, 0x78, 0xB8, 0x01, 0xE5, 0xD5, 0x6F, 0x4E, 0xF7, 0x13, 0x42, 0xEC, 0x45, 0x2B, 0x4F, 0x36, 0xDB, 0x9C, 0xE3, 0x44, 0x34, 0x84, 0x73, 0x2E, 0x7F, 0xFD, 0x91, 0x41, 0xD6, 0x95, 0x18, 0xFF, 0x70, 0xC8, 0x02, 0x5F, 0x08, 0x1B, 0x6A, 0x5B, 0x19, 0xA0, 0x4D, 0x35, 0x54, 0xE9, 0x32, 0x88, 0x72, 0x07, 0x87, 0x90, 0x4A, 0x80, 0x1F, 0x9D] byte6 = [0x38, 0xD9, 0xDA, 0xE6, 0xB5, 0xF1, 0x0B, 0x93, 0x0C, 0x58, 0x0D, 0xAE, 0x0A, 0x85, 0x2A, 0x50, 0xC2, 0xBF, 0xD4, 0x28, 0x52, 0xC4, 0x4F, 0xE1, 0x44, 0xE0, 0xA2, 0x70, 0x36, 0x65, 0x4B, 0x41, 0x9D, 0x5F, 0x05, 0x7C, 0xF7, 0xD7, 0x99, 0x8B, 0xCC, 0xCE, 0x16, 0xBE, 0xB6, 0xC5, 0x8F, 0x79, 0xC7, 0x20, 0x7E, 0xF4, 0xF3, 0x2E, 0x4A, 0x89, 0xD6, 0x0F, 0x6E, 0xB0, 0x61, 0xB1, 0x6D, 0x19, 0x73, 0x03, 0x74, 0xA1, 0x40, 0xEC, 0xC0, 0x57, 0x94, 0x7A, 0x66, 0xD5, 0xEA, 0x17, 0x6A, 0x84, 0x37, 0xED, 0xF6, 0x13, 0x31, 0x5B, 0x82, 0x1E, 0xFC, 0x92, 0xE2, 0x42, 0x86, 0xBA, 0xE3, 0x91, 0x7F, 0x67, 0x5C, 0x98, 0x15, 0x22, 0x8D, 0x80, 0x04, 0xE4, 0x25, 0x09, 0xA0, 0xAD, 0x63, 0xE5, 0xB4, 0x9A, 0x3C, 0xA3, 0x3A, 0x69, 0xF8, 0xCD, 0xBC, 0x88, 0x55, 0xB2, 0xBD, 0x6B, 0x77, 0x71, 0xB3, 0xD3, 0x90, 0x75, 0x06, 0x49, 0xC3, 0x32, 0x4D, 0x1D, 0xA8, 0xAA, 0xFB, 0x7B, 0x7D, 0x2B, 0xA6, 0x34, 0x72, 0x47, 0xF0, 0x2F, 0x9C, 0x08, 0x00, 0x14, 0x8C, 0x26, 0x5E, 0x87, 0xD1, 0xCF, 0xC9, 0x18, 0x51, 0x23, 0xCB, 0xF5, 0x1C, 0x9F, 0x97, 0xF9, 0xBB, 0xA7, 0x39, 0x45, 0x02, 0xFD, 0x46, 0x8A, 0x54, 0xA4, 0x8E, 0x9E, 0x68, 0x96, 0x0E, 0x78, 0xB8, 0x3D, 0x11, 0x64, 0xAF, 0x10, 0xDE, 0x6C, 0x60, 0x5A, 0x76, 0x1A, 0xE9, 0xC1, 0x3E, 0xCA, 0x9B, 0x27, 0x30, 0xEF, 0xFF, 0x07, 0xD2, 0xB9, 0x2D, 0xD0, 0xEE, 0x83, 0xAB, 0xF2, 0x4C, 0xA5, 0x21, 0x62, 0x81, 0x33, 0x1B, 0xD8, 0x6F, 0xAC, 0x3B, 0x5D, 0xE8, 0xFA, 0x3F, 0xDB, 0x95, 0xE7, 0x59, 0x12, 0x48, 0x35, 0xC6, 0x2C, 0x4E, 0x01, 0xDD, 0x43, 0x29, 0xDC, 0x24, 0x1F, 0xB7, 0xA9, 0xEB, 0xC8, 0xFE, 0x56, 0xDF, 0x53] byte7 = [0x0F, 0xA5, 0xBA, 0x03, 0xF9, 0x69, 0x2A, 0xD7, 0xEA, 0xB5, 0xFC, 0xA1, 0x39, 0x20, 0x68, 0x72, 0x25, 0xB2, 0x6C, 0xAD, 0x88, 0x51, 0x73, 0xEB, 0xCF, 0x13, 0xDE, 0x7C, 0x6D, 0x38, 0x05, 0x09, 0xC2, 0x96, 0x1F, 0x7F, 0x37, 0x4A, 0xC9, 0xE7, 0x6A, 0xB0, 0x59, 0xF7, 0xD2, 0xB9, 0x16, 0xC8, 0xEE, 0xA9, 0x18, 0x80, 0xAC, 0xE3, 0x9E, 0x6F, 0x3C, 0x2F, 0x3E, 0x9A, 0xBE, 0x1D, 0xB4, 0x7B, 0x7D, 0x32, 0x6B, 0x74, 0xC5, 0xC0, 0xC7, 0xD1, 0x29, 0x98, 0xDD, 0xB6, 0x0E, 0x4D, 0xBF, 0x79, 0x0D, 0xDA, 0x7A, 0x17, 0x71, 0x43, 0x87, 0xFF, 0xDC, 0xC6, 0x12, 0xE9, 0x67, 0x2D, 0x70, 0x9F, 0x95, 0x30, 0x26, 0x24, 0x2B, 0xA8, 0xA2, 0xD8, 0x3B, 0x31, 0xA0, 0x3D, 0x4B, 0x90, 0x60, 0x34, 0x75, 0xE8, 0x5D, 0xF4, 0x85, 0xF3, 0xFE, 0x35, 0xCB, 0xB8, 0x02, 0x50, 0xB1, 0xF1, 0x1A, 0x1B, 0x21, 0xCD, 0xC4, 0x7E, 0xED, 0x07, 0xD9, 0xD6, 0x44, 0x15, 0x8E, 0x49, 0xB3, 0x97, 0xE6, 0x63, 0xB7, 0xEF, 0x3A, 0x8F, 0xF2, 0x53, 0x10, 0x77, 0x86, 0xF8, 0x8A, 0x28, 0x3F, 0xD4, 0x4C, 0xE5, 0x82, 0x83, 0xEC, 0x62, 0x89, 0xDF, 0xC3, 0x14, 0xCA, 0xA3, 0x5F, 0x64, 0x47, 0xFD, 0x00, 0x84, 0x66, 0xA7, 0x5A, 0x0C, 0x01, 0xD5, 0x5B, 0x0A, 0x4F, 0x27, 0x78, 0x0B, 0x2E, 0x48, 0x36, 0xFA, 0x08, 0x56, 0xE0, 0xA6, 0xC1, 0x5C, 0x8B, 0x41, 0x06, 0xBB, 0x52, 0x93, 0xAF, 0x2C, 0x5E, 0xF6, 0x61, 0xF0, 0xAB, 0x91, 0x45, 0x04, 0xBD, 0xCC, 0xE4, 0x65, 0x9D, 0x92, 0xCE, 0x40, 0xAE, 0x76, 0x9B, 0x9C, 0xAA, 0x54, 0xD0, 0x1C, 0x81, 0x4E, 0x57, 0x55, 0x23, 0x6E, 0x1E, 0x99, 0xDB, 0xFB, 0xA4, 0x22, 0x19, 0x58, 0x11, 0x8D, 0x94, 0xD3, 0xE2, 0x8C, 0xF5, 0x42, 0x46, 0xBC, 0x33, 0xE1] byte8 = [0x00, 0x74, 0x59, 0xC6, 0xAC, 0xD3, 0xC1, 0xA0, 0x88, 0x3F, 0x1C, 0x28, 0x17, 