NOV X联合出题人

​ 比赛一直在打安洵杯,buu都没好好看,现在安洵杯迷宫题斜着走还没搞明白,先来复现一波buu的月赛

babytea

1. 一 看核心算法经典teaimage-20221129172038310

2. 结果脚本算不出来==,我还以为老子脚本有问题,动调发现有异常,直接去看汇编,结果发现果然存在几个异常点

a)sum+异常image-20221129172501520

b)开头也有异常,而且这个是默认必须跳转image-20221129172612239

3.直接修改汇编,让报错的地方直接跳转到异常处理程序image-20221129172922988

4.然后源码就变了image-20221129173019067

5.但是v5地方不是每次都要异或,是有条件的,当>>0x1f == 0时异或image-20221129173152401

6.总之这是一道魔改tea罢了,脚本如下

from Crypto.Util.number import *
def tea(v,k,d38,d3c):
    v0 = v[0]
    v1 = v[1]
    s = 0
    j = [0]
    # sum
    for i in range(32):
        s = (s + dword_41F000)&0xffffffff
        if (s >> 0x1f) == 0:
            s ^= 0x1234567
        j.append(s) 
    sum = j[32]
    for i in range(32):
        v1 -= (k[3] + (v0 >> 5)) ^ (sum + v0) ^ (k[2] + 16 * v0)
        v1 = v1&0xffffffff
        v0 -= (k[1] + (v1 >> 5)) ^ (sum + v1) ^ (k[0] + 16 * v1)
        v0 = v0&0xffffffff
        sum = j[31-i]
    v0 ^= d38
    v1 ^= d3c
    v[0] = v0&0xffffffff
    v[1] = v1&0xffffffff

enc = [0x5E27B530, 0x0BDBEF7F3, 0x0E3516A8F, 0x5D836CFE, 0x0D83DFA09, 0x8EFC737A,0x55A853A3, 0x7A564EC5]
k = [0x67452301, 0x0EFCDAB89, 0x98BADCFE, 0x10325476]
m = [None]*2
flag = []
dword_41F038 = [0x1234567,0x5E27B530,0x0E3516A8F,0x0D83DFA09]
dword_41F03C = [0x89ABCDEF,0x0BDBEF7F3,0x5D836CFE,0x8EFC737A]
dword_41F000 = 0x9E3779B1
for i in range(4):
    m[0] = enc[2*i]
    m[1] = enc[2*i+1]
    tea(m,k,dword_41F038[i],dword_41F03C[i])
    flag.append(long_to_bytes(m[0])[::-1])
    flag.append(long_to_bytes(m[1])[::-1])
b''.join(flag)
#600d_y0u_r34lly_kn0w_734_4nd_53h

babysmc

1. smc函数,但是异或值是输入的值image-20221130165909641

2. 其他也没有和输入值相关的函数,所以只能选择爆破image-20221130170030329

3. 当爆破到第一个操作时push ebp时那就成功了,所以硬编码就为0x55,先是loc50,第一个值是57image-20221130170339966

4. 但是爆破失败,真的是糟糕!!!image-20221130170528580

5. 后面发现还有一个函数,这个函数居然爆破成功了,奇了个怪image-20221130170643748

6. 后面惊奇地发现第一个函数应该被异或了两次,进过256长度的计算,确实如此image-20221130170821019

7. 然后就爆破出来了,yes,用idc改编码image-20221130170946128

8. 改完之后从修改开始处到return代码全部重新分析一遍,因为256长度把已经分析了的代码也改了,然后重新生成函数

9. 然后逻辑就是循环十次,不同函数调用十次,最后用z3解image-20221130172042777

这里附上代码,仅供参考

from z3 import *
dword_422040 = [0x00027FC8, 0x00029049, 0x0003336C, 0x0002C6A7, 0x00036CB0, 0x0001F2BB, 0x00035262, 0x0002AEDF, 0x0002955E, 0x0002EE10, 0x0002B057, 0x0002FDE8, 0x00029B92, 0x00035842, 0x000294D2, 0x0002B984]

