튜기's blogggg

defcon2019 veryandroidoso

by St1tch

Reversing/리버싱 문제풀이

apk문제인데, 처음 문제를 보자마자 후킹으로 풀면 편할 것 같다는 생각을 했다.

문제는 18글자의 플래그를 맞추면 끝나는 문제인데, 검사를 할 때는 2 글자씩 hex로 바꿔서 검증을 하기 때문에, 총 9번의 검증 루틴을 통과하면 플래그를 얻을 수 있다.

사실상 8번째 까지는 후킹으로 빠르게 값을 뽑아낼 수 있다.

마지막 한글자가 8번째까지의 입력한 값들에 따라 바뀌기 때문에, 이에 대한 처리만 잘해주면 된다.

우선, 필요한 함수들은 frida에서 바로바로 호출해서 쓸 수 있으니, 필요한 데이터들을 먼저 골라냈다.

 

1. 입력값에 대한 dictionary 정보 및 getSecretNumber 정보 추출.

- 각 조건에 맞는 글자들의 경우의수가 1가지가 아니기 때문에, 쉽게 풀기 위해서는 입력값과 검증 함수에 들어가는 값의 사전 정보가 필요하다.

- 브루트포싱시 getSecretNumer를 계속 호출하면, 속도가 느려지기 때문에, 어차피 고정된 값이니 미리 추출해서 사용하면 빠르다.

 

import re
dat = open('prob.java', 'rb').read()
m_dic = [{}, {}, {}, {}, {}, {}, {}, {}, {},]
'''
i10 = m2(i10, getSecretNumber(scramble));
-> i10 = m2(255, getSecretNumber(scramble));
'''
for i in range(9):
regex = "m%s\([0-9]{1,3},"%(i)
tmp = map(lambda x:eval(x.split('(')[1].split(',')[0]), re.findall(regex, dat))
for idx in range(len(tmp)):
m_dic[i][tmp[idx]] = idx
for i in range(9):
if len(m_dic[i]) != 256:
print i, m_dic[i]
print m_dic[2]
view raw exdic.py hosted with ❤ by GitHub
Java.perform(function () {
console.log("[*] Hooking start...")
main = Java.use("ooo.defcon2019.quals.veryandroidoso.MainActivity")
solver = Java.use("ooo.defcon2019.quals.veryandroidoso.Solver")
main.fail.implementation = function () {
for (var i = 0; i < 256; i++) {
var tmp = solver.getSecretNumber(i);
console.log(i, ":", tmp);
};
console.log("[*] fail called");
};
});
view raw get_secret.js hosted with ❤ by GitHub

 

2. flag의 8번째 글자까지의 모든 경우 알아내기.

- 후킹을 fail함수에 걸고, 각 스테이지의 함수들을 호출하였다.

- 각 스테이지에서 만족하는 값들을 모두 출력을 하였고, 다음 단계에서 이를 이용해 마지막 한 바이트를 찾아야 한다.

Java.perform(function () {
console.log("[*] Hooking...")
main = Java.use("ooo.defcon2019.quals.veryandroidoso.MainActivity")
solver = Java.use("ooo.defcon2019.quals.veryandroidoso.Solver")
main.fail.implementation = function () {
console.log("[*] trace start...")
var scramble = solver.scramble(13)
var res = []
for (var i = 0; i < 256; i++) {
var tmp = solver.m0(i, solver.getSecretNumber(scramble));
if ((tmp & 255) == 172) {
res.push(m_dic[0][i]);
};
};
console.log("1 :", res)
scramble = solver.scramble(scramble);
var res = []
for (var i = 0; i < 256; i++) {
var tmp = solver.m1(i, solver.getSecretNumber(scramble));
if ((tmp & 255) == 6) {
res.push(m_dic[1][i]);
};
};
console.log("2 :", res)
scramble = solver.scramble(scramble);
var res = []
for (var i = 0; i < 256; i++) {
var tmp = solver.m2(i, solver.getSecretNumber(scramble));
if ((tmp & 251) == 146) {
res.push(m_dic[2][i]);
};
};
console.log("3 :", res)
scramble = solver.scramble(scramble);
var res = []
for (var i = 0; i < 256; i++) {
var tmp = solver.m3(i, solver.getSecretNumber(scramble));
if ((tmp & 247) == 97) {
res.push(m_dic[3][i]);
};
};
console.log("4 :", res)
scramble = solver.scramble(scramble);
var res = []
for (var i = 0; i < 256; i++) {
var tmp = solver.m4(i, solver.getSecretNumber(scramble));
if ((tmp & 202) == 130) {
res.push(m_dic[4][i]);
};
};
console.log("5 :", res)
var res = []
for (var i = 0; i < 256; i++) {
if ((i & 65) == 65) {
res.push(i);
};
};
console.log("6 :", res);
scramble = solver.scramble(scramble);
var res = []
for (var i = 0; i < 256; i++) {
var tmp = solver.m6(i, solver.getSecretNumber(scramble));
if ((tmp & 255) == 236) {
res.push(m_dic[6][i]);
};
};
console.log("7 :", res);
scramble = solver.scramble(scramble);
var res = []
for (var i = 0; i < 256; i++) {
var tmp = solver.m7(i, solver.getSecretNumber(scramble));
if ((tmp & 255) == 142) {
res.push(m_dic[7][i]);
};
};
console.log("8 :", res);
};
solver.scramble.implementation = function (arg1) {
return (arg1 + 323) % 256;
};
solver.getSecretNumber.implementation = function (arg1) {
return secret[arg1];
};
});
view raw trace.js hosted with ❤ by GitHub

 

3. 브루트 포싱 ~ 

- 3,4,5,6번째 글자의 경우의 수가 각각 2,2,16,64 이므로 총 4096의 경우의 수가 있다.

4096번에 각각의 경우에 수에 맞는 마지막 바이트를 찾고, 완성된 값이 마지막 검증에서 통과하는지를 알아내야 한다.

 

solve함수를 호출하여 하나하나 확인을 하면 너무 오래걸린다. 뭐 sleep함수에 후킹을 걸어 시간을 줄일 수는 있다.

나는 마지막 검증에 사용하는 m8, m9함수를 바로 호출해서 빠르게 플래그를 얻을 수 있었다..