0x22, 0xC5, 0x38, 0xF9, 0x1B, 0x21, 0x49, 0x99, 0xAF, 0xD6, 0x95, 0xA4, 0x9D, 0x5D, 0x5B, 0x73, 0xFE, 0xC9, 0x9A, 0x4C, 0xB4, 0x27, 0x5E, 0x71, 0x25, 0xE2, 0x90, 0xC0, 0x62, 0x5F, 0x48, 0x77, 0xE0, 0xF2, 0x8E, 0x40, 0xC7, 0x79, 0x1A, 0xDC, 0xF3, 0x01, 0xB6, 0xD8, 0xB5, 0x67, 0x1E, 0x85, 0x12, 0x68, 0x87, 0xD0, 0x30, 0xEB, 0x2F, 0x50, 0xCF, 0xEE, 0xDD, 0xFB, 0xE6, 0xA5, 0x69, 0x05, 0x75, 0xB7, 0xEF, 0x70, 0x53, 0xFF, 0xBA, 0x80, 0x41, 0x9B, 0xA1, 0x39, 0xF8, 0x65, 0x1F, 0x7A, 0x51, 0x98, 0xAD, 0x02, 0x13, 0x18, 0xC3, 0x31, 0x89, 0xCD, 0xCA, 0x91, 0xD1, 0x78, 0x57, 0x47, 0xB8, 0x54, 0x9F, 0x96, 0x04, 0x23, 0x2B, 0xE5, 0x46, 0x29, 0x7C, 0x76, 0x82, 0xBC, 0xFC, 0x6E, 0xEC, 0xED, 0x64, 0x4A, 0x26, 0x34, 0x5C, 0x19, 0x55, 0xFD, 0x6D, 0xFA, 0x7E, 0xB2, 0xD4, 0xF1, 0xF6, 0xE4, 0x60, 0xB0, 0x52, 0x9E, 0x8F, 0xBB, 0x08, 0x3B, 0x97, 0xE8, 0x10, 0x6C, 0x44, 0x3A, 0x36, 0x35, 0x03, 0xC4, 0x81, 0x9C, 0xAB, 0xCB, 0x66, 0xAA, 0x37, 0xA2, 0xD2, 0xE1, 0xE9, 0x7B, 0x14, 0x8D, 0xD9, 0xF5, 0x0B, 0xC2, 0x07, 0xA8, 0x0D, 0xA3, 0x0A, 0x84, 0x6B, 0x2C, 0xEA, 0x0C, 0xAE, 0x7D, 0x6F, 0xD7, 0xE7, 0xC8, 0x3C, 0x45, 0xCC, 0x58, 0xB9, 0x3D, 0x33, 0x4E, 0x4B, 0x8C, 0xCE, 0x72, 0x6A, 0x8B, 0x2D, 0x24, 0x11, 0xDF, 0x5A, 0x2E, 0x92, 0xDA, 0x86, 0x94, 0xA7, 0xD5, 0x4F, 0x2A, 0xB3, 0x63, 0x61, 0xE3, 0xDE, 0x43, 0x1D, 0xBF, 0x15, 0x32, 0xBE, 0x16, 0x3E, 0x93, 0x7F, 0x83, 0x56, 0x06, 0xF7, 0x8A, 0x20, 0xBD, 0x0E, 0xA6, 0xDB, 0x0F, 0xB1, 0x42, 0xF0, 0x09, 0x4D, 0xA9, 0xF4] byte9 = [0x45, 0x1F, 0x63, 0x81, 0xE6, 0xAD, 0x4F, 0xD3, 0xC0, 0x15, 0x69, 0x8F, 0x0D, 0x31, 0x0C, 0xB0, 0xF1, 0x2E, 0x98, 0xC1, 0xC2, 0x96, 0xB2, 0xEB, 0xBF, 0xDF, 0x17, 0xF4, 0x7F, 0xE5, 0x66, 0x73, 0xD8, 0x56, 0x46, 0x20, 0x9C, 0x77, 0x3D, 0x72, 0xA3, 0x91, 0x49, 0x68, 0x4C, 0x1E, 0xAE, 0x06, 0x7A, 0x94, 0xDD, 0x52, 0x55, 0x2C, 0xB8, 0x42, 0x79, 0xFE, 0x38, 0xEF, 0x8B, 0xF7, 0xAC, 0xDC, 0xFF, 0x78, 0x34, 0x70, 0xA9, 0xCE, 0x3F, 0x0E, 0x11, 0x43, 0x5B, 0xF8, 0xAF, 0xD0, 0xFA, 0x33, 0xBA, 0xCF, 0x4A, 0xC9, 0x88, 0x4E, 0x80, 0x10, 0x85, 0x37, 0x12, 0xAB, 0xE1, 0x61, 0xB7, 0x3E, 0x4D, 0x19, 0x3A, 0x04, 0x8C, 0x92, 0x0B, 0xE7, 0x3C, 0xEA, 0xC7, 0x16, 0x35, 0xB1, 0xA7, 0x8E, 0x40, 0x9F, 0xB6, 0xB5, 0x25, 0xA0, 0x5A, 0x30, 0x7D, 0xA2, 0x1A, 0x64, 0xC5, 0x6D, 0x74, 0x82, 0x08, 0x7E, 0xD2, 0xF6, 0xAA, 0xDA, 0xED, 0x4B, 0x6E, 0xE8, 0xE9, 0xE2, 0xD4, 0x71, 0xB9, 0x09, 0x84, 0x3B, 0xC4, 0x1C, 0x60, 0xFD, 0x22, 0x99, 0x39, 0x97, 0x18, 0x89, 0x7C, 0xA4, 0x27, 0xBD, 0x0F, 0xCC, 0x95, 0xF5, 0xB3, 0x65, 0x6B, 0x8A, 0x58, 0x36, 0xBB, 0x9E, 0x75, 0xD1, 0x03, 0x9D, 0x6A, 0x6C, 0x53, 0x05, 0xB4, 0xE4, 0xEE, 0x67, 0x87, 0x7B, 0x32, 0x2D, 0x24, 0x2A, 0x59, 0xEC, 0x0A, 0xDB, 0x21, 0x07, 0x23, 0x50, 0x02, 0x41, 0xF2, 0x83, 0xD9, 0x26, 0xBC, 0x6F, 0x86, 0xA6, 0x93, 0xF9, 0xC8, 0xD6, 0xA5, 0x1D, 0xE3, 0xE0, 0xFC, 0xCA, 0x1B, 0x5E, 0x8D, 0x2F, 0x5C, 0xBE, 0x47, 0xA8, 0x44, 0x57, 0x54, 0x48, 0xC3, 0x00, 0x62, 0x5D, 0xCB, 0xD7, 0x76, 0xCD, 0x28, 0xD5, 0x14, 0x90, 0x13, 0xDE, 0x5F, 0xF0, 0x01, 0x2B, 0xC6, 0x29, 0x9A, 0x9B, 0x51, 0xF3, 0xFB, 0xA1] byte10 = [0x7A, 0x91, 0x9F, 0x23, 0x71, 0xD1, 0x63, 0xDB, 0x59, 0x0A, 0xEC, 0x69, 0xEE, 0x76, 0x5D, 0x64, 0x37, 0x42, 0x8C, 0x0B, 0x3C, 0x5C, 0x80, 0xAD, 0x6A, 0x03, 0x43, 0x93, 0xBC, 0xBF, 0xE3, 0xAF, 0x5A, 0x8A, 0x65, 0x0D, 0x31, 0xDF, 0x3E, 0xA7, 0xE4, 0xDD, 0xB4, 0xB0, 0x56, 0x1C, 0x12, 0xA4, 0x9E, 0xD8, 0x3D, 0x81, 0x60, 0x9A, 0xCB, 0xFA, 0xB1, 0xE0, 0xD3, 0xF4, 0xA2, 0x26, 0x68, 0x90, 0x4B, 0x45, 0x85, 0x20, 0x16, 0xDE, 0xED, 0x4C, 0x6F, 0x34, 0xDC, 0xBE, 0xD2, 0x46, 0x33, 0x14, 0x77, 0xC6, 0xCD, 