flag = [0] * 34
s = Solver()
a1 = [BitVec(f'flag[{i}]',8) for i in range(17,33)]
s.add(dword_422040[0] == (159 * a1[8] \
                          + 109 * a1[12] \
                          + 14 * a1[0] \
                          + 92 * a1[14] \
                          + 211 * a1[4] \
                          + 178 * a1[7] \
                          + 57 * a1[2] \
                          + 175 * a1[5] \
                          + 170 * a1[11] \
                        + 59 * a1[6] \
                          + 200 * a1[9] \
                          + 5 * a1[15] \
                          + 48 * a1[13] \
                          + 28 * a1[3] \
                          + 18 * a1[10] \
                          + 228 * a1[1])&0xffffffff)
s.add(dword_422040[6] == (173 * a1[11] \
                          + 34 * a1[5] \
                          + 69 * a1[4] \
                          + 216 * a1[14] \
                          + 225 * a1[9] \
                          + 160 * a1[1] \
                          + 207 * a1[10] \
                          + 175 * a1[7] \
                          + 121 * a1[0] \
                          + 122 * a1[2] \
                          + 179 * a1[12] \
                          + 91 * a1[13] \
                          + 181 * a1[8] \
                          + 93 * a1[3] \
                          + 121 * a1[6] \
                          + 12 * a1[15])&0xffffffff)
s.add(dword_422040[8] == (215 * a1[11] \
                          + 164 * a1[5] \
                          + 97 * a1[2] \
                          + 99 * a1[3] \
                          + 188 * a1[4] \
                          + ((a1[9] << 7)&0xffffffff) \
                          + 214 * a1[6] \
                          + 106 * a1[8] \
                          + 169 * a1[0] \
                          + 28 * a1[14] \
                          + 18 * a1[12] \
                          + a1[1] \
                          + 177 * a1[10] \
                          + 114 * a1[7] \
                          + 176 * a1[15] \
                          + 25 * a1[13])&0xffffffff)
s.add(dword_422040[9] == (175 * a1[14] \
                          + 42 * a1[4] \
                          + 214 * a1[12] \
                          + 43 * a1[13] \
                          + 147 * a1[6] \
                          + 53 * a1[10] \
                          + 12 * a1[1] \
                          + 213 * a1[7] \
                          + 241 * a1[9] \
                          + 223 * a1[5] \
                          + 65 * a1[3] \
                          + 42 * a1[15] \
                          + 131 * a1[2] \
                          + 81 * a1[0] \
                          + 92 * a1[11] \
                          + 110 * a1[8])&0xffffffff)
s.add(dword_422040[13] == (57 * a1[0] \
                           + 109 * a1[7] \
                           + 60 * a1[2] \
                           + 228 * a1[13] \
                           + 166 * a1[4] \
                           + 236 * a1[9] \
                           + 100 * a1[6] \
                           + 179 * a1[11] \
                           + 20 * a1[12] \
                           + 45 * a1[8] \
                           + 204 * a1[3] \
                           + 182 * a1[14] \
                           + 84 * a1[10] \
                           + 170 * a1[15] \
                           + 199 * a1[5] \
                           + 138 * a1[1])&0xffffffff)
s.add(dword_422040[10] == (98 * a1[11] \
                           + 122 * a1[9] \
                           + 237 * a1[12] \
                           + 117 * a1[0] \
                           + 34 * a1[3] \
                           + 168 * a1[8] \
                           + 135 * a1[10] \
                           + 119 * a1[6] \
                           + 91 * a1[2] \
                           + 161 * a1[15] \
                           + 152 * a1[7] \
                           + 186 * a1[4] \
                           + 187 * a1[13] \
                           + 72 * a1[14] \
                           + 36 * a1[5] \
                           + 171 * a1[1])&0xffffffff)
s.add(dword_422040[7] == (184 * a1[9] \
                          + 112 * a1[0] \
                          + 107 * a1[11] \
                          + 170 * a1[13] \
                          + 55 * a1[8] \
                          + 85 * a1[14] \
                          + 212 * a1[10] \
                          + 173 * a1[15] \
                          + 166 * a1[12] \
                          + 142 * a1[4] \
                          + 202 * a1[5] \
                          + 63 * a1[2] \
                          + 30 * a1[7] \
                          + 175 * a1[3] \
                          + 217 * a1[6] \
                          + 63 * a1[1])&0xffffffff)
s.add(dword_422040[15] == (((a1[7] << 6)&0xffffffff) \
                           + 228 * a1[4] \
                           + 90 * a1[11] \
                           + 85 * a1[3] \
                           + 196 * a1[6] \
                           + 219 * a1[0] \
                           + 93 * a1[14] \
                           + 183 * a1[15] \
                           + 156 * a1[12] \
                           + 197 * a1[8] \
                           + 119 * a1[13] \
                           + 36 * a1[10] \
                           + 205 * a1[2] \
                           + 94 * a1[9] \
                           + 153 * a1[5])&0xffffffff)
s.add(dword_422040[5] == (9 * a1[4] \
                          + ((a1[5] << 6)&0xffffffff) \
                          + 62 * a1[1] \
                          + 58 * a1[7] \
                          + 100 * a1[13] \