 

Java.perform(function () {
console.log("[*] Hooking start...")
main = Java.use("ooo.defcon2019.quals.veryandroidoso.MainActivity")
solver = Java.use("ooo.defcon2019.quals.veryandroidoso.Solver")
main.fail.implementation = function () {
console.log("[*] fail called")
arr1 = [52, 254]
arr2 = [22, 176]
arr3 = [221, 244, 147, 102, 238, 63, 247, 49, 145, 254, 72, 136, 118, 203, 120, 74]
arr4 = [65, 67, 69, 71, 73, 75, 77, 79, 81, 83, 85, 87, 89, 91, 93, 95, 97, 99, 101, 103, 105, 107, 109, 111, 113, 115, 117, 119, 121, 123, 125, 127, 193, 195, 197, 199, 201, 203, 205, 207, 209, 211, 213, 215, 217, 219, 221, 223, 225, 227, 229, 231, 233, 235, 237, 239, 241, 243, 245, 247, 249, 251, 253, 255]
var cnt = 0;
for (var ii = 0; ii < 2; ii++) {
for (var jj = 0; jj < 2; jj++) {
for (var kk = 0; kk < 16; kk++) {
for (var ll = 0; ll < 64; ll++) {
if ((cnt % 100) == 0) {
console.log(cnt);
};
cnt = cnt + 1;
var good;
var i = arr1[ii]
var j = arr2[jj]
var k = arr3[kk]
var l = arr4[ll]
solver.m9(((((((250 + 180) + i) + j) + k) + l) + (68 * 190)));
for (var a = 0; a < 256; a++) {
var tmp = solver.m8(a, secret[227]);
if ((tmp & 255) == 103) {
good = m_dic[8][a];
break;
};
};
if ((((((((((secret[250]) * (secret[180])) * (secret[i])) * (secret[j])) * (secret[k])) * (secret[l])) * (secret[68])) + (190)) + (secret[good])) % 144 == 37) {
console.log("OOO{" + (250).toString(16) + (180).toString(16) + i.toString(16) + j.toString(16) + k.toString(16) + l.toString(16) + (68).toString(16) + (190).toString(16) + good.toString(16) + "}");
this.win();
return;
}
}
}
}
}
};
});
view raw solve.js hosted with ❤ by GitHub

 

 

이 문제는 후킹없이도 충분히 풀 수 있는 문제이지만, 분석을 조금 덜 하고 그냥  필요한 값들이나 함수를 후킹을 통해 얻은 후, 필요한 부분만 구현하여 플래그를 얻을 수 있는 그런 문제였다.

 

 

(아래는 후킹없이 구현해서 푼 코드. ㅇㅅㅇ)