0xF0, 0xC5, 0xAC, 0x1F, 0xD0, 0x95, 0x97, 0x3F, 0xD7, 0x52, 0xAE, 0xB9, 0xC9, 0x0C, 0xCA, 0x4E, 0xF1, 0xB7, 0x39, 0x7F, 0x27, 0x2B, 0x40, 0x4A, 0x51, 0xA1, 0xCC, 0xCE, 0x6E, 0x70, 0xFF, 0x0E, 0xEF, 0x8E, 0x25, 0xB3, 0x5E, 0x6C, 0xAB, 0x02, 0x49, 0xE9, 0x9B, 0x36, 0x13, 0x9C, 0x04, 0x35, 0xC0, 0xFB, 0x3A, 0x67, 0xB6, 0x9D, 0xC2, 0x73, 0xB5, 0x6D, 0xCF, 0x83, 0x2C, 0x01, 0xC1, 0x10, 0x6B, 0x79, 0x87, 0x5B, 0x57, 0x47, 0xE5, 0x15, 0xF7, 0xA5, 0x74, 0xAA, 0x53, 0x7D, 0x2E, 0xD5, 0xA3, 0x19, 0xF5, 0x2D, 0xFD, 0x61, 0x8D, 0xC8, 0x1B, 0xC3, 0xDA, 0xF6, 0x72, 0x54, 0x5F, 0x1E, 0xE8, 0x17, 0x50, 0xB2, 0xE7, 0x0F, 0x7E, 0x55, 0xBD, 0x86, 0x00, 0x78, 0x94, 0x92, 0x09, 0x2F, 0xD6, 0xD9, 0xF3, 0x29, 0xE6, 0x24, 0x32, 0x66, 0x22, 0x41, 0xC4, 0x7C, 0x05, 0x98, 0x44, 0x4F, 0x99, 0xA9, 0xE1, 0x8F, 0x08, 0x1A, 0x2A, 0x11, 0xEA, 0x3B, 0xE2, 0x38, 0xB8, 0x18, 0xF9, 0xD4, 0xC7, 0x62, 0x7B, 0x75, 0x58, 0x96, 0x28, 0xEB, 0x06, 0x84, 0x89, 0x48, 0x82, 0x88, 0xA6, 0xFE, 0xA0, 0xF2, 0xF8, 0x1D, 0x8B, 0xFC, 0xA8, 0x21, 0x30, 0xBB, 0x07, 0xBA, 0x4D] l = [] for i in a1: for j in range(0,256): if (i == byte1[j]): l.append(j) l1 = [] for i in l: for j in range(0,256): if (i == byte2[j]): l1.append(j) l2 = [] for i in l1: for j in range(0,256): if (i == byte3[j]): l2.append(j) l3 = [] for i in l2: for j in range(0,256): if (i == byte4[j]): l3.append(j) l4 = [] for i in l3: for j in range(0,256): if (i == byte5[j]): l4.append(j) l5 = [] for i in l4: for j in range(0,256): if (i == byte6[j]): l5.append(j) l6 = [] for i in l5: for j in range(0,256): if (i == byte7[j]): l6.append(j) l7 = [] for i in l6: for j in range(0,256): if (i == byte8[j]): l7.append(j) l8 = [] for i in l7: for j in range(0,256): if (i == byte9[j]): l8.append(j) l9 = [] for i in l8: for j in range(0,256): if (i == byte10[j]): l9.append(j) for i in l9: print(chr(i&0x7f),end='')
from z3 import * dword_422040_0 = 0x27FC8 dword_422040_1 = 0x29049 dword_422040_2 = 0x3336C dword_422040_3 = 0x2C6A7 dword_422040_4 = 0x36CB0 dword_422040_5 = 0x1F2BB dword_422040_6 = 0x35262 dword_422040_7 = 0x2AEDF dword_422040_8 = 0x2955E dword_422040_9 = 0x2EE10 dword_422040_10= 0x2B057 dword_422040_11= 0x2FDE8 dword_422040_12= 0x29B92 dword_422040_13= 0x35842 dword_422040_14= 0x294D2 dword_422040_15= 0x2B984 s = Solver() a1,a1_1,a1_2,a1_3,a1_4,a1_5,a1_6,a1_7,a1_8,a1_9,a1_10,a1_11,a1_12,a1_13,a1_14,a1_15 = Ints('a a1_1 a1_2 a1_3 a1_4 a1_5 a1_6 a1_7 a1_8 a1_9 a1_10 a1_11 a1_12 a1_13 a1_14 a1_15') s.add(dword_422040_0==159*a1_8+109*a1_12+14*a1+92*a1_14+211*a1_4+178*a1_7+57*a1_2+175*a1_5+170*a1_11+59*a1_6+200*a1_9+5*a1_15+48*a1_13+28*a1_3+18*a1_10+228*a1_1) s.add(dword_422040_6==173*a1_11+34*a1_5+69*a1_4+216*a1_14+225*a1_9+160*a1_1+207*a1_10+175*a1_7+121*a1+122*a1_2+179*a1_12+91*a1_13+181*a1_8+93*a1_3+121*a1_6+12*a1_15) s.add(dword_422040_8==215*a1_11+164*a1_5+97*a1_2+99*a1_3+188*a1_4+a1_9*128+214*a1_6+106*a1_8+169*a1+28*a1_14+18*a1_12+a1_1+177*a1_10+114*a1_7+176*a1_15+25*a1_13) s.add(dword_422040_9==175*a1_14+42*a1_4+214*a1_12+43*a1_13+147*a1_6+53*a1_10+12*a1_1+213*a1_7+241*a1_9+223*a1_5+65*a1_3+42*a1_15+131*a1_2+81*a1+92*a1_11+110*a1_8) s.add(dword_422040_13==57*a1+109*a1_7+60*a1_2+228*a1_13+166*a1_4+236*a1_9+100*a1_6+179*a1_11+20*a1_12+45*a1_8+204*a1_3+182*a1_14+84*a1_10+170*a1_15+199*a1_5+138*a1_1) s.add(dword_422040_10==98*a1_11+122*a1_9+237*a1_12+117*a1+34*a1_3+168*a1_8+135*a1_10+119*a1_6+91*a1_2+161*a1_15+152*a1_7+186*a1_4+187*a1_13+72*a1_14+36*a1_5+171*a1_1) s.add(dword_422040_7==184*a1_9+112*a1+107*a1_11+170*a1_13+55*a1_8+85