                          + 137 * a1[11] \
                          + 6 * a1[0] \
                          + 119 * a1[9] \
                          + 180 * a1[6] \
                          + 228 * a1[8] \
                          + 88 * a1[12] \
                          + 107 * a1[15] \
                          + 56 * a1[14] \
                          + 207 * a1[2] \
                          + 248 * a1[10] \
                          + 150 * a1[3])&0xffffffff)
s.add(dword_422040[3] == (38 * a1[7] \
                          + 194 * a1[4] \
                          + 105 * a1[0] \
                          + 150 * a1[6] \
                          + 75 * a1[1] \
                          + 89 * a1[15] \
                          + 99 * a1[14] \
                          + 98 * a1[3] \
                          + 91 * a1[8] \
                          + 178 * a1[12] \
                          + 117 * a1[2] \
                          + 48 * a1[13] \
                          + 239 * a1[10] \
                          + 233 * a1[11] \
                          + 63 * a1[5]  \
                          + 250 * a1[9])&0xffffffff)
s.add(dword_422040[11] == (30 * a1[8] \
                           + 13 * a1[5] \
                           + 206 * a1[3] \
                           + 234 * a1[15] \
                           + 71 * a1[7] \
                           + 239 * a1[12] \
                           + 141 * a1[10] \
                           + 179 * a1[13] \
                           + 113 * a1[14] \
                           + 181 * a1[9] \
                           + 52 * a1[6] \
                           + 74 * a1[11] \
                           + 168 * a1[4] \
                           + 239 * a1[1] \
                           + 164 * a1[0] \
                           + 179 * a1[2])&0xffffffff)
s.add(dword_422040[14] == (211 * a1[1] \
                           + 74 * a1[5] \
                           + 144 * a1[8] \
                           + 234 * a1[0] \
                           + 241 * a1[2] \
                           + 157 * a1[11] \
                           + 25 * a1[15] \
                           + 6 * a1[10] \
                           + 243 * a1[6] \
                           + 107 * a1[9] \
                           + 77 * a1[12] \
                           + 127 * a1[4] \
                           + 67 * a1[7] \
                           + 13 * a1[14] \
                           + 151 * a1[3]  \
                           + 127 * a1[13])&0xffffffff)
s.add(dword_422040[2] == (209 * a1[9] \
                          + 110 * a1[7] \
                          + 22 * a1[10] \
                          + 102 * a1[11] \
                          + 187 * a1[1] \
                          + 58 * a1[8] \
                          + 236 * a1[6] \
                          + 146 * a1[13] \
                          + 205 * a1[15] \
                          + 63 * a1[2] \
                          + 211 * a1[4] \
                          + 152 * a1[3] \
                          + 82 * a1[14] \
                          + 14 * a1[5] \
                          + 49 * a1[12] \
                          + 251 * a1[0])&0xffffffff)
s.add(dword_422040[12] == (230 * a1[0] \
                           + 27 * a1[3] \
                           + 186 * a1[10] \
                           + 58 * a1[7] \
                           + 121 * a1[1] \
                           + 59 * a1[14] \
                           + 90 * a1[12] \
                           + 40 * a1[2] \
                           + 230 * a1[11] \
                           + 25 * a1[6] \
                           + 198 * a1[5] \
                           + 81 * a1[4] \
                           + 71 * a1[13] \
                           + 180 * a1[8] \
                           + 149 * a1[9] \
                           + 73 * a1[15])&0xffffffff)
s.add(dword_422040[4] == (188 * a1[5] \
                          + 80 * a1[1] \
                          + 221 * a1[6] \
                          + ((a1[12] << 6)&0xffffffff) \
                          + 230 * a1[3] \
                          + 123 * a1[8] \
                          + 124 * a1[11] \
                          + 253 * a1[0] \
                          + 202 * a1[10] \
                          + 63 * a1[2] \
                          + 40 * a1[7] \
                          + 109 * a1[9] \
                          + 195 * a1[15] \
                          + 199 * a1[13] \
                          + 82 * a1[4] \
                          + 225 * a1[14])&0xffffffff)
s.add(dword_422040[1] == (236 * a1[15] \
                          + 44 * a1[14] \
                          + 214 * a1[13] \
                          + 52 * a1[8] \
                          + 37 * a1[6] \
                          + 101 * a1[9] \
                          + 244 * a1[10] \
                          + 238 * a1[11] \
                          + 109 * a1[0] \
                          + 188 * a1[1] \
                          + 20 * a1[3] \
                          + 87 * a1[7] \
                          + 93 * a1[4] \
                          + 158 * a1[5] \
                          + 105 * a1[12] \
                          + 3 * a1[2])&0xffffffff)
assert s.check() == sat
print(s.model())
flag[28] = 114
flag[18] = 42
flag[21] = 71
flag[27] = 42
flag[30] = 124
flag[32] = 51
flag[23] = 42
flag[26] = 186
flag[31] = 209
flag[17] = 186
flag[24] = 186
flag[29] = 11
flag[20] = 45
flag[19] = 51
flag[22] = 51
flag[25] = 25
dword_422000 = [0x0002A81A, 0x00028D44, 0x00022653, 0x0002E993, 0x000249B5, 0x00024265, 0x0003253D, 0x0002D77B, 0x000282C8, 0x00022892, 0x0002BD54, 0x0002482E, 0x00024C1F, 0x00028127, 0x0001E62E, 0x0001F009]