s1 = [17, 143, 36, 128, 90, 119, 37, 114, 235, 59, 251, 219, 32, 39, 29, 69, 134, 87, 89, 79, 200, 254, 93, 211, 53, 244, 85, 30, 245, 23, 64, 131, 252, 232, 149, 80, 246, 120, 207, 35, 2, 111, 7, 15, 230, 214, 198, 208, 238, 213, 182, 133, 250, 220, 66, 92, 201, 107, 96, 224, 186, 71, 65, 193, 173, 239, 88, 212, 160, 51, 194, 247, 167, 215, 4, 179, 172, 48, 68, 22, 157, 118, 70, 164, 12, 127, 165, 62, 196, 234, 221, 181, 222, 210, 249, 166, 52, 159, 5, 44, 115, 113, 41, 40, 3, 16, 243, 255, 177, 175, 43, 146, 49, 190, 81, 125, 25, 233, 180, 100, 14, 155, 168, 144, 34, 192, 98, 204, 27, 161, 33, 163, 91, 138, 240, 74, 206, 226, 26, 154, 241, 108, 150, 141, 1, 61, 110, 135, 169, 126, 223, 162, 6, 189, 156, 176, 11, 105, 152, 101, 67, 56, 99, 106, 84, 237, 97, 86, 73, 21, 47, 121, 145, 124, 24, 187, 171, 140, 148, 38, 117, 75, 77, 109, 45, 209, 137, 18, 94, 185, 216, 136, 142, 228, 170, 236, 229, 242, 72, 188, 225, 202, 63, 129, 103, 203, 183, 158, 218, 102, 199, 0, 139, 78, 82, 76, 19, 231, 174, 60, 50, 153, 122, 10, 13, 20, 195, 248, 104, 253, 205, 54, 197, 227, 184, 42, 130, 116, 55, 191, 123, 95, 58, 83, 217, 178, 151, 28, 9, 147, 46, 31, 8, 112, 57, 132]
s2 = [24, 0, 154, 42, 104, 111, 17, 207, 236, 112, 127, 155, 83, 160, 130, 9, 12, 21, 37, 133, 186, 15, 254, 234, 212, 229, 252, 206, 248, 191, 56, 174, 231, 182, 171, 156, 139, 152, 247, 243, 13, 66, 132, 213, 196, 158, 166, 177, 194, 60, 165, 19, 26, 221, 203, 100, 72, 86, 123, 135, 250, 180, 14, 85, 146, 1, 210, 114, 124, 192, 18, 106, 27, 149, 181, 102, 95, 69, 148, 173, 199, 40, 8, 244, 107, 113, 228, 215, 49, 25, 6, 193, 225, 205, 238, 169, 241, 122, 31, 22, 77, 131, 57, 88, 144, 145, 189, 153, 222, 51, 129, 246, 28, 232, 2, 141, 137, 101, 10, 97, 125, 224, 208, 219, 233, 68, 187, 61, 70, 195, 20, 103, 142, 52, 150, 55, 4, 216, 82, 170, 188, 78, 164, 63, 11, 99, 197, 220, 7, 96, 235, 38, 168, 110, 93, 39, 34, 92, 54, 162, 90, 242, 211, 109, 157, 45, 30, 87, 159, 117, 136, 29, 147, 73, 198, 116, 91, 23, 245, 218, 121, 240, 161, 185, 53, 41, 36, 126, 33, 3, 163, 184, 223, 167, 16, 59, 251, 50, 202, 178, 74, 255, 176, 249, 183, 172, 62, 237, 80, 214, 230, 227, 79, 253, 81, 65, 46, 239, 226, 67, 204, 134, 32, 44, 217, 98, 64, 43, 200, 94, 119, 115, 138, 140, 47, 209, 75, 128, 175, 58, 151, 179, 105, 84, 89, 120, 5, 201, 35, 118, 76, 48, 143, 71, 108, 190]
s3 = [63, 229, 55, 24, 146, 177, 41, 242, 39, 240, 133, 250, 69, 203, 253, 33, 127, 191, 79, 196, 50, 172, 230, 122, 226, 141, 211, 93, 109, 167, 20, 232, 245, 142, 176, 47, 169, 126, 255, 120, 201, 84, 18, 163, 140, 31, 2, 136, 216, 81, 209, 16, 14, 149, 97, 181, 22, 159, 114, 115, 28, 74, 112, 178, 219, 164, 94, 80, 77, 73, 231, 183, 244, 29, 99, 205, 8, 220, 15, 117, 0, 9, 102, 105, 217, 44, 154, 17, 119, 104, 107, 61, 152, 95, 56, 252, 106, 162, 87, 251, 12, 52, 234, 207, 197, 51, 239, 49, 113, 254, 222, 247, 215, 82, 138, 161, 37, 185, 131, 128, 228, 144, 249, 19, 4, 139, 11, 42, 190, 5, 124, 59, 223, 213, 26, 48, 121, 173, 166, 58, 64, 21, 200, 237, 23, 89, 145, 165, 175, 1, 157, 135, 36, 186, 180, 241, 30, 66, 53, 238, 118, 199, 150, 206, 86, 90, 225, 91, 46, 179, 25, 155, 214, 35, 193, 100, 65, 189, 40, 221, 137, 116, 62, 6, 54, 45, 129, 71, 32, 130, 148, 96, 170, 153, 182, 57, 111, 125, 187, 168, 246, 143, 210, 43, 212, 110, 160, 188, 83, 72, 67, 92, 218, 195, 134, 208, 147, 98, 13, 171, 243, 236, 75, 194, 204, 108, 158, 198, 10, 7, 156, 227, 3, 184, 174, 132, 78, 27, 76, 60, 123, 192, 38, 248, 233, 68, 101, 85, 151, 34, 224, 103, 202, 88, 70, 235]
s4 = [0 for _ in range(256)]
s5 = [14, 141, 205, 28, 40, 251, 154, 240, 30, 164, 171, 193, 49, 232, 169, 119, 194, 249, 252, 216, 31, 118, 244, 27, 44, 127, 124, 79, 60, 250, 217, 179, 93, 224, 110, 156, 170, 9, 138, 77, 204, 135, 254, 61, 66, 86, 50, 121, 197, 23, 202, 182, 39, 120, 175, 178, 233, 0, 130, 85, 131, 144, 8, 41, 16, 173, 17, 57, 222, 35, 185, 219, 206, 92, 174, 241, 125, 199, 78, 42, 212, 177, 198, 243, 147, 73, 102, 207, 45, 186, 15, 221, 134, 43, 168, 238, 47, 91, 21, 117, 53, 13, 18, 180, 191, 32, 56, 236, 181, 203, 142, 228, 38, 157, 6, 214, 195, 192, 126, 90, 215, 114, 155, 54, 3, 46, 183, 68, 70, 158, 159, 253, 26, 88, 101, 103, 188, 145, 136, 106, 208, 165, 107, 100, 25, 209, 96, 139, 55, 113, 5, 109, 150, 225, 229, 94, 163, 248, 111, 167, 226, 140, 89, 132, 67, 4, 128, 12, 58, 172, 83, 37, 123, 2, 22, 162, 143, 237, 7, 230, 184, 242, 62, 227, 190, 48, 187, 146, 64, 82, 71, 149, 59, 1, 84, 246, 122, 218, 99, 20, 76, 201, 74, 153, 129, 87, 148, 200, 213, 105, 29, 19, 108, 80, 220, 72, 166, 160, 116, 239, 34, 10, 211, 115, 161, 65, 24, 69, 75, 95, 112, 210, 152, 63, 97, 51, 133, 137, 235, 231, 245, 234, 104, 247, 151, 189, 223, 176, 36, 52, 81, 33, 98, 11, 255, 196]