*a1_14+212*a1_10+173*a1_15+166*a1_12+142*a1_4+202*a1_5+63*a1_2+30*a1_7+175*a1_3+217*a1_6+63*a1_1) s.add(dword_422040_15==a1_7*64+228*a1_4+90*a1_11+85*a1_3+196*a1_6+219*a1+93*a1_14+183*a1_15+156*a1_12+197*a1_8+119*a1_13+36*a1_10+205*a1_2+94*a1_9+153*a1_5) s.add(dword_422040_5==9*a1_4+a1_5*64+62*a1_1+58*a1_7+100*a1_13+137*a1_11+6*a1+119*a1_9+180*a1_6+228*a1_8+88*a1_12+107*a1_15+56*a1_14+207*a1_2+248*a1_10+150*a1_3) s.add(dword_422040_3==38*a1_7+194*a1_4+105*a1+150*a1_6+75*a1_1+89*a1_15+99*a1_14+98*a1_3+91*a1_8+178*a1_12+117*a1_2+48*a1_13+239*a1_10+233*a1_11+63*a1_5+250*a1_9) s.add(dword_422040_11==30*a1_8+13*a1_5+206*a1_3+234*a1_15+71*a1_7+239*a1_12+141*a1_10+179*a1_13+113*a1_14+181*a1_9+52*a1_6+74*a1_11+168*a1_4+239*a1_1+164*a1+179*a1_2) s.add(dword_422040_14==211*a1_1+74*a1_5+144*a1_8+234*a1+241*a1_2+157*a1_11+25*a1_15+6*a1_10+243*a1_6+107*a1_9+77*a1_12+127*a1_4+67*a1_7+13*a1_14+151*a1_3+127*a1_13) s.add(dword_422040_2==209*a1_9+110*a1_7+22*a1_10+102*a1_11+187*a1_1+58*a1_8+236*a1_6+146*a1_13+205*a1_15+63*a1_2+211*a1_4+152*a1_3+82*a1_14+14*a1_5+49*a1_12+251*a1) s.add(dword_422040_12==230*a1+27*a1_3+186*a1_10+58*a1_7+121*a1_1+59*a1_14+90*a1_12+40*a1_2+230*a1_11+25*a1_6+198*a1_5+81*a1_4+71*a1_13+180*a1_8+149*a1_9+73*a1_15) s.add(dword_422040_4==188*a1_5+80*a1_1+221*a1_6+a1_12*64+230*a1_3+123*a1_8+124*a1_11+253*a1+202*a1_10+63*a1_2+40*a1_7+109*a1_9+195*a1_15+199*a1_13+82*a1_4+225*a1_14) s.add(dword_422040_1==236*a1_15+44*a1_14+214*a1_13+52*a1_8+37*a1_6+101*a1_9+244*a1_10+238*a1_11+109*a1+188*a1_1+20*a1_3+87*a1_7+93*a1_4+158*a1_5+105*a1_12+3*a1_2) if s.check() == sat: ans = s.model() print(ans) else: print("no ans!") a1 = [186,42,51,45,71,51,42,186,25,186,42,114,11,124,209,51] byte1 = [0xd1,0x9c,0x68,0xc0,0x13,0xac,0x48,0x32,0xa3,0xba,0x4c,0xe7,0x6d,0xc8,0x1c,0xab,0xe2,0x7a,0x42,0xe1,0x7b,0x16,0x67,0x3,0xae,0x7e,0xaa,0x38,0x22,0x2,0x39,0x51,0xc7,0x79,0xd7,0xcb,0xef,0x62,0x98,0xdc,0x53,0x72,0x89,0xa5,0x4b,0xc6,0x86,0xf6,0xfc,0x77,0x5a,0xf5,0x2e,0x3d,0xb2,0xfe,0x59,0x27,0x80,0x63,0xdd,0x1a,0x12,0x5e,0xed,0xb0,0xbc,0xc4,0x5f,0x11,0xc9,0x9,0xc5,0x75,0x96,0xa,0x2f,0x0,0x17,0x81,0x14,0x47,0xbb,0x9d,0x8e,0x3c,0xd6,0xa1,0xe0,0xa2,0x26,0x5d,0x8,0x6e,0x4e,0xf1,0xcf,0x73,0x8a,0x90,0xb,0xb3,0x3e,0xb6,0x1f,0xc3,0xb7,0xda,0x8d,0x5,0xee,0x18,0x93,0x3a,0x6a,0x8c,0x43,0x8f,0xeb,0xe9,0x5b,0x29,0x37,0x1e,0x46,0x33,0x31,0xfb,0x35,0x34,0x61,0x4,0xe,0x2b,0x74,0xf9,0x8b,0x2c,0x20,0xc,0x7c,0x28,0x5c,0xca,0xe6,0x6b,0xd8,0x30,0xe4,0x21,0x44,0x70,0x6,0xa6,0x60,0x41,0x84,0x10,0x95,0x4f,0x64,0x83,0xd2,0x9a,0xbe,0xaf,0x9f,0x7,0xc1,0xb8,0x3b,0x65,0xcc,0x57,0xb5,0xd9,0x92,0xde,0xd,0xe3,0xf3,0xa4,0xbd,0x6f,0xd3,0x25,0x88,0x71,0xff,0xa9,0x36,0xb1,0x78,0x24,0x69,0xad,0x19,0xbf,0xfd,0xcd,0x4a,0xea,0x87,0x91,0xa8,0x66,0x82,0x50,0xf,0x99,0x45,0xf2,0xd5,0x9b,0x94,0x7d,0xce,0xdb,0xb9,0x52,0xe5,0xf4,0x1,0x7f,0xd4,0x15,0x2d,0x3f,0x1d,0xa7,0xc2,0xfa,0x40,0xe8,0xa0,0x55,0x6c,0xf7,0x1b,0x58,0x85,0x56,0x9e,0xec,0x97,0x23,0xf0,0x4d,0xd0,0xf8,0x2a,0x49,0xb4,0x76,0x54,0xdf] byte2 = [0x38,0x5a,0xc7,0x98,0x15,0x6a,0xc9,0x28,0x33,0xea,0xf4,0xd9,0xdb,0x77,0xb8,0x49,0x1b,0x79,0xf5,0xfd,0x3e,0xa2,0xde,0x17,0xc4,0x5e,0xe5,0x11,0xb6,0x1d,0x86,0xf9,0x90,0x78,0x8a,0x14,0x12,0xb1,0xc2,0x21,0xf1,0x2,0x58,0xa1,0x23,0xc,0xad,0xa5,0x50,0x48,0x1e,0x6d,0xf8,0x96,0x9d,0x19,0x0,0xbd,0x26,0xce,0xa7,0x24,0x2e,0x39,0x7b,0xfa,0x5f,0xcc,0x1a,0xb,0x40,0xf,0x4b,0x82,0xe2,0x97,0x10,0x2a,0xfc,0x3b,0xb2,0x66,0x27,0x54,0x7,0xe3,0x8,0xa3,0xa6,0xed,0x62,0x13,0x9c,0x20,0x1,0x92,0xe8,0xae,0xbe,0xe1,0xa,0x41,0x94,0x80,0xa9,0x2f,0x29