x = Solver()
a1 = [BitVec(f'flag[{i}]',8) for i in range(1,17)]
x.add(dword_422000[12] == (199 * a1[9] \
                       + 98 * a1[7] \
                       + 192 * a1[8] \
                       + 23 * a1[12] \
                       + 79 * a1[14] \
                       + 77 * a1[10] \
                       + 185 * a1[13] \
                       + 135 * a1[15] \
                       + 119 * a1[4] \
                           + 54 * a1[0] \
                           + 41 * a1[1] \
                       + 124 * a1[6] \
                       + 18 * a1[2] \
                       + 181 * a1[11] \
                       + 191 * a1[5] \
                       + 7 * a1[3])&0xffffffff)
x.add(dword_422000[3] == (210 * a1[11] \
                      + 26 * a1[15] \
                      + 169 * a1[0] \
                      + 177 * a1[13] \
                      + a1[6] \
                      + 205 * a1[8] \
                      + 223 * a1[10] \
                      + 32 * a1[5] \
                      + 225 * a1[3] \
                      + 61 * a1[14] \
                      + 72 * a1[1] \
                      + 186 * a1[9] \
                      + 253 * a1[12] \
                      + 205 * a1[2] \
                      + 49 * a1[4] \
                      + 232 * a1[7])&0xffffffff)
x.add(dword_422000[13] == (192 * a1[3] \
                       + 22 * a1[10] \
                       + 175 * a1[1] \
                       + 184 * a1[7] \
                       + 116 * a1[15] \
                       + 70 * a1[13] \
                       + 153 * a1[14] \
                       + 119 * a1[0] \
                       + 217 * a1[6] \
                       + 123 * a1[5] \
                       + 17 * a1[2] \
                       + 244 * a1[12] \
                       + 116 * a1[8] \
                       + 46 * a1[4] \
                       + 19 * a1[9] \
                       + 130 * a1[11])&0xffffffff)
x.add(dword_422000[7] == (41 * a1[12] \
                      + 71 * a1[7] \
                      + 185 * a1[1] \
                      + 69 * a1[11] \
                      + 142 * a1[8] \
                      + 221 * a1[5] \
                      + 24 * a1[3] \
                      + 208 * a1[6] \
                      + 41 * a1[9] \
                      + 159 * a1[2] \
                      + 231 * a1[14] \
                      + 235 * a1[13] \
                      + 225 * a1[0] \
                      + (a1[4] << 6) \
                      + 162 * a1[10] \
                      + 134 * a1[15])&0xffffffff)
x.add(dword_422000[11] == (36 * a1[12] \
                       + 220 * a1[4] \
                       + 110 * a1[13] \
                       + 45 * a1[7] \
                       + 123 * a1[9] \
                       + 133 * a1[1] \
                       + 101 * a1[5] \
                       + 137 * a1[10] \
                       + 102 * a1[0] \
                           + 227 * a1[14] \
                       + 94 * a1[15] \
                       + 18 * a1[2] \
                       + 22 * a1[6] \
                       + 189 * a1[11] \
                       + 218 * a1[8])&0xffffffff)
x.add(dword_422000[15] == (86 * a1[11] \
                       + 31 * a1[9] \
                       + 229 * a1[6] \
                       + 27 * a1[3] \
                       + 6 * a1[12] \
                       + 13 * a1[10] \
                       + 158 * a1[1] \
                       + 89 * a1[7] \
                       + 35 * a1[15] \
                       + 126 * a1[8] \
                       + 165 * a1[13] \
                       + 220 * a1[0] \
                       + 138 * a1[5] \
                       + 100 * a1[4] \
                       + 84 * a1[14] \
                       + 175 * a1[2])&0xffffffff)
x.add(dword_422000[8] == (7 * a1[1] \
                      + 28 * a1[8] \
                      + 131 * a1[10] \
                      + 6 * a1[6] \
                      + 254 * a1[0] \
                      + 130 * a1[13] \
                      + 124 * a1[3] \
                      + 55 * a1[12] \
                      + 157 * a1[14] \
                      + 175 * a1[5] \
                      + 140 * a1[4] \
                      + 241 * a1[9] \
                      + 11 * a1[11] \
                      + 211 * a1[2] \
                      + 121 * a1[7] \
                      + 200 * a1[15])&0xffffffff)
x.add(dword_422000[6] == (195 * a1[14] \
                      + 197 * a1[13] \
                      + 218 * a1[7] \
                      + 83 * a1[1] \
                      + 98 * a1[2] \
                      + 70 * a1[10] \
                      + 229 * a1[15] \
                      + 148 * a1[11] \
                      + 195 * a1[0] \
                      + 94 * a1[6] \
                      + 211 * a1[12] \
                      + 220 * a1[9] \
                      + 81 * a1[5] \
                      + 253 * a1[8] \
                      + 78 * a1[4] \
                      + 4 * a1[3])&0xffffffff)
x.add(dword_422000[14] == (3 * a1[4] \
                       + 136 * a1[7] \
                       + 156 * a1[3] \
                       + 189 * a1[1] \
                       + 244 * a1[12] \
                       + 157 * a1[15] \
                       + 83 * a1[9] \
                       + 6 * a1[0] \
                       + 113 * a1[6] \
                       + 63 * a1[14] \
                       + 35 * a1[2] \
                       + 22 * a1[8] \
                       + 26 * a1[10] \
                       + 62 * a1[11] \
                       + 98 * a1[5] \
                       + 110 * a1[13])&0xffffffff)
x.add(dword_422000[4] == (96 * a1[4] \
                      + 248 * a1[8] \
                      + 191 * a1[9] \
                      + 194 * a1[2] \
                      + 154 * a1[1] \
                      + 31 * a1[6] \
                      + 157 * a1[7] \
                      + 248 * a1[13] \
                      + 81 * a1[15] \
                      + 56 * a1[10] \
                      + 52 * a1[0] \
                      + 94 * a1[12] \
                      + 212 * a1[5] \
                      + 83 * a1[3] \
                      + 83 * a1[14] \
                      + 158 * a1[11])&0xffffffff)
x.add(dword_422000[1] == (67 * a1[4] \
                      + 220 * a1[2] \
                      + 123 * a1[11] \
                      + 168 * a1[5] \
                      + 23 * a1[12] \
                      + 148 * a1[7] \
                      + 127 * a1[10] \
                      + 194 * a1[1] \
                      + 132 * a1[8] \
                      + 44 * a1[0] \
                      + 60 * a1[13] \
                      + 98 * a1[15] \
                      + 38 * a1[14] \
                      + 245 * a1[9] \
                      + 159 * a1[6] \
                      + 146 * a1[3])&0xffffffff)
x.add(dword_422000[5] == (132 * a1[3] \
                           + 10 * a1[7] \
                      + 95 * a1[0] \
                      + 83 * a1[10] \
                      + 99 * a1[1] \
                      + 77 * a1[12] \
                      + 195 * a1[2] \
                      + 47 * a1[6] \
                      + 38 * a1[13] \
                      + 178 * a1[8] \
                      + 74 * a1[4] \
                      + 86 * a1[11] \
                      + 208 * a1[9] \
                      + 240 * a1[14] \
                      + 120 * a1[5] \
                      + 43 * a1[15])&0xffffffff)
x.add(dword_422000[9] == (172 * a1[1] \
                      + 110 * a1[2] \
                      + 92 * a1[7] \
                      + 126 * a1[15] \
                      + 91 * a1[0] \
                      + 77 * a1[6] \
                      + 207 * a1[5] \
                      + 249 * a1[11] \
                      + 240 * a1[12] \
                      + 129 * a1[10] \
                      + 6 * a1[13] \
                      + 100 * a1[3] \
                      + a1[14] \
                      + 76 * a1[9] \
                      + 127 * a1[4] \
                      + 4 * a1[8])&0xffffffff)
x.add(dword_422000[10] == (46 * a1[15] \
                       + 37 * a1[0] \
                       + 3 * a1[3] \
                       + 72 * a1[6] \
                       + 116 * a1[7] \
                       + 186 * a1[1] \
                       + 221 * a1[14] \
                       + 236 * a1[4] \
                       + 79 * a1[2] \
                       + 175 * a1[10] \
                       + 184 * a1[9] \
                       + 160 * a1[11] \
                       + 227 * a1[12] \
                       + 99 * a1[8] \
                       + 71 * a1[13] \
                       + 4 * a1[5])&0xffffffff)
x.add(dword_422000[0] == (203 * a1[3] \
                      + 31 * a1[0] \
                      + 11 * a1[14] \
                      + 149 * a1[7] \
                      + 215 * a1[5] \
                      + 206 * a1[1] \
                      + 245 * a1[6] \
                      + 9 * a1[11] \
                      + 16 * a1[10] \
                      + 241 * a1[13] \
                      + 110 * a1[8] \
                      + 175 * a1[2] \
                      + 38 * a1[4] \
                      + 227 * a1[9] \
                      + 208 * a1[12] \
                      + 8 * a1[15])&0xffffffff)
x.add(dword_422000[2] == (132 * a1[3] \
                      + 119 * a1[14] \
                      + 26 * a1[8] \
                      + 24 * a1[6] \
                      + 121 * a1[11] \
                      + 235 * a1[2] \
                      + 228 * a1[12] \
                      + 34 * a1[5] \
                      + 37 * a1[15] \
                      + 24 * a1[9] \
                      + 145 * a1[13] \
                      + 199 * a1[4] \
                      + 173 * a1[10] \
                      + 58 * a1[0] \
                      + 246 * a1[7] \
                      + 199 * a1[1])&0xffffffff)
    