m0 = lambda v2, v3 : ((v3 - 123) % 256 + 256) % 256 ^ (v2 + 37) % 256
m1 = lambda v2, v3 : ((v3 - 125) % 256 + 256) % 256 ^ (v2 + 39) % 256
m2 = lambda v2, v3 : ((v3 - 3) % 256 + 256) % 256 ^ (v2 + 12) % 256
m3 = lambda v2, v3 : ((v3 - 21) % 256 + 256) % 256 ^ (v2 + 44) % 256
m4 = lambda v2, v3 : ((v3 - 77) % 256 + 256) % 256 ^ (v2 + 123) % 256
m5 = lambda v2, v3 : ((v3 - 123) % 256 + 256) % 256 ^ (v2 + 37) % 256
m6 = lambda v2, v3 : ((v3 - 99) % 256 + 256) % 256 ^ (v2 + 37) % 256
m7 = lambda v2, v3 : s2[v2 + 89 - ((v2 + 89 + (((v2 + 89) >> 31) >> 24)) & 0x3FFFFF00)] ^ s1[(v3 - 16) % 256 + 256 - (((v3 - 16) % 256 + 256 + ((((v3 - 16) % 256 + 256) >> 31) >> 24)) & 0x3FFFFF00)]
m8 = lambda v2, v3 : s4[v2 + 34 - ((v2 + 34 + (((v2 + 34) >> 31) >> 24)) & 0x3FFFFF00)] ^ s3[(v3 - 24) % 256 + 256 - (((v3 - 24) % 256 + 256 + ((((v3 - 24) % 256 + 256) >> 31) >> 24)) & 0x3FFFFF00)]
m_dic = [{0: 246, 1: 236, 2: 226, 3: 248, 4: 165, 5: 177, 6: 114, 7: 31, 8: 198, 9: 125, 10: 79, 11: 216, 12: 51, 13: 103, 14: 108, 15: 169, 16: 218, 17: 193, 18: 9, 19: 190, 20: 26, 21: 116, 22: 176, 23: 22, 24: 141, 25: 199, 26: 241, 27: 88, 28: 20, 29: 77, 30: 181, 31: 229, 32: 37, 33: 110, 34: 98, 35: 231, 36: 124, 37: 207, 38: 156, 39: 8, 40: 143, 41: 48, 42: 58, 43: 42, 44: 112, 45: 105, 46: 213, 47: 6, 48: 67, 49: 102, 50: 34, 51: 166, 52: 109, 53: 250, 54: 155, 55: 201, 56: 86, 57: 151, 58: 126, 59: 194, 60: 183, 61: 255, 62: 111, 63: 69, 64: 119, 65: 172, 66: 25, 67: 28, 68: 99, 69: 64, 70: 160, 71: 38, 72: 158, 73: 24, 74: 192, 75: 132, 76: 134, 77: 214, 78: 146, 79: 81, 80: 136, 81: 61, 82: 54, 83: 244, 84: 239, 85: 161, 86: 245, 87: 242, 88: 2, 89: 65, 90: 153, 91: 203, 92: 178, 93: 243, 94: 228, 95: 73, 96: 95, 97: 4, 98: 164, 99: 174, 100: 0, 101: 53, 102: 76, 103: 234, 104: 94, 105: 87, 106: 202, 107: 163, 108: 182, 109: 217, 110: 36, 111: 120, 112: 127, 113: 43, 114: 13, 115: 62, 116: 14, 117: 40, 118: 185, 119: 197, 120: 131, 121: 115, 122: 205, 123: 121, 124: 123, 125: 71, 126: 142, 127: 186, 128: 56, 129: 68, 130: 129, 131: 118, 132: 74, 133: 188, 134: 104, 135: 184, 136: 60, 137: 237, 138: 195, 139: 66, 140: 148, 141: 179, 142: 235, 143: 75, 144: 11, 145: 135, 146: 80, 147: 170, 148: 44, 149: 83, 150: 17, 151: 247, 152: 16, 153: 232, 154: 70, 155: 97, 156: 30, 157: 12, 158: 149, 159: 189, 160: 204, 161: 154, 162: 90, 163: 253, 164: 225, 165: 240, 166: 147, 167: 249, 168: 220, 169: 101, 170: 215, 171: 162, 172: 59, 173: 10, 174: 223, 175: 19, 176: 251, 177: 49, 178: 55, 179: 21, 180: 233, 181: 208, 182: 140, 183: 175, 184: 180, 185: 47, 186: 113, 187: 238, 188: 167, 189: 230, 190: 1, 191: 57, 192: 145, 193: 92, 194: 39, 195: 196, 196: 18, 197: 191, 198: 138, 199: 78, 200: 29, 201: 91, 202: 100, 203: 159, 204: 224, 205: 187, 206: 200, 207: 152, 208: 93, 209: 96, 210: 33, 211: 209, 212: 210, 213: 23, 214: 173, 215: 222, 216: 5, 217: 46, 218: 206, 219: 139, 220: 41, 221: 32, 222: 128, 223: 150, 224: 133, 225: 82, 226: 106, 227: 252, 228: 27, 229: 254, 230: 221, 231: 137, 232: 52, 233: 35, 234: 211, 235: 89, 236: 84, 237: 171, 238: 168, 239: 50, 240: 3, 241: 212, 242: 72, 243: 7, 244: 117, 245: 85, 246: 144, 247: 45, 248: 122, 249: 219, 250: 15, 251: 63, 252: 157, 253: 227, 254: 130, 255: 107}, {0: 135, 1: 194, 2: 220, 3: 208, 4: 18, 5: 56, 6: 15, 7: 93, 8: 107, 9: 10, 10: 228, 11: 167, 12: 211, 13: 234, 14: 185, 15: 250, 16: 34, 17: 224, 18: 28, 19: 108, 20: 245, 21: 251, 22: 157, 23: 125, 24: 37, 25: 60, 26: 96, 27: 192, 28: 53, 29: 0, 30: 243, 31: 102, 32: 137, 33: 71, 34: 147, 35: 180, 36: 136, 37: 57, 38: 83, 39: 153, 40: 82, 41: 130, 42: 171, 43: 105, 44: 12, 45: 186, 46: 225, 47: 113, 48: 177, 49: 54, 50: 63, 51: 246, 52: 140, 53: 214, 54: 183, 55: 174, 56: 181, 57: 46, 58: 19, 59: 244, 60: 116, 61: 109, 62: 17, 63: 151, 64: 207, 65: 205, 66: 152, 67: 178, 68: 216, 69: 195, 70: 182, 71: 134, 72: 22, 73: 221, 74: 86, 75: 159, 76: 111, 77: 164, 78: 184, 79: 11, 80: 128, 81: 68, 82: 3, 83: 242, 84: 21, 85: 76, 86: 69, 87: 145, 88: 106, 89: 188, 90: 119, 91: 201, 92: 95, 93: 58, 94: 215, 95: 144, 96: 193, 97: 217, 98: 161, 99: 81, 100: 168, 101: 98, 102: 65, 103: 229, 104: 146, 105: 38, 106: 129, 107: 222, 108: 155, 109: 210, 110: 198, 111: 114, 112: 226, 113: 203, 114: 30, 115: 236, 116: 43, 