,0x70,0x35,0x16,0xf7,0x6b,0xfe,0x9e,0xd,0xd3,0x7f,0x1f,0xa0,0x32,0xd2,0x52,0x5,0x76,0x89,0x9b,0x7a,0x8f,0x99,0xef,0xcf,0x51,0xe,0xec,0x59,0x5c,0x37,0xd5,0x8e,0x31,0x34,0x2d,0x93,0x25,0x1c,0xc8,0x5b,0x47,0x9f,0x3,0x67,0x7e,0x42,0x7d,0x3a,0xaa,0x57,0xda,0x9a,0xab,0x74,0x72,0xe4,0xb7,0x5d,0xcd,0x87,0x46,0x2b,0x43,0xf3,0xd0,0x85,0x55,0xbb,0xd4,0xc6,0x61,0x56,0x4,0x65,0x7c,0x88,0xc3,0x73,0xbc,0xeb,0xdd,0x4d,0xe0,0xe6,0xc0,0x63,0x8d,0xf2,0x81,0xf6,0xa8,0x3d,0x3f,0xa4,0xe9,0x4a,0xb5,0xf0,0xca,0x8b,0x2c,0xd7,0xac,0xc5,0xc1,0xbf,0x53,0xd1,0x6f,0x6,0xe7,0xd6,0x9,0x95,0x44,0x71,0xb9,0x83,0x4c,0x22,0xaf,0xb4,0x75,0x36,0x30,0xcb,0xee,0x91,0x45,0x8c,0x4e,0x6e,0x6c,0x4f,0x84,0xba,0xff,0x64,0xb3,0x60,0xfb,0xb0,0x18,0xd8,0xdf,0x3c,0x68,0xdc,0x69] byte3 = [0x91, 0x67, 0x1A, 0xBE, 0xAB, 0xC2, 0x85, 0xD5, 0xDA, 0xCC, 0xF7, 0x5B, 0x54, 0x61, 0x05, 0xDF, 0x02, 0x70, 0x65, 0x69, 0x9A, 0x7A, 0x09, 0x92, 0x5D, 0x2A, 0xA7, 0x37, 0xFF, 0x19, 0xE6, 0x99, 0xF3, 0x1E, 0xBD, 0x82, 0x48, 0x3C, 0xE8, 0xC8, 0x66, 0x17, 0xB7, 0xA9, 0xC5, 0x4E, 0x33, 0x84, 0x45, 0xD3, 0x8B, 0x49, 0x50, 0x43, 0x8F, 0xCD, 0x73, 0x29, 0x04, 0xDC, 0x01, 0x0C, 0xDD, 0x2E, 0xFB, 0x6E, 0x0F, 0x24, 0x57, 0xE9, 0xC9, 0x7D, 0xB3, 0x40, 0x4B, 0x56, 0x6C, 0x68, 0xE2, 0x22, 0xF6, 0x80, 0xAA, 0x95, 0xD4, 0x97, 0x94, 0x21, 0x53, 0xD1, 0xE3, 0x59, 0xD2, 0xED, 0x41, 0x4D, 0x74, 0xA3, 0xA0, 0x32, 0x0D, 0xFC, 0x46, 0x34, 0xFA, 0xB1, 0x5E, 0xC6, 0x71, 0xC0, 0xE0, 0x3F, 0x13, 0x12, 0xD7, 0xEE, 0xF8, 0x26, 0xE1, 0x25, 0x88, 0x77, 0xB0, 0x8D, 0x6A, 0xEA, 0x0E, 0xD6, 0x3E, 0x03, 0x64, 0xBF, 0x8C, 0x96, 0xD9, 0xA4, 0x42, 0xAD, 0xFD, 0x16, 0x5A, 0xE4, 0x06, 0x9D, 0x07, 0x87, 0x5F, 0xAF, 0xDB, 0xC1, 0x93, 0x1C, 0xF1, 0xDE, 0xA6, 0x3A, 0xF4, 0x2C, 0x1B, 0x39, 0xE7, 0x4A, 0xC7, 0x35, 0xFE, 0x0A, 0x62, 0xF0, 0xCA, 0xEC, 0x27, 0x52, 0x23, 0x7F, 0xA5, 0x79, 0x7C, 0x75, 0x86, 0xEB, 0x60, 0xA8, 0xF5, 0x1F, 0x20, 0xC3, 0x63, 0x5C, 0x72, 0x18, 0xE5, 0x51, 0xAC, 0xB9, 0x90, 0x9F, 0x4C, 0xB2, 0xCB, 0x00, 0x6F, 0x28, 0xA1, 0xB6, 0x9B, 0xD0, 0x7B, 0x36, 0x4F, 0x9C, 0xCF, 0x98, 0x8A, 0x0B, 0x78, 0xB4, 0x7E, 0x2B, 0xEF, 0x58, 0xB5, 0xBA, 0x55, 0xB8, 0x10, 0x2F, 0x44, 0xAE, 0x89, 0x08, 0xC4, 0x3B, 0x9E, 0xF9, 0x6D, 0xF2, 0x15, 0x1D, 0x30, 0x47, 0x8E, 0x31, 0x2D, 0xD8, 0x6B, 0x3D, 0x11, 0x14, 0xA2, 0x83, 0xCE, 0xBB, 0x81, 0xBC, 0x76, 0x38] byte4 = [0xE8, 0x22, 0x64, 0x9F, 0xC5, 0xD5, 0x25, 0xC9, 0x5D, 0xDF, 0xA1, 0x74, 0xCB, 0x57, 0xF7, 0xF0, 0xBD, 0x56, 0xFF, 0x33, 0x79, 0xFE, 0x87, 0xB6, 0xB1, 0x54, 0x10, 0x95, 0x8A, 0xEC, 0x7B, 0x48, 0x84, 0x3D, 0x30, 0xEF, 0x86, 0xFA, 0x97, 0x1C, 0xDC, 0xA9, 0x5A, 0xF3, 0x67, 0x18, 0x83, 0x72, 0x06, 0xB9, 0xF5, 0x05, 0x68, 0x59, 0xF2, 0xE4, 0x88, 0x5E, 0x14, 0x17, 0x11, 0x9C, 0xAB, 0xDE, 0xEB, 0x7D, 0x62, 0x9B, 0xD6, 0xF4, 0x01, 0x29, 0xBC, 0xC0, 0x69, 0xA2, 0x2B, 0x0D, 0x1D, 0x98, 0x6A, 0xBE, 0x65, 0x09, 0xF8, 0x96, 0xB4, 0x6E, 0x63, 0xE3, 0x34, 0x2D, 0xCE, 0x0A, 0xCD, 0xAA, 0x21, 0xCC, 0xE7, 0xA5, 0xDB, 0xD8, 0x03, 0xDD, 0xB2, 0x1F, 0x9D, 0x9E, 0x0E, 0x8F, 0x8B, 0xCA, 0x92, 0x0B, 0xA7, 0x5B, 0xD2, 0xCF, 0x47, 0x07, 0x04, 0xAE, 0x3B, 0xA8, 0x7C, 0x73, 0xF9, 0x35, 0xEE, 0x7A, 0xB0, 0xBA, 0x85, 0x46, 0x3E, 0x81, 0xC7, 0x40, 0x37, 0x15, 0x3A, 0x19, 0xE0, 0x1E, 0x28, 0x4A, 0x4F, 0x8C, 0xD4, 0x51, 0x2E, 0x94, 0x89, 0x2A, 0x0F, 0x7E, 0xE1, 0xC8, 0x5F, 0x4E, 0x6D, 0xF6, 0x49, 0xB8, 0x55, 0x60, 0x82, 0x20, 0x36, 0xC1, 0x0C, 0x1B, 0xC4, 0x00, 0xE5, 0xA3, 0x2C, 0xE9, 0xC2, 0xF1, 0x23, 0x3F, 0xC3, 0xB5, 0x8D, 0xD7, 0x42, 0xFC, 0x50, 0x13, 0xBB, 0x61, 0x9A, 0x44, 0xE6, 0x91, 0x2F, 0x70, 0xC6, 0x6F, 0xD1, 0x27, 0x43, 