assert x.check() == sat
print(x.model())

flag[0] = 0x23
flag[33] = 0x21
flag[5] = 43
flag[11] = 186
flag[8] = 51
flag[16] = 72
flag[6] = 42
flag[4] = 51
flag[3] = 1
flag[10] = 179
flag[14] = 43
flag[7] = 186
flag[1] = 90
flag[13] = 113
flag[12] = 51
flag[2] = 45
flag[9] = 72
flag[15] = 114

by280 = [0x7A, 0x91, 0x9F, 0x23, 0x71, 0xD1, 0x63, 0xDB, 0x59, 0x0A, 0xEC, 0x69, 0xEE, 0x76, 0x5D, 0x64, 0x37, 0x42, 0x8C, 0x0B, 0x3C, 0x5C, 0x80, 0xAD, 0x6A, 0x03, 0x43, 0x93, 0xBC, 0xBF, 0xE3, 0xAF, 0x5A, 0x8A, 0x65, 0x0D, 0x31, 0xDF, 0x3E, 0xA7, 0xE4, 0xDD, 0xB4, 0xB0, 0x56, 0x1C, 0x12, 0xA4, 0x9E, 0xD8, 0x3D, 0x81, 0x60, 0x9A, 0xCB, 0xFA, 0xB1, 0xE0, 0xD3, 0xF4, 0xA2, 0x26, 0x68, 0x90, 0x4B, 0x45, 0x85, 0x20, 0x16, 0xDE, 0xED, 0x4C, 0x6F, 0x34, 0xDC, 0xBE, 0xD2, 0x46, 0x33, 0x14, 0x77, 0xC6, 0xCD, 0xF0, 0xC5, 0xAC, 0x1F, 0xD0, 0x95, 0x97, 0x3F, 0xD7, 0x52, 0xAE, 0xB9, 0xC9, 0x0C, 0xCA, 0x4E, 0xF1, 0xB7, 0x39, 0x7F, 0x27, 0x2B, 0x40, 0x4A, 0x51, 0xA1, 0xCC, 0xCE, 0x6E, 0x70, 0xFF, 0x0E, 0xEF, 0x8E, 0x25, 0xB3, 0x5E, 0x6C, 0xAB, 0x02, 0x49, 0xE9, 0x9B, 0x36, 0x13, 0x9C, 0x04, 0x35, 0xC0, 0xFB, 0x3A, 0x67, 0xB6, 0x9D, 0xC2, 0x73, 0xB5, 0x6D, 0xCF, 0x83, 0x2C, 0x01, 0xC1, 0x10, 0x6B, 0x79, 0x87, 0x5B, 0x57, 0x47, 0xE5, 0x15, 0xF7, 0xA5, 0x74, 0xAA, 0x53, 0x7D, 0x2E, 0xD5, 0xA3, 0x19, 0xF5, 0x2D, 0xFD, 0x61, 0x8D, 0xC8, 0x1B, 0xC3, 0xDA, 0xF6, 0x72, 0x54, 0x5F, 0x1E, 0xE8, 0x17, 0x50, 0xB2, 0xE7, 0x0F, 0x7E, 0x55, 0xBD, 0x86, 0x00, 0x78, 0x94, 0x92, 0x09, 0x2F, 0xD6, 0xD9, 0xF3, 0x29, 0xE6, 0x24, 0x32, 0x66, 0x22, 0x41, 0xC4, 0x7C, 0x05, 0x98, 0x44, 0x4F, 0x99, 0xA9, 0xE1, 0x8F, 0x08, 0x1A, 0x2A, 0x11, 0xEA, 0x3B, 0xE2, 0x38, 0xB8, 0x18, 0xF9, 0xD4, 0xC7, 0x62, 0x7B, 0x75, 0x58, 0x96, 0x28, 0xEB, 0x06, 0x84, 0x89, 0x48, 0x82, 0x88, 0xA6, 0xFE, 0xA0, 0xF2, 0xF8, 0x1D, 0x8B, 0xFC, 0xA8, 0x21, 0x30, 0xBB, 0x07, 0xBA, 0x4D]
by380 = [0x45, 0x1F, 0x63, 0x81, 0xE6, 0xAD, 0x4F, 0xD3, 0xC0, 0x15, 0x69, 0x8F, 0x0D, 0x31, 0x0C, 0xB0, 0xF1, 0x2E, 0x98, 0xC1, 0xC2, 0x96, 0xB2, 0xEB, 0xBF, 0xDF, 0x17, 0xF4, 0x7F, 0xE5, 0x66, 0x73, 0xD8, 0x56, 0x46, 0x20, 0x9C, 0x77, 0x3D, 0x72, 0xA3, 0x91, 0x49, 0x68, 0x4C, 0x1E, 0xAE, 0x06, 0x7A, 0x94, 0xDD, 0x52, 0x55, 0x2C, 0xB8, 0x42, 0x79, 0xFE, 0x38, 0xEF, 0x8B, 0xF7, 0xAC, 0xDC, 0xFF, 0x78, 0x34, 0x70, 0xA9, 0xCE, 0x3F, 0x0E, 0x11, 0x43, 0x5B, 0xF8, 0xAF, 0xD0, 0xFA, 0x33, 0xBA, 0xCF, 0x4A, 0xC9, 0x88, 0x4E, 0x80, 0x10, 0x85, 0x37, 0x12, 0xAB, 0xE1, 0x61, 0xB7, 0x3E, 0x4D, 0x19, 0x3A, 0x04, 0x8C, 0x92, 0x0B, 0xE7, 0x3C, 0xEA, 0xC7, 0x16, 0x35, 0xB1, 0xA7, 0x8E, 0x40, 0x9F, 0xB6, 0xB5, 0x25, 0xA0, 0x5A, 0x30, 0x7D, 0xA2, 0x1A, 0x64, 0xC5, 0x6D, 0x74, 0x82, 0x08, 0x7E, 0xD2, 0xF6, 0xAA, 0xDA, 0xED, 0x4B, 0x6E, 0xE8, 0xE9, 