117: 120, 118: 62, 119: 99, 120: 117, 121: 172, 122: 196, 123: 94, 124: 162, 125: 197, 126: 25, 127: 51, 128: 209, 129: 50, 130: 115, 131: 1, 132: 48, 133: 75, 134: 241, 135: 16, 136: 232, 137: 32, 138: 44, 139: 156, 140: 26, 141: 92, 142: 33, 143: 7, 144: 88, 145: 89, 146: 66, 147: 142, 148: 59, 149: 166, 150: 143, 151: 219, 152: 218, 153: 212, 154: 39, 155: 74, 156: 202, 157: 112, 158: 124, 159: 36, 160: 131, 161: 91, 162: 173, 163: 35, 164: 101, 165: 176, 166: 64, 167: 14, 168: 154, 169: 42, 170: 80, 171: 24, 172: 103, 173: 213, 174: 2, 175: 23, 176: 78, 177: 227, 178: 55, 179: 6, 180: 240, 181: 73, 182: 8, 183: 5, 184: 189, 185: 97, 186: 40, 187: 187, 188: 27, 189: 123, 190: 160, 191: 248, 192: 122, 193: 165, 194: 85, 195: 238, 196: 206, 197: 72, 198: 254, 199: 127, 200: 4, 201: 70, 202: 150, 203: 13, 204: 84, 205: 31, 206: 45, 207: 121, 208: 79, 209: 41, 210: 253, 211: 179, 212: 90, 213: 190, 214: 239, 215: 175, 216: 9, 217: 199, 218: 235, 219: 47, 220: 255, 221: 132, 222: 87, 223: 100, 224: 77, 225: 230, 226: 249, 227: 170, 228: 200, 229: 149, 230: 138, 231: 67, 232: 148, 233: 133, 234: 49, 235: 247, 236: 223, 237: 163, 238: 61, 239: 237, 240: 169, 241: 110, 242: 20, 243: 204, 244: 158, 245: 233, 246: 139, 247: 52, 248: 141, 249: 104, 250: 29, 251: 252, 252: 118, 253: 126, 254: 231, 255: 191}, {0: 157, 1: 222, 2: 174, 3: 138, 4: 250, 5: 66, 6: 112, 7: 254, 8: 180, 9: 107, 10: 40, 11: 52, 12: 23, 13: 115, 14: 21, 15: 6, 16: 99, 17: 137, 18: 81, 19: 190, 20: 177, 21: 179, 22: 36, 23: 75, 24: 178, 25: 161, 26: 91, 27: 76, 28: 43, 29: 206, 30: 1, 31: 233, 32: 53, 33: 194, 34: 239, 35: 181, 36: 224, 37: 214, 38: 127, 39: 210, 40: 29, 41: 247, 42: 227, 43: 236, 44: 101, 45: 228, 46: 73, 47: 199, 48: 93, 49: 70, 50: 17, 51: 139, 52: 30, 53: 153, 54: 16, 55: 41, 56: 14, 57: 79, 58: 57, 59: 204, 60: 170, 61: 215, 62: 142, 63: 147, 64: 54, 65: 231, 66: 28, 67: 155, 68: 219, 69: 165, 70: 105, 71: 82, 72: 68, 73: 172, 74: 241, 75: 176, 76: 248, 77: 22, 78: 3, 79: 38, 80: 124, 81: 152, 82: 18, 83: 95, 84: 48, 85: 44, 86: 211, 87: 242, 88: 84, 89: 216, 90: 167, 91: 196, 92: 8, 93: 10, 94: 129, 95: 148, 96: 186, 97: 126, 98: 2, 99: 159, 100: 246, 101: 249, 102: 164, 103: 90, 104: 195, 105: 234, 106: 96, 107: 109, 108: 60, 109: 88, 110: 64, 111: 59, 112: 19, 113: 205, 114: 37, 115: 97, 116: 197, 117: 168, 118: 238, 119: 118, 120: 71, 121: 122, 122: 202, 123: 20, 124: 121, 125: 156, 126: 145, 127: 140, 128: 209, 129: 188, 130: 98, 131: 89, 132: 252, 133: 100, 134: 33, 135: 192, 136: 11, 137: 201, 138: 135, 139: 221, 140: 86, 141: 182, 142: 61, 143: 39, 144: 51, 145: 27, 146: 225, 147: 56, 148: 136, 149: 128, 150: 160, 151: 5, 152: 154, 153: 158, 154: 46, 155: 74, 156: 15, 157: 218, 158: 193, 159: 189, 160: 113, 161: 255, 162: 226, 163: 125, 164: 102, 165: 183, 166: 229, 167: 134, 168: 50, 169: 146, 170: 80, 171: 7, 172: 230, 173: 203, 174: 42, 175: 49, 176: 58, 177: 198, 178: 171, 179: 110, 180: 94, 181: 175, 182: 104, 183: 253, 184: 24, 185: 77, 186: 151, 187: 63, 188: 111, 189: 191, 190: 114, 191: 251, 192: 212, 193: 132, 194: 244, 195: 65, 196: 85, 197: 119, 198: 4, 199: 150, 200: 217, 201: 184, 202: 130, 203: 83, 204: 106, 205: 143, 206: 12, 207: 55, 208: 26, 209: 116, 210: 141, 211: 187, 212: 237, 213: 32, 214: 25, 215: 240, 216: 62, 217: 162, 218: 108, 219: 67, 220: 13, 221: 45, 222: 235, 223: 87, 224: 31, 225: 220, 226: 120, 227: 34, 228: 149, 229: 163, 230: 117, 231: 232, 232: 72, 233: 78, 234: 173, 235: 69, 236: 9, 237: 185, 238: 133, 239: 144, 240: 123, 241: 103, 242: 208, 243: 131, 244: 169, 245: 207, 246: 166, 247: 200, 248: 47, 249: 245, 250: 35, 251: 92, 252: 213, 253: 243, 254: 223, 255: 0}, {0: 32, 1: 0, 2: 136, 3: 236, 4: 50, 5: 94, 6: 155, 7: 243, 8: 54, 9: 177, 10: 216, 11: 158, 12: 106, 13: 238, 14: 60, 15: 213, 16: 82, 17: 9, 18: 246, 19: 127, 20: 241, 21: 174, 22: 168, 23: 152, 24: 122, 25: 86, 26: 77, 27: 200, 28: 57, 29: 48, 30: 30, 31: 250, 32: 19, 33: 115, 34: 73, 35: 255, 36: 235, 37: 197, 38: 107, 39: 79, 40: 20, 41: 56, 42: 228, 43: 222, 44: 36, 45: 62, 46: 120, 47: 237, 48: 160, 49: 153, 50: 139, 51: 65, 52: 14, 53: 182, 54: 89, 55: 80, 56: 251, 57: 175, 58: 51, 59: 5, 60: 181, 61: 75, 62: 40, 63: 15, 64: 137, 65: 6, 66: 71, 67: 234, 68: 145, 69: 166, 70: 193, 71: 44, 72: 128, 73: 31, 74: 76, 75: 126, 76: 151, 77: 191, 78: 194, 79: 248, 80: 43, 81: 209, 82: 104, 83: 205, 84: 123, 85: 13, 86: 38, 87: 117, 88: 91, 89: 208, 90: 134, 91: 88, 92: 24, 93: 169, 94: 61, 95: 70, 96: 207, 97: 26, 98: 219, 