0x08, 0xDA, 0xFD, 0x52, 0x71, 0x77, 0xED, 0xE2, 0xAD, 0x16, 0x8E, 0x12, 0x4C, 0x31, 0x3C, 0x39, 0x78, 0x90, 0xBF, 0x1A, 0x76, 0x75, 0x41, 0x99, 0xD0, 0x80, 0xB7, 0x66, 0x24, 0xD3, 0x7F, 0x4B, 0x45, 0x5C, 0x53, 0x4D, 0x26, 0x32, 0xA0, 0xFB, 0xB3, 0x38, 0x6B, 0xAF, 0xA6, 0xD9, 0x02, 0xA4, 0xEA, 0x6C, 0xAC, 0x58, 0x93] byte5 = [0xB0, 0x28, 0x0B, 0x89, 0x4B, 0xA4, 0xBE, 0x1A, 0x8F, 0x6C, 0xCF, 0xB2, 0xB5, 0xFE, 0xFB, 0x59, 0x2D, 0x29, 0x39, 0x62, 0x97, 0xAA, 0xD7, 0x7D, 0x94, 0x2C, 0xFC, 0x5D, 0xB4, 0x7C, 0x8A, 0x82, 0xD3, 0xA7, 0xBA, 0xDF, 0x21, 0xE6, 0xA2, 0xD0, 0xE8, 0xF0, 0x67, 0x3A, 0xB9, 0x98, 0xF9, 0xAE, 0xD1, 0x56, 0xD8, 0xCA, 0x10, 0xEA, 0x92, 0xA8, 0x75, 0x7E, 0x65, 0xA9, 0xAF, 0x51, 0xC9, 0x8E, 0xD4, 0x77, 0xE4, 0x49, 0x06, 0x61, 0x9E, 0x24, 0xD9, 0x9B, 0x11, 0x05, 0x1D, 0x96, 0x9A, 0xB1, 0xE0, 0x83, 0xE1, 0x1C, 0xCD, 0xF3, 0x38, 0xB3, 0x57, 0x50, 0xF4, 0xAC, 0xEB, 0x14, 0xA5, 0x46, 0xF6, 0x93, 0xAD, 0x7B, 0x30, 0xEF, 0x79, 0x17, 0x47, 0xDA, 0xC0, 0xDD, 0xDE, 0xDC, 0x5A, 0x76, 0x3B, 0x31, 0x0D, 0x0E, 0x86, 0xF1, 0x71, 0xFA, 0x0C, 0x00, 0xA3, 0xBF, 0x64, 0x37, 0x22, 0xD2, 0x69, 0x5C, 0xC6, 0x16, 0x9F, 0x5E, 0x7A, 0x1E, 0x27, 0x60, 0x6E, 0xF8, 0x8C, 0xEE, 0xC2, 0x74, 0x81, 0x8B, 0x33, 0x03, 0xBD, 0x2A, 0x0A, 0x68, 0x6B, 0x3F, 0x4C, 0xC3, 0x15, 0x04, 0x3D, 0x63, 0xF5, 0xAB, 0xCC, 0x3C, 0x53, 0x20, 0x66, 0xC4, 0xC1, 0x23, 0xE7, 0x25, 0x55, 0xC7, 0xED, 0xB7, 0xBC, 0xCB, 0x8D, 0x09, 0xCE, 0x52, 0xBB, 0xE2, 0xC5, 0xB6, 0x26, 0x12, 0x2F, 0x99, 0x58, 0x40, 0x6D, 0xA1, 0x3E, 0x48, 0x85, 0xA6, 0xF2, 0x0F, 0x43, 0x78, 0xB8, 0x01, 0xE5, 0xD5, 0x6F, 0x4E, 0xF7, 0x13, 0x42, 0xEC, 0x45, 0x2B, 0x4F, 0x36, 0xDB, 0x9C, 0xE3, 0x44, 0x34, 0x84, 0x73, 0x2E, 0x7F, 0xFD, 0x91, 0x41, 0xD6, 0x95, 0x18, 0xFF, 0x70, 0xC8, 0x02, 0x5F, 0x08, 0x1B, 0x6A, 0x5B, 0x19, 0xA0, 0x4D, 0x35, 0x54, 0xE9, 0x32, 0x88, 0x72, 0x07, 0x87, 0x90, 0x4A, 0x80, 0x1F, 0x9D] byte6 = [0x38, 0xD9, 0xDA, 0xE6, 0xB5, 0xF1, 0x0B, 0x93, 0x0C, 0x58, 0x0D, 0xAE, 0x0A, 0x85, 0x2A, 0x50, 0xC2, 0xBF, 0xD4, 0x28, 0x52, 0xC4, 0x4F, 0xE1, 0x44, 0xE0, 0xA2, 0x70, 0x36, 0x65, 0x4B, 0x41, 0x9D, 0x5F, 0x05, 0x7C, 0xF7, 0xD7, 0x99, 0x8B, 0xCC, 0xCE, 0x16, 0xBE, 0xB6, 0xC5, 0x8F, 0x79, 0xC7, 0x20, 0x7E, 0xF4, 0xF3, 0x2E, 0x4A, 0x89, 0xD6, 0x0F, 0x6E, 0xB0, 0x61, 0xB1, 0x6D, 0x19, 0x73, 0x03, 0x74, 0xA1, 0x40, 0xEC, 0xC0, 0x57, 0x94, 0x7A, 0x66, 0xD5, 0xEA, 0x17, 0x6A, 0x84, 0x37, 0xED, 0xF6, 0x13, 0x31, 0x5B, 0x82, 0x1E, 0xFC, 0x92, 0xE2, 0x42, 0x86, 0xBA, 0xE3, 0x91, 0x7F, 0x67, 0x5C, 0x98, 0x15, 0x22, 0x8D, 0x80, 0x04, 0xE4, 0x25, 0x09, 0xA0, 0xAD, 0x63, 0xE5, 0xB4, 0x9A, 0x3C, 0xA3, 0x3A, 0x69, 0xF8, 0xCD, 0xBC, 0x88, 0x55, 0xB2, 0xBD, 0x6B, 0x77, 0x71, 0xB3, 0xD3, 0x90, 0x75, 0x06, 0x49, 0xC3, 0x32, 0x4D, 0x1D, 0xA8, 0xAA, 0xFB, 0x7B, 0x7D, 0x2B, 0xA6, 0x34, 0x72, 0x47, 0xF0, 0x2F, 0x9C, 0x08, 0x00, 0x14, 0x8C, 0x26, 0x5E, 0x87, 0xD1, 0xCF, 0xC9, 0x18, 0x51, 0x23, 0xCB, 0xF5, 0x1C, 0x9F, 0x97, 0xF9, 0xBB, 0xA7, 0x39, 0x45, 0x02, 0xFD, 0x46, 0x8A, 0x54, 0xA4, 0x8E, 0x9E, 0x68, 0x96, 0x0E, 0x78, 0xB8, 0x3D, 0x11, 0x64, 0xAF, 0x10, 0xDE, 0x6C, 0x60, 0x5A, 0x76, 0x1A, 0xE9, 0xC1, 0x3E, 0xCA, 0x9B, 0x27, 0x30, 0xEF, 0xFF, 0x07, 0xD2, 0xB9, 0x2D, 0xD0, 0xEE, 0x83, 0xAB, 0xF2, 0x4C, 0xA5, 0x21, 0x62, 0x81, 0x33, 0x1B, 0xD8, 0x6F, 0xAC, 0x3B, 0x5D, 0xE8, 0xFA, 0x3F, 0xDB, 0x95, 0xE7, 0x59, 0x12, 0x48, 0x35, 0xC6, 0x2C, 0x4E, 0x01, 0xDD, 0x43, 0x29, 0xDC, 0x24, 0x1F, 0xB7, 0xA9, 0xEB, 0xC8, 0xFE, 0x56, 0xDF, 0x53] byte7 = [0x0F, 0xA5, 0xBA, 0x03, 0xF9, 0x69, 0x2A, 0xD7, 0xEA, 0xB5, 0xFC, 0xA1, 0x39, 0x20, 0x68, 