0xE2, 0xD4, 0x71, 0xB9, 0x09, 0x84, 0x3B, 0xC4, 0x1C, 0x60, 0xFD, 0x22, 0x99, 0x39, 0x97, 0x18, 0x89, 0x7C, 0xA4, 0x27, 0xBD, 0x0F, 0xCC, 0x95, 0xF5, 0xB3, 0x65, 0x6B, 0x8A, 0x58, 0x36, 0xBB, 0x9E, 0x75, 0xD1, 0x03, 0x9D, 0x6A, 0x6C, 0x53, 0x05, 0xB4, 0xE4, 0xEE, 0x67, 0x87, 0x7B, 0x32, 0x2D, 0x24, 0x2A, 0x59, 0xEC, 0x0A, 0xDB, 0x21, 0x07, 0x23, 0x50, 0x02, 0x41, 0xF2, 0x83, 0xD9, 0x26, 0xBC, 0x6F, 0x86, 0xA6, 0x93, 0xF9, 0xC8, 0xD6, 0xA5, 0x1D, 0xE3, 0xE0, 0xFC, 0xCA, 0x1B, 0x5E, 0x8D, 0x2F, 0x5C, 0xBE, 0x47, 0xA8, 0x44, 0x57, 0x54, 0x48, 0xC3, 0x00, 0x62, 0x5D, 0xCB, 0xD7, 0x76, 0xCD, 0x28, 0xD5, 0x14, 0x90, 0x13, 0xDE, 0x5F, 0xF0, 0x01, 0x2B, 0xC6, 0x29, 0x9A, 0x9B, 0x51, 0xF3, 0xFB, 0xA1]
by580 = [0x00, 0x74, 0x59, 0xC6, 0xAC, 0xD3, 0xC1, 0xA0, 0x88, 0x3F, 0x1C, 0x28, 0x17, 0x22, 0xC5, 0x38, 0xF9, 0x1B, 0x21, 0x49, 0x99, 0xAF, 0xD6, 0x95, 0xA4, 0x9D, 0x5D, 0x5B, 0x73, 0xFE, 0xC9, 0x9A, 0x4C, 0xB4, 0x27, 0x5E, 0x71, 0x25, 0xE2, 0x90, 0xC0, 0x62, 0x5F, 0x48, 0x77, 0xE0, 0xF2, 0x8E, 0x40, 0xC7, 0x79, 0x1A, 0xDC, 0xF3, 0x01, 0xB6, 0xD8, 0xB5, 0x67, 0x1E, 0x85, 0x12, 0x68, 0x87, 0xD0, 0x30, 0xEB, 0x2F, 0x50, 0xCF, 0xEE, 0xDD, 0xFB, 0xE6, 0xA5, 0x69, 0x05, 0x75, 0xB7, 0xEF, 0x70, 0x53, 0xFF, 0xBA, 0x80, 0x41, 0x9B, 0xA1, 0x39, 0xF8, 0x65, 0x1F, 0x7A, 0x51, 0x98, 0xAD, 0x02, 0x13, 0x18, 0xC3, 0x31, 0x89, 0xCD, 0xCA, 0x91, 0xD1, 0x78, 0x57, 0x47, 0xB8, 0x54, 0x9F, 0x96, 0x04, 0x23, 0x2B, 0xE5, 0x46, 0x29, 0x7C, 0x76, 0x82, 0xBC, 0xFC, 0x6E, 0xEC, 0xED, 0x64, 0x4A, 0x26, 0x34, 0x5C, 0x19, 0x55, 0xFD, 0x6D, 0xFA, 0x7E, 0xB2, 0xD4, 0xF1, 0xF6, 0xE4, 0x60, 0xB0, 0x52, 0x9E, 0x8F, 0xBB, 0x08, 0x3B, 0x97, 0xE8, 0x10, 0x6C, 0x44, 0x3A, 0x36, 0x35, 0x03, 0xC4, 0x81, 0x9C, 0xAB, 0xCB, 0x66, 0xAA, 0x37, 0xA2, 0xD2, 0xE1, 0xE9, 0x7B, 0x14, 0x8D, 0xD9, 0xF5, 0x0B, 0xC2, 0x07, 0xA8, 0x0D, 0xA3, 0x0A, 0x84, 0x6B, 0x2C, 0xEA, 0x0C, 0xAE, 0x7D, 0x6F, 0xD7, 0xE7, 0xC8, 0x3C, 0x45, 0xCC, 0x58, 0xB9, 0x3D, 0x33, 0x4E, 0x4B, 0x8C, 0xCE, 0x72, 0x6A, 0x8B, 0x2D, 0x24, 0x11, 0xDF, 0x5A, 0x2E, 0x92, 0xDA, 0x86, 0x94, 0xA7, 0xD5, 0x4F, 0x2A, 0xB3, 0x63, 0x61, 0xE3, 0xDE, 0x43, 0x1D, 0xBF, 0x15, 0x32, 0xBE, 0x16, 0x3E, 0x93, 0x7F, 0x83, 0x56, 0x06, 0xF7, 0x8A, 0x20, 0xBD, 0x0E, 0xA6, 0xDB, 0x0F, 0xB1, 0x42, 0xF0, 0x09, 0x4D, 0xA9, 0xF4]
by780 = [0x0F, 0xA5, 0xBA, 0x03, 0xF9, 0x69, 0x2A, 0xD7, 0xEA, 0xB5, 0xFC, 0xA1, 0x39, 0x20, 0x68, 0x72, 0x25, 0xB2, 0x6C, 0xAD, 0x88, 0x51, 0x73, 0xEB, 0xCF, 0x13, 0xDE, 0x7C, 0x6D, 0x38, 0x05, 0x09, 0xC2, 0x96, 0x1F, 0x7F, 0x37, 0x4A, 0xC9, 0xE7, 0x6A, 0xB0, 0x59, 0xF7, 0xD2, 0xB9, 0x16, 0xC8, 0xEE, 0xA9, 0x18, 0x80, 0xAC, 0xE3, 0x9E, 0x6F, 0x3C, 0x2F, 0x3E, 0x9A, 0xBE, 0x1D, 0xB4, 0x7B, 0x7D, 0x32, 0x6B, 0x74, 0xC5, 0xC0, 