99: 12, 100: 231, 101: 25, 102: 172, 103: 233, 104: 253, 105: 186, 106: 28, 107: 35, 108: 49, 109: 109, 110: 162, 111: 198, 112: 129, 113: 148, 114: 140, 115: 189, 116: 7, 117: 8, 118: 42, 119: 164, 120: 173, 121: 97, 122: 11, 123: 37, 124: 239, 125: 229, 126: 112, 127: 199, 128: 203, 129: 87, 130: 147, 131: 17, 132: 22, 133: 23, 134: 2, 135: 245, 136: 184, 137: 105, 138: 154, 139: 150, 140: 176, 141: 178, 142: 72, 143: 230, 144: 29, 145: 187, 146: 163, 147: 215, 148: 144, 149: 249, 150: 58, 151: 247, 152: 110, 153: 33, 154: 171, 155: 220, 156: 141, 157: 69, 158: 185, 159: 64, 160: 143, 161: 78, 162: 179, 163: 3, 164: 41, 165: 218, 166: 188, 167: 100, 168: 142, 169: 113, 170: 254, 171: 149, 172: 240, 173: 118, 174: 99, 175: 170, 176: 103, 177: 21, 178: 4, 179: 45, 180: 83, 181: 90, 182: 121, 183: 68, 184: 47, 185: 74, 186: 204, 187: 114, 188: 224, 189: 210, 190: 180, 191: 84, 192: 34, 193: 93, 194: 214, 195: 202, 196: 161, 197: 46, 198: 108, 199: 59, 200: 252, 201: 227, 202: 165, 203: 63, 204: 18, 205: 183, 206: 16, 207: 92, 208: 130, 209: 55, 210: 212, 211: 98, 212: 66, 213: 159, 214: 223, 215: 232, 216: 95, 217: 196, 218: 135, 219: 211, 220: 132, 221: 119, 222: 67, 223: 1, 224: 10, 225: 156, 226: 195, 227: 102, 228: 124, 229: 206, 230: 27, 231: 96, 232: 225, 233: 39, 234: 244, 235: 53, 236: 226, 237: 167, 238: 242, 239: 125, 240: 221, 241: 157, 242: 146, 243: 201, 244: 52, 245: 217, 246: 138, 247: 85, 248: 81, 249: 190, 250: 111, 251: 131, 252: 192, 253: 116, 254: 133, 255: 101}, {0: 171, 1: 217, 2: 51, 3: 43, 4: 105, 5: 246, 6: 67, 7: 13, 8: 92, 9: 109, 10: 4, 11: 55, 12: 168, 13: 221, 14: 244, 15: 93, 16: 115, 17: 147, 18: 102, 19: 91, 20: 56, 21: 151, 22: 126, 23: 88, 24: 68, 25: 16, 26: 29, 27: 224, 28: 141, 29: 238, 30: 63, 31: 149, 32: 161, 33: 247, 34: 49, 35: 119, 36: 253, 37: 95, 38: 57, 39: 9, 40: 188, 41: 219, 42: 129, 43: 146, 44: 197, 45: 145, 46: 254, 47: 152, 48: 183, 49: 72, 50: 136, 51: 46, 52: 22, 53: 174, 54: 44, 55: 150, 56: 184, 57: 117, 58: 2, 59: 84, 60: 226, 61: 118, 62: 203, 63: 207, 64: 172, 65: 120, 66: 74, 67: 140, 68: 138, 69: 58, 70: 37, 71: 181, 72: 36, 73: 53, 74: 132, 75: 87, 76: 130, 77: 236, 78: 7, 79: 159, 80: 204, 81: 243, 82: 242, 83: 220, 84: 83, 85: 218, 86: 200, 87: 182, 88: 111, 89: 19, 90: 214, 91: 162, 92: 73, 93: 112, 94: 240, 95: 54, 96: 205, 97: 225, 98: 71, 99: 64, 100: 101, 101: 33, 102: 98, 103: 137, 104: 47, 105: 106, 106: 75, 107: 227, 108: 209, 109: 169, 110: 10, 111: 107, 112: 179, 113: 59, 114: 190, 115: 212, 116: 28, 117: 241, 118: 77, 119: 191, 120: 185, 121: 81, 122: 155, 123: 48, 124: 148, 125: 167, 126: 154, 127: 178, 128: 213, 129: 66, 130: 5, 131: 21, 132: 160, 133: 69, 134: 41, 135: 100, 136: 157, 137: 173, 138: 177, 139: 234, 140: 163, 141: 122, 142: 38, 143: 6, 144: 0, 145: 79, 146: 193, 147: 134, 148: 222, 149: 86, 150: 189, 151: 89, 152: 198, 153: 216, 154: 76, 155: 3, 156: 201, 157: 18, 158: 1, 159: 31, 160: 180, 161: 24, 162: 143, 163: 233, 164: 78, 165: 211, 166: 133, 167: 96, 168: 40, 169: 114, 170: 8, 171: 104, 172: 85, 173: 42, 174: 248, 175: 187, 176: 103, 177: 80, 178: 176, 179: 60, 180: 249, 181: 26, 182: 125, 183: 61, 184: 27, 185: 170, 186: 34, 187: 230, 188: 52, 189: 228, 190: 82, 191: 232, 192: 62, 193: 139, 194: 144, 195: 166, 196: 156, 197: 153, 198: 70, 199: 124, 200: 128, 201: 194, 202: 17, 203: 210, 204: 158, 205: 39, 206: 50, 207: 90, 208: 206, 209: 237, 210: 215, 211: 231, 212: 202, 213: 113, 214: 14, 215: 65, 216: 123, 217: 245, 218: 229, 219: 110, 220: 252, 221: 192, 222: 45, 223: 239, 224: 196, 225: 131, 226: 99, 227: 199, 228: 195, 229: 116, 230: 127, 231: 251, 232: 223, 233: 23, 234: 164, 235: 15, 236: 165, 237: 20, 238: 121, 239: 235, 240: 186, 241: 175, 242: 135, 243: 142, 244: 32, 245: 25, 246: 12, 247: 94, 248: 35, 249: 255, 250: 11, 251: 108, 252: 250, 253: 208, 254: 30, 255: 97}, {}, {0: 63, 1: 214, 2: 166, 3: 227, 4: 64, 5: 205, 6: 0, 7: 105, 8: 34, 9: 87, 10: 45, 11: 123, 12: 211, 13: 101, 14: 122, 15: 199, 16: 81, 17: 108, 18: 76, 19: 13, 20: 209, 21: 182, 22: 190, 23: 24, 24: 20, 25: 26, 26: 167, 27: 27, 28: 157, 29: 218, 30: 32, 31: 252, 32: 242, 33: 28, 34: 94, 35: 165, 36: 129, 37: 150, 38: 229, 39: 137, 40: 174, 41: 197, 42: 8, 43: 183, 44: 175, 45: 33, 46: 249, 47: 142, 48: 206, 49: 202, 50: 224, 51: 77, 52: 253, 53: 159, 54: 231, 55: 247, 56: 116, 57: 100, 58: 124, 59: 168, 60: 128, 61: 15, 62: 95, 63: 78, 64: 235, 65: 88, 66: 145, 67: 2, 68: 192, 69: 85, 70: 11, 71: 48, 72: 207, 73: 133, 74: 5, 75: 65, 