0x72, 0x25, 0xB2, 0x6C, 0xAD, 0x88, 0x51, 0x73, 0xEB, 0xCF, 0x13, 0xDE, 0x7C, 0x6D, 0x38, 0x05, 0x09, 0xC2, 0x96, 0x1F, 0x7F, 0x37, 0x4A, 0xC9, 0xE7, 0x6A, 0xB0, 0x59, 0xF7, 0xD2, 0xB9, 0x16, 0xC8, 0xEE, 0xA9, 0x18, 0x80, 0xAC, 0xE3, 0x9E, 0x6F, 0x3C, 0x2F, 0x3E, 0x9A, 0xBE, 0x1D, 0xB4, 0x7B, 0x7D, 0x32, 0x6B, 0x74, 0xC5, 0xC0, 0xC7, 0xD1, 0x29, 0x98, 0xDD, 0xB6, 0x0E, 0x4D, 0xBF, 0x79, 0x0D, 0xDA, 0x7A, 0x17, 0x71, 0x43, 0x87, 0xFF, 0xDC, 0xC6, 0x12, 0xE9, 0x67, 0x2D, 0x70, 0x9F, 0x95, 0x30, 0x26, 0x24, 0x2B, 0xA8, 0xA2, 0xD8, 0x3B, 0x31, 0xA0, 0x3D, 0x4B, 0x90, 0x60, 0x34, 0x75, 0xE8, 0x5D, 0xF4, 0x85, 0xF3, 0xFE, 0x35, 0xCB, 0xB8, 0x02, 0x50, 0xB1, 0xF1, 0x1A, 0x1B, 0x21, 0xCD, 0xC4, 0x7E, 0xED, 0x07, 0xD9, 0xD6, 0x44, 0x15, 0x8E, 0x49, 0xB3, 0x97, 0xE6, 0x63, 0xB7, 0xEF, 0x3A, 0x8F, 0xF2, 0x53, 0x10, 0x77, 0x86, 0xF8, 0x8A, 0x28, 0x3F, 0xD4, 0x4C, 0xE5, 0x82, 0x83, 0xEC, 0x62, 0x89, 0xDF, 0xC3, 0x14, 0xCA, 0xA3, 0x5F, 0x64, 0x47, 0xFD, 0x00, 0x84, 0x66, 0xA7, 0x5A, 0x0C, 0x01, 0xD5, 0x5B, 0x0A, 0x4F, 0x27, 0x78, 0x0B, 0x2E, 0x48, 0x36, 0xFA, 0x08, 0x56, 0xE0, 0xA6, 0xC1, 0x5C, 0x8B, 0x41, 0x06, 0xBB, 0x52, 0x93, 0xAF, 0x2C, 0x5E, 0xF6, 0x61, 0xF0, 0xAB, 0x91, 0x45, 0x04, 0xBD, 0xCC, 0xE4, 0x65, 0x9D, 0x92, 0xCE, 0x40, 0xAE, 0x76, 0x9B, 0x9C, 0xAA, 0x54, 0xD0, 0x1C, 0x81, 0x4E, 0x57, 0x55, 0x23, 0x6E, 0x1E, 0x99, 0xDB, 0xFB, 0xA4, 0x22, 0x19, 0x58, 0x11, 0x8D, 0x94, 0xD3, 0xE2, 0x8C, 0xF5, 0x42, 0x46, 0xBC, 0x33, 0xE1] byte8 = [0x00, 0x74, 0x59, 0xC6, 0xAC, 0xD3, 0xC1, 0xA0, 0x88, 0x3F, 0x1C, 0x28, 0x17, 0x22, 0xC5, 0x38, 0xF9, 0x1B, 0x21, 0x49, 0x99, 0xAF, 0xD6, 0x95, 0xA4, 0x9D, 0x5D, 0x5B, 0x73, 0xFE, 0xC9, 0x9A, 0x4C, 0xB4, 0x27, 0x5E, 0x71, 0x25, 0xE2, 0x90, 0xC0, 0x62, 0x5F, 0x48, 0x77, 0xE0, 0xF2, 0x8E, 0x40, 0xC7, 0x79, 0x1A, 0xDC, 0xF3, 0x01, 0xB6, 0xD8, 0xB5, 0x67, 0x1E, 0x85, 0x12, 0x68, 0x87, 0xD0, 0x30, 0xEB, 0x2F, 0x50, 0xCF, 0xEE, 0xDD, 0xFB, 0xE6, 0xA5, 0x69, 0x05, 0x75, 0xB7, 0xEF, 0x70, 0x53, 0xFF, 0xBA, 0x80, 0x41, 0x9B, 0xA1, 0x39, 0xF8, 0x65, 0x1F, 0x7A, 0x51, 0x98, 0xAD, 0x02, 0x13, 0x18, 0xC3, 0x31, 0x89, 0xCD, 0xCA, 0x91, 0xD1, 0x78, 0x57, 0x47, 0xB8, 0x54, 0x9F, 0x96, 0x04, 0x23, 0x2B, 0xE5, 0x46, 0x29, 0x7C, 0x76, 0x82, 0xBC, 0xFC, 0x6E, 0xEC, 0xED, 0x64, 0x4A, 0x26, 0x34, 0x5C, 0x19, 0x55, 0xFD, 0x6D, 0xFA, 0x7E, 0xB2, 0xD4, 0xF1, 0xF6, 0xE4, 0x60, 0xB0, 0x52, 0x9E, 0x8F, 0xBB, 0x08, 0x3B, 0x97, 0xE8, 0x10, 0x6C, 0x44, 0x3A, 0x36, 0x35, 0x03, 0xC4, 0x81, 0x9C, 0xAB, 0xCB, 0x66, 0xAA, 0x37, 0xA2, 0xD2, 0xE1, 0xE9, 0x7B, 0x14, 0x8D, 0xD9, 0xF5, 0x0B, 0xC2, 0x07, 0xA8, 0x0D, 0xA3, 0x0A, 0x84, 0x6B, 0x2C, 0xEA, 0x0C, 0xAE, 0x7D, 0x6F, 0xD7, 0xE7, 0xC8, 0x3C, 0x45, 0xCC, 0x58, 0xB9, 0x3D, 0x33, 0x4E, 0x4B, 0x8C, 0xCE, 0x72, 0x6A, 0x8B, 0x2D, 0x24, 0x11, 0xDF, 0x5A, 0x2E, 0x92, 0xDA, 0x86, 0x94, 0xA7, 0xD5, 0x4F, 0x2A, 0xB3, 0x63, 0x61, 0xE3, 0xDE, 0x43, 0x1D, 0xBF, 0x15, 0x32, 0xBE, 0x16, 0x3E, 0x93, 0x7F, 0x83, 0x56, 0x06, 0xF7, 0x8A, 0x20, 0xBD, 0x0E, 0xA6, 0xDB, 0x0F, 0xB1, 0x42, 0xF0, 0x09, 0x4D, 0xA9, 0xF4] byte9 = [0x45, 0x1F, 0x63, 0x81, 0xE6, 0xAD, 0x4F, 0xD3, 0xC0, 0x15, 0x69, 0x8F, 0x0D, 0x31, 0x0C, 0xB0, 0xF1, 0x2E, 0x98, 0xC1, 0xC2, 0x96, 0xB2, 0xEB, 0xBF, 0xDF, 0x17, 0xF4, 0x7F, 0xE5, 0x66, 0x73, 0xD8, 0x56, 0x46, 0x20, 0x9C, 0x77, 0x3D, 0x72, 0xA3, 0x91, 0x49, 0x68, 0x4C, 0x1E, 0xAE, 0x06, 0x7A, 0x94, 0xDD, 0x52, 0x55, 0x2C, 0xB8, 0x42, 0x79, 0xFE, 0x38, 0xEF, 0x8B, 0xF7, 0xAC, 0xDC, 0xFF, 0x78, 0x34, 0x70, 0xA9, 0xCE, 0x3F, 0x0E, 0x11, 0x43, 0x5B, 0xF8, 0xAF, 0xD0, 0xFA, 0x33, 0xBA, 0xCF, 0x4A, 0xC9, 0x88, 