0xC7, 0xD1, 0x29, 0x98, 0xDD, 0xB6, 0x0E, 0x4D, 0xBF, 0x79, 0x0D, 0xDA, 0x7A, 0x17, 0x71, 0x43, 0x87, 0xFF, 0xDC, 0xC6, 0x12, 0xE9, 0x67, 0x2D, 0x70, 0x9F, 0x95, 0x30, 0x26, 0x24, 0x2B, 0xA8, 0xA2, 0xD8, 0x3B, 0x31, 0xA0, 0x3D, 0x4B, 0x90, 0x60, 0x34, 0x75, 0xE8, 0x5D, 0xF4, 0x85, 0xF3, 0xFE, 0x35, 0xCB, 0xB8, 0x02, 0x50, 0xB1, 0xF1, 0x1A, 0x1B, 0x21, 0xCD, 0xC4, 0x7E, 0xED, 0x07, 0xD9, 0xD6, 0x44, 0x15, 0x8E, 0x49, 0xB3, 0x97, 0xE6, 0x63, 0xB7, 0xEF, 0x3A, 0x8F, 0xF2, 0x53, 0x10, 0x77, 0x86, 0xF8, 0x8A, 0x28, 0x3F, 0xD4, 0x4C, 0xE5, 0x82, 0x83, 0xEC, 0x62, 0x89, 0xDF, 0xC3, 0x14, 0xCA, 0xA3, 0x5F, 0x64, 0x47, 0xFD, 0x00, 0x84, 0x66, 0xA7, 0x5A, 0x0C, 0x01, 0xD5, 0x5B, 0x0A, 0x4F, 0x27, 0x78, 0x0B, 0x2E, 0x48, 0x36, 0xFA, 0x08, 0x56, 0xE0, 0xA6, 0xC1, 0x5C, 0x8B, 0x41, 0x06, 0xBB, 0x52, 0x93, 0xAF, 0x2C, 0x5E, 0xF6, 0x61, 0xF0, 0xAB, 0x91, 0x45, 0x04, 0xBD, 0xCC, 0xE4, 0x65, 0x9D, 0x92, 0xCE, 0x40, 0xAE, 0x76, 0x9B, 0x9C, 0xAA, 0x54, 0xD0, 0x1C, 0x81, 0x4E, 0x57, 0x55, 0x23, 0x6E, 0x1E, 0x99, 0xDB, 0xFB, 0xA4, 0x22, 0x19, 0x58, 0x11, 0x8D, 0x94, 0xD3, 0xE2, 0x8C, 0xF5, 0x42, 0x46, 0xBC, 0x33, 0xE1]
byb80 = [0x38, 0xD9, 0xDA, 0xE6, 0xB5, 0xF1, 0x0B, 0x93, 0x0C, 0x58, 0x0D, 0xAE, 0x0A, 0x85, 0x2A, 0x50, 0xC2, 0xBF, 0xD4, 0x28, 0x52, 0xC4, 0x4F, 0xE1, 0x44, 0xE0, 0xA2, 0x70, 0x36, 0x65, 0x4B, 0x41, 0x9D, 0x5F, 0x05, 0x7C, 0xF7, 0xD7, 0x99, 0x8B, 0xCC, 0xCE, 0x16, 0xBE, 0xB6, 0xC5, 0x8F, 0x79, 0xC7, 0x20, 0x7E, 0xF4, 0xF3, 0x2E, 0x4A, 0x89, 0xD6, 0x0F, 0x6E, 0xB0, 0x61, 0xB1, 0x6D, 0x19, 0x73, 0x03, 0x74, 0xA1, 0x40, 0xEC, 0xC0, 0x57, 0x94, 0x7A, 0x66, 0xD5, 0xEA, 0x17, 0x6A, 0x84, 0x37, 0xED, 0xF6, 0x13, 0x31, 0x5B, 0x82, 0x1E, 0xFC, 0x92, 0xE2, 0x42, 0x86, 0xBA, 0xE3, 0x91, 0x7F, 0x67, 0x5C, 0x98, 0x15, 0x22, 0x8D, 0x80, 0x04, 0xE4, 0x25, 0x09, 0xA0, 0xAD, 0x63, 0xE5, 0xB4, 0x9A, 0x3C, 0xA3, 0x3A, 0x69, 0xF8, 0xCD, 0xBC, 0x88, 0x55, 0xB2, 0xBD, 0x6B, 0x77, 0x71, 0xB3, 0xD3, 0x90, 0x75, 0x06, 0x49, 0xC3, 0x32, 0x4D, 0x1D, 0xA8, 0xAA, 0xFB, 0x7B, 0x7D, 0x2B, 0xA6, 0x34, 0x72, 0x47, 0xF0, 0x2F, 0x9C, 0x08, 0x00, 0x14, 0x8C, 0x26, 0x5E, 0x87, 0xD1, 0xCF, 0xC9, 0x18, 0x51, 0x23, 0xCB, 0xF5, 0x1C, 0x9F, 0x97, 0xF9, 0xBB, 0xA7, 0x39, 0x45, 0x02, 0xFD, 0x46, 0x8A, 0x54, 0xA4, 0x8E, 0x9E, 0x68, 0x96, 0x0E, 0x78, 0xB8, 0x3D, 0x11, 0x64, 0xAF, 0x10, 0xDE, 0x6C, 0x60, 0x5A, 0x76, 0x1A, 0xE9, 0xC1, 0x3E, 0xCA, 0x9B, 0x27, 0x30, 0xEF, 0xFF, 0x07, 0xD2, 0xB9, 0x2D, 0xD0, 0xEE, 0x83, 0xAB, 0xF2, 0x4C, 0xA5, 0x21, 0x62, 0x81, 0x33, 0x1B, 0xD8, 0x6F, 0xAC, 0x3B, 0x5D, 0xE8, 0xFA, 0x3F, 0xDB, 0x95, 0xE7, 0x59, 0x12, 0x48, 0x35, 0xC6, 0x2C, 0x4E, 0x01, 0xDD, 0x43, 0x29, 0xDC, 0x24, 0x1F, 0xB7, 0xA9, 0xEB, 0xC8, 0xFE, 0x56, 0xDF, 0x53]