76: 74, 77: 140, 78: 102, 79: 181, 80: 179, 81: 92, 82: 161, 83: 228, 84: 29, 85: 191, 86: 208, 87: 144, 88: 4, 89: 41, 90: 46, 91: 58, 92: 152, 93: 160, 94: 62, 95: 243, 96: 154, 97: 42, 98: 200, 99: 49, 100: 9, 101: 170, 102: 188, 103: 151, 104: 187, 105: 155, 106: 193, 107: 121, 108: 71, 109: 173, 110: 86, 111: 132, 112: 1, 113: 80, 114: 39, 115: 223, 116: 171, 117: 203, 118: 215, 119: 184, 120: 89, 121: 222, 122: 35, 123: 226, 124: 7, 125: 44, 126: 36, 127: 233, 128: 115, 129: 19, 130: 163, 131: 23, 132: 130, 133: 37, 134: 225, 135: 114, 136: 126, 137: 139, 138: 254, 139: 158, 140: 118, 141: 16, 142: 57, 143: 204, 144: 135, 145: 198, 146: 69, 147: 172, 148: 220, 149: 238, 150: 246, 151: 195, 152: 3, 153: 125, 154: 180, 155: 245, 156: 70, 157: 153, 158: 82, 159: 104, 160: 141, 161: 6, 162: 99, 163: 134, 164: 136, 165: 237, 166: 98, 167: 66, 168: 112, 169: 251, 170: 148, 171: 107, 172: 50, 173: 22, 174: 60, 175: 219, 176: 61, 177: 217, 178: 248, 179: 162, 180: 25, 181: 239, 182: 83, 183: 84, 184: 177, 185: 40, 186: 17, 187: 244, 188: 109, 189: 236, 190: 18, 191: 106, 192: 103, 193: 186, 194: 230, 195: 164, 196: 51, 197: 255, 198: 210, 199: 73, 200: 146, 201: 127, 202: 194, 203: 43, 204: 91, 205: 68, 206: 55, 207: 185, 208: 53, 209: 56, 210: 234, 211: 110, 212: 241, 213: 47, 214: 176, 215: 14, 216: 97, 217: 156, 218: 111, 219: 201, 220: 96, 221: 250, 222: 67, 223: 147, 224: 52, 225: 117, 226: 12, 227: 221, 228: 79, 229: 169, 230: 232, 231: 120, 232: 119, 233: 93, 234: 38, 235: 178, 236: 138, 237: 30, 238: 75, 239: 59, 240: 72, 241: 143, 242: 216, 243: 131, 244: 189, 245: 31, 246: 113, 247: 10, 248: 213, 249: 90, 250: 149, 251: 54, 252: 240, 253: 212, 254: 196, 255: 21}, {0: 227, 1: 206, 2: 61, 3: 180, 4: 224, 5: 202, 6: 178, 7: 124, 8: 28, 9: 228, 10: 236, 11: 98, 12: 25, 13: 237, 14: 179, 15: 122, 16: 189, 17: 182, 18: 71, 19: 20, 20: 164, 21: 169, 22: 241, 23: 166, 24: 104, 25: 123, 26: 24, 27: 102, 28: 185, 29: 194, 30: 197, 31: 230, 32: 201, 33: 200, 34: 244, 35: 121, 36: 13, 37: 226, 38: 63, 39: 110, 40: 60, 41: 193, 42: 211, 43: 27, 44: 34, 45: 159, 46: 107, 47: 151, 48: 35, 49: 165, 50: 120, 51: 54, 52: 46, 53: 173, 54: 128, 55: 138, 56: 217, 57: 68, 58: 153, 59: 170, 60: 5, 61: 132, 62: 248, 63: 213, 64: 163, 65: 191, 66: 62, 67: 66, 68: 44, 69: 51, 70: 100, 71: 105, 72: 171, 73: 75, 74: 116, 75: 148, 76: 112, 77: 233, 78: 4, 79: 199, 80: 56, 81: 88, 82: 36, 83: 245, 84: 45, 85: 78, 86: 162, 87: 118, 88: 18, 89: 143, 90: 82, 91: 113, 92: 94, 93: 187, 94: 142, 95: 101, 96: 141, 97: 2, 98: 147, 99: 212, 100: 6, 101: 152, 102: 149, 103: 89, 104: 172, 105: 96, 106: 176, 107: 161, 108: 115, 109: 208, 110: 204, 111: 23, 112: 70, 113: 175, 114: 234, 115: 11, 116: 80, 117: 215, 118: 67, 119: 79, 120: 131, 121: 42, 122: 242, 123: 111, 124: 218, 125: 37, 126: 57, 127: 10, 128: 7, 129: 190, 130: 127, 131: 177, 132: 154, 133: 53, 134: 99, 135: 32, 136: 29, 137: 48, 138: 72, 139: 238, 140: 207, 141: 81, 142: 254, 143: 184, 144: 58, 145: 235, 146: 253, 147: 95, 148: 232, 149: 196, 150: 160, 151: 216, 152: 9, 153: 255, 154: 50, 155: 174, 156: 222, 157: 214, 158: 49, 159: 17, 160: 203, 161: 83, 162: 85, 163: 252, 164: 125, 165: 19, 166: 103, 167: 186, 168: 1, 169: 198, 170: 209, 171: 65, 172: 108, 173: 40, 174: 14, 175: 205, 176: 146, 177: 220, 178: 33, 179: 77, 180: 55, 181: 16, 182: 155, 183: 210, 184: 93, 185: 106, 186: 52, 187: 251, 188: 129, 189: 134, 190: 157, 191: 247, 192: 140, 193: 243, 194: 150, 195: 39, 196: 188, 197: 119, 198: 92, 199: 30, 200: 192, 201: 76, 202: 74, 203: 91, 204: 86, 205: 250, 206: 117, 207: 41, 208: 0, 209: 15, 210: 167, 211: 22, 212: 21, 213: 130, 214: 90, 215: 47, 216: 221, 217: 135, 218: 144, 219: 126, 220: 229, 221: 97, 222: 246, 223: 158, 224: 87, 225: 183, 226: 59, 227: 223, 228: 114, 229: 26, 230: 137, 231: 73, 232: 8, 233: 43, 234: 156, 235: 195, 236: 219, 237: 109, 238: 84, 239: 249, 240: 31, 241: 136, 242: 3, 243: 231, 244: 64, 245: 145, 246: 139, 247: 69, 248: 225, 249: 239, 250: 133, 251: 168, 252: 240, 253: 12, 254: 38, 255: 181}, {0: 235, 1: 210, 2: 7, 3: 219, 4: 172, 5: 152, 6: 76, 7: 105, 8: 150, 9: 110, 10: 4, 11: 34, 12: 208, 13: 85, 14: 238, 15: 204, 16: 130, 17: 245, 18: 14, 19: 45, 20: 136, 21: 91, 22: 128, 23: 173, 24: 127, 25: 78, 26: 18, 27: 237, 28: 217, 29: 68, 30: 26, 31: 132, 32: 195, 33: 57, 34: 189, 35: 67, 36: 135, 37: 206, 38: 66, 39: 48, 40: 239, 41: 229, 42: 1, 43: 157, 44: 16, 45: 155, 46: 190, 47: 253, 48: 92, 49: 198, 50: 23, 51: 160, 52: 185, 53: 25, 