0x4E, 0x80, 0x10, 0x85, 0x37, 0x12, 0xAB, 0xE1, 0x61, 0xB7, 0x3E, 0x4D, 0x19, 0x3A, 0x04, 0x8C, 0x92, 0x0B, 0xE7, 0x3C, 0xEA, 0xC7, 0x16, 0x35, 0xB1, 0xA7, 0x8E, 0x40, 0x9F, 0xB6, 0xB5, 0x25, 0xA0, 0x5A, 0x30, 0x7D, 0xA2, 0x1A, 0x64, 0xC5, 0x6D, 0x74, 0x82, 0x08, 0x7E, 0xD2, 0xF6, 0xAA, 0xDA, 0xED, 0x4B, 0x6E, 0xE8, 0xE9, 0xE2, 0xD4, 0x71, 0xB9, 0x09, 0x84, 0x3B, 0xC4, 0x1C, 0x60, 0xFD, 0x22, 0x99, 0x39, 0x97, 0x18, 0x89, 0x7C, 0xA4, 0x27, 0xBD, 0x0F, 0xCC, 0x95, 0xF5, 0xB3, 0x65, 0x6B, 0x8A, 0x58, 0x36, 0xBB, 0x9E, 0x75, 0xD1, 0x03, 0x9D, 0x6A, 0x6C, 0x53, 0x05, 0xB4, 0xE4, 0xEE, 0x67, 0x87, 0x7B, 0x32, 0x2D, 0x24, 0x2A, 0x59, 0xEC, 0x0A, 0xDB, 0x21, 0x07, 0x23, 0x50, 0x02, 0x41, 0xF2, 0x83, 0xD9, 0x26, 0xBC, 0x6F, 0x86, 0xA6, 0x93, 0xF9, 0xC8, 0xD6, 0xA5, 0x1D, 0xE3, 0xE0, 0xFC, 0xCA, 0x1B, 0x5E, 0x8D, 0x2F, 0x5C, 0xBE, 0x47, 0xA8, 0x44, 0x57, 0x54, 0x48, 0xC3, 0x00, 0x62, 0x5D, 0xCB, 0xD7, 0x76, 0xCD, 0x28, 0xD5, 0x14, 0x90, 0x13, 0xDE, 0x5F, 0xF0, 0x01, 0x2B, 0xC6, 0x29, 0x9A, 0x9B, 0x51, 0xF3, 0xFB, 0xA1] byte10 = [0x7A, 0x91, 0x9F, 0x23, 0x71, 0xD1, 0x63, 0xDB, 0x59, 0x0A, 0xEC, 0x69, 0xEE, 0x76, 0x5D, 0x64, 0x37, 0x42, 0x8C, 0x0B, 0x3C, 0x5C, 0x80, 0xAD, 0x6A, 0x03, 0x43, 0x93, 0xBC, 0xBF, 0xE3, 0xAF, 0x5A, 0x8A, 0x65, 0x0D, 0x31, 0xDF, 0x3E, 0xA7, 0xE4, 0xDD, 0xB4, 0xB0, 0x56, 0x1C, 0x12, 0xA4, 0x9E, 0xD8, 0x3D, 0x81, 0x60, 0x9A, 0xCB, 0xFA, 0xB1, 0xE0, 0xD3, 0xF4, 0xA2, 0x26, 0x68, 0x90, 0x4B, 0x45, 0x85, 0x20, 0x16, 0xDE, 0xED, 0x4C, 0x6F, 0x34, 0xDC, 0xBE, 0xD2, 0x46, 0x33, 0x14, 0x77, 0xC6, 0xCD, 0xF0, 0xC5, 0xAC, 0x1F, 0xD0, 0x95, 0x97, 0x3F, 0xD7, 0x52, 0xAE, 0xB9, 0xC9, 0x0C, 0xCA, 0x4E, 0xF1, 0xB7, 0x39, 0x7F, 0x27, 0x2B, 0x40, 0x4A, 0x51, 0xA1, 0xCC, 0xCE, 0x6E, 0x70, 0xFF, 0x0E, 0xEF, 0x8E, 0x25, 0xB3, 0x5E, 0x6C, 0xAB, 0x02, 0x49, 0xE9, 0x9B, 0x36, 0x13, 0x9C, 0x04, 0x35, 0xC0, 0xFB, 0x3A, 0x67, 0xB6, 0x9D, 0xC2, 0x73, 0xB5, 0x6D, 0xCF, 0x83, 0x2C, 0x01, 0xC1, 0x10, 0x6B, 0x79, 0x87, 0x5B, 0x57, 0x47, 0xE5, 0x15, 0xF7, 0xA5, 0x74, 0xAA, 0x53, 0x7D, 0x2E, 0xD5, 0xA3, 0x19, 0xF5, 0x2D, 0xFD, 0x61, 0x8D, 0xC8, 0x1B, 0xC3, 0xDA, 0xF6, 0x72, 0x54, 0x5F, 0x1E, 0xE8, 0x17, 0x50, 0xB2, 0xE7, 0x0F, 0x7E, 0x55, 0xBD, 0x86, 0x00, 0x78, 0x94, 0x92, 0x09, 0x2F, 0xD6, 0xD9, 0xF3, 0x29, 0xE6, 0x24, 0x32, 0x66, 0x22, 0x41, 0xC4, 0x7C, 0x05, 0x98, 0x44, 0x4F, 0x99, 0xA9, 0xE1, 0x8F, 0x08, 0x1A, 0x2A, 0x11, 0xEA, 0x3B, 0xE2, 0x38, 0xB8, 0x18, 0xF9, 0xD4, 0xC7, 0x62, 0x7B, 0x75, 0x58, 0x96, 0x28, 0xEB, 0x06, 0x84, 0x89, 0x48, 0x82, 0x88, 0xA6, 0xFE, 0xA0, 0xF2, 0xF8, 0x1D, 0x8B, 0xFC, 0xA8, 0x21, 0x30, 0xBB, 0x07, 0xBA, 0x4D] l = [] for i in a1: for j in range(0,256): if (i == byte1[j]): l.append(j) l1 = [] for i in l: for j in range(0,256): if (i == byte2[j]): l1.append(j) l2 = [] for i in l1: for j in range(0,256): if (i == byte3[j]): l2.append(j) l3 = [] for i in l2: for j in range(0,256): if (i == byte4[j]): l3.append(j) l4 = [] for i in l3: for j in range(0,256): if (i == byte5[j]): l4.append(j) l5 = [] for i in l4: for j in range(0,256): if (i == byte6[j]): l5.append(j) l6 = [] for i in l5: for j in range(0,256): if (i == byte7[j]): l6.append(j) l7 = [] for i in l6: for j in range(0,256): if (i == byte8[j]): l7.append(j) l8 = [] for i in l7: for j in range(0,256): if (i == byte9[j]): l8.append(j) l9 = [] for i in l8: for j in range(0,256): if (i == byte10[j]): l9.append(j) for i in l9: print(chr(i&0x7f),end='') print() print(chr(0x23)) print(chr(0x21))
因为当时代码没写好，所以分成了两个程序，最后把结果加上头和尾，头和尾就是自解密函数的两个密钥
flag:#yu370_4r7m_3_h453r_0f_r3v3r51n6_!