54: 149, 55: 177, 56: 201, 57: 213, 58: 96, 59: 112, 60: 107, 61: 137, 62: 41, 63: 106, 64: 19, 65: 194, 66: 12, 67: 156, 68: 38, 69: 124, 70: 192, 71: 71, 72: 144, 73: 165, 74: 0, 75: 216, 76: 212, 77: 193, 78: 33, 79: 246, 80: 88, 81: 163, 82: 5, 83: 250, 84: 118, 85: 179, 86: 87, 87: 161, 88: 42, 89: 99, 90: 3, 91: 59, 92: 224, 93: 83, 94: 44, 95: 199, 96: 90, 97: 196, 98: 53, 99: 43, 100: 47, 101: 27, 102: 95, 103: 162, 104: 244, 105: 117, 106: 102, 107: 222, 108: 2, 109: 40, 110: 133, 111: 115, 112: 232, 113: 220, 114: 46, 115: 17, 116: 111, 117: 84, 118: 240, 119: 164, 120: 176, 121: 221, 122: 254, 123: 122, 124: 205, 125: 103, 126: 64, 127: 143, 128: 191, 129: 215, 130: 174, 131: 36, 132: 104, 133: 98, 134: 236, 135: 226, 136: 30, 137: 13, 138: 49, 139: 252, 140: 15, 141: 147, 142: 35, 143: 52, 144: 51, 145: 29, 146: 56, 147: 10, 148: 158, 149: 97, 150: 138, 151: 120, 152: 81, 153: 24, 154: 227, 155: 31, 156: 8, 157: 101, 158: 251, 159: 32, 160: 255, 161: 28, 162: 140, 163: 167, 164: 233, 165: 108, 166: 72, 167: 139, 168: 154, 169: 223, 170: 225, 171: 60, 172: 146, 173: 116, 174: 151, 175: 148, 176: 73, 177: 178, 178: 169, 179: 249, 180: 183, 181: 228, 182: 6, 183: 188, 184: 141, 185: 202, 186: 247, 187: 11, 188: 9, 189: 166, 190: 142, 191: 243, 192: 63, 193: 134, 194: 131, 195: 61, 196: 93, 197: 75, 198: 248, 199: 58, 200: 62, 201: 119, 202: 82, 203: 197, 204: 22, 205: 69, 206: 153, 207: 89, 208: 113, 209: 79, 210: 209, 211: 214, 212: 218, 213: 230, 214: 168, 215: 203, 216: 114, 217: 77, 218: 187, 219: 200, 220: 123, 221: 170, 222: 231, 223: 186, 224: 94, 225: 125, 226: 37, 227: 171, 228: 86, 229: 21, 230: 70, 231: 184, 232: 100, 233: 39, 234: 145, 235: 242, 236: 126, 237: 50, 238: 207, 239: 74, 240: 175, 241: 80, 242: 129, 243: 180, 244: 211, 245: 241, 246: 55, 247: 181, 248: 65, 249: 182, 250: 159, 251: 54, 252: 234, 253: 121, 254: 109, 255: 20}]
def m9(a3):
global s4
s4 = [s5[i] ^ a3 for i in range(256)]
get_scramble = lambda i : (i + 323) % 256
get_secretnumber = lambda i : [105, 71, 127, 221, 12, 24, 237, 85, 2, 143, 81, 214, 5, 79, 100, 82, 44, 225, 80, 5, 2, 177, 133, 113, 244, 238, 241, 218, 214, 83, 169, 112, 233, 154, 245, 14, 26, 167, 104, 50, 208, 241, 229, 70, 12, 3, 219, 15, 88, 34, 197, 185, 97, 205, 147, 95, 218, 159, 70, 129, 255, 145, 43, 49, 17, 197, 210, 68, 69, 210, 74, 59, 249, 41, 182, 11, 99, 106, 146, 250, 113, 183, 183, 193, 202, 81, 227, 242, 44, 1, 199, 153, 120, 48, 78, 65, 230, 173, 71, 15, 103, 89, 61, 109, 172, 7, 97, 101, 58, 126, 169, 97, 105, 80, 198, 188, 240, 219, 29, 14, 41, 139, 157, 117, 107, 98, 191, 222, 136, 247, 45, 93, 4, 154, 113, 108, 192, 154, 5, 76, 66, 134, 244, 227, 132, 238, 150, 201, 86, 237, 124, 152, 134, 199, 152, 117, 168, 43, 61, 129, 222, 245, 111, 109, 155, 142, 16, 101, 72, 191, 231, 213, 224, 26, 149, 87, 171, 79, 174, 23, 108, 245, 195, 70, 253, 36, 207, 226, 39, 13, 210, 175, 223, 178, 93, 16, 96, 209, 52, 247, 230, 58, 198, 1, 40, 75, 203, 45, 234, 156, 214, 244, 141, 89, 132, 229, 29, 156, 190, 108, 88, 10, 28, 105, 180, 182, 157, 23, 234, 17, 249, 18, 210, 62, 31, 236, 97, 190, 1, 236, 17, 102, 33, 84, 5, 131, 149, 198, 122, 86, 126, 90, 235, 175, 58, 176][i]
flag = [0 for _ in range(8)]
m = [m0, m1, m2, m3, m4, m5, m6, m7]
comp = [(255,172), (255,6), (251,146), (247,97), (202,130), (65, 65), (255, 236), (255, 142)]
f = [[] for _ in range(8)]
scramble = get_scramble(13)
for idx in range(8):
for i in range(256):
if idx==5:
if (i & comp[idx][0] == comp[idx][1]):
f[idx].append(i)
else:
if m[idx](i, get_secretnumber(scramble)) & comp[idx][0] == comp[idx][1]:
f[idx].append(m_dic[idx][i])
if (idx != 5) and (idx != 7):
scramble = get_scramble(scramble)
def check_flag(flag):
global scramble
f = map(ord, flag)
tmp_scramble = get_scramble(f[-1]+scramble)
m9(((f[0] + f[1] + f[2] + f[3] + f[4] + f[5]) + (f[6] * f[7])))
for idx in range(256):
if m8(idx, get_secretnumber(tmp_scramble)) & 255 == 103:
good = m_dic[8][idx]
if (((get_secretnumber(f[0]) * get_secretnumber(f[1]) * get_secretnumber(f[2]) * get_secretnumber(f[3]) * get_secretnumber(f[4]) * get_secretnumber(f[5]) * get_secretnumber(f[6])) + f[7] + get_secretnumber(good)) % 144 == 37):
print 'OOO{' + ''.join(flag+chr(good)).encode('hex') + '}'
break
def go(flag, idx):
if len(flag) == 8:
check_flag(flag)
else:
for i in range(len(f[idx])):
tmp = flag + chr(f[idx][i])
go(tmp, idx+1)
go('', 0)
view raw solve_re.py hosted with ❤ by GitHub
블로그의 프로필 사진

블로그의 정보

튜기's blogg(st1tch)

St1tch

활동하기

티스토리툴바