byd80 = [0xB0, 0x28, 0x0B, 0x89, 0x4B, 0xA4, 0xBE, 0x1A, 0x8F, 0x6C, 0xCF, 0xB2, 0xB5, 0xFE, 0xFB, 0x59, 0x2D, 0x29, 0x39, 0x62, 0x97, 0xAA, 0xD7, 0x7D, 0x94, 0x2C, 0xFC, 0x5D, 0xB4, 0x7C, 0x8A, 0x82, 0xD3, 0xA7, 0xBA, 0xDF, 0x21, 0xE6, 0xA2, 0xD0, 0xE8, 0xF0, 0x67, 0x3A, 0xB9, 0x98, 0xF9, 0xAE, 0xD1, 0x56, 0xD8, 0xCA, 0x10, 0xEA, 0x92, 0xA8, 0x75, 0x7E, 0x65, 0xA9, 0xAF, 0x51, 0xC9, 0x8E, 0xD4, 0x77, 0xE4, 0x49, 0x06, 0x61, 0x9E, 0x24, 0xD9, 0x9B, 0x11, 0x05, 0x1D, 0x96, 0x9A, 0xB1, 0xE0, 0x83, 0xE1, 0x1C, 0xCD, 0xF3, 0x38, 0xB3, 0x57, 0x50, 0xF4, 0xAC, 0xEB, 0x14, 0xA5, 0x46, 0xF6, 0x93, 0xAD, 0x7B, 0x30, 0xEF, 0x79, 0x17, 0x47, 0xDA, 0xC0, 0xDD, 0xDE, 0xDC, 0x5A, 0x76, 0x3B, 0x31, 0x0D, 0x0E, 0x86, 0xF1, 0x71, 0xFA, 0x0C, 0x00, 0xA3, 0xBF, 0x64, 0x37, 0x22, 0xD2, 0x69, 0x5C, 0xC6, 0x16, 0x9F, 0x5E, 0x7A, 0x1E, 0x27, 0x60, 0x6E, 0xF8, 0x8C, 0xEE, 0xC2, 0x74, 0x81, 0x8B, 0x33, 0x03, 0xBD, 0x2A, 0x0A, 0x68, 0x6B, 0x3F, 0x4C, 0xC3, 0x15, 0x04, 0x3D, 0x63, 0xF5, 0xAB, 0xCC, 0x3C, 0x53, 0x20, 0x66, 0xC4, 0xC1, 0x23, 0xE7, 0x25, 0x55, 0xC7, 0xED, 0xB7, 0xBC, 0xCB, 0x8D, 0x09, 0xCE, 0x52, 0xBB, 0xE2, 0xC5, 0xB6, 0x26, 0x12, 0x2F, 0x99, 0x58, 0x40, 0x6D, 0xA1, 0x3E, 0x48, 0x85, 0xA6, 0xF2, 0x0F, 0x43, 0x78, 0xB8, 0x01, 0xE5, 0xD5, 0x6F, 0x4E, 0xF7, 0x13, 0x42, 0xEC, 0x45, 0x2B, 0x4F, 0x36, 0xDB, 0x9C, 0xE3, 0x44, 0x34, 0x84, 0x73, 0x2E, 0x7F, 0xFD, 0x91, 0x41, 0xD6, 0x95, 0x18, 0xFF, 0x70, 0xC8, 0x02, 0x5F, 0x08, 0x1B, 0x6A, 0x5B, 0x19, 0xA0, 0x4D, 0x35, 0x54, 0xE9, 0x32, 0x88, 0x72, 0x07, 0x87, 0x90, 0x4A, 0x80, 0x1F, 0x9D]
by1180 = [0xE8, 0x22, 0x64, 0x9F, 0xC5, 0xD5, 0x25, 0xC9, 0x5D, 0xDF, 0xA1, 0x74, 0xCB, 0x57, 0xF7, 0xF0, 0xBD, 0x56, 0xFF, 0x33, 0x79, 0xFE, 0x87, 0xB6, 0xB1, 0x54, 0x10, 0x95, 0x8A, 0xEC, 0x7B, 0x48, 0x84, 0x3D, 0x30, 0xEF, 0x86, 0xFA, 0x97, 0x1C, 0xDC, 0xA9, 0x5A, 0xF3, 0x67, 0x18, 0x83, 0x72, 0x06, 0xB9, 0xF5, 0x05, 0x68, 0x59, 0xF2, 0xE4, 0x88, 0x5E, 0x14, 0x17, 0x11, 0x9C, 0xAB, 0xDE, 0xEB, 0x7D, 0x62, 0x9B, 0xD6, 0xF4, 0x01, 0x29, 0xBC, 0xC0, 0x69, 0xA2, 0x2B, 0x0D, 0x1D, 0x98, 0x6A, 0xBE, 0x65, 0x09, 0xF8, 0x96, 0xB4, 0x6E, 0x63, 0xE3, 0x34, 0x2D, 0xCE, 0x0A, 0xCD, 0xAA, 0x21, 0xCC, 0xE7, 0xA5, 0xDB, 0xD8, 0x03, 0xDD, 0xB2, 0x1F, 0x9D, 0x9E, 0x0E, 0x8F, 0x8B, 0xCA, 0x92, 0x0B, 0xA7, 0x5B, 0xD2, 0xCF, 0x47, 0x07, 0x04, 0xAE, 0x3B, 0xA8, 0x7C, 0x73, 0xF9, 0x35, 0xEE, 0x7A, 0xB0, 0xBA, 0x85, 0x46, 0x3E, 0x81, 0xC7, 0x40, 0x37, 0x15, 0x3A, 0x19, 0xE0, 0x1E, 0x28, 0x4A, 0x4F, 0x8C, 0xD4, 0x51, 0x2E, 0x94, 0x89, 0x2A, 0x0F, 0x7E, 0xE1, 0xC8, 0x5F, 0x4E, 0x6D, 0xF6, 0x49, 0xB8, 0x55, 0x60, 0x82, 0x20, 0x36, 0xC1, 0x0C, 0x1B, 0xC4, 0x00, 0xE5, 0xA3, 0x2C, 0xE9, 0xC2, 0xF1, 0x23, 0x3F, 0xC3, 0xB5, 0x8D, 0xD7, 0x42, 0xFC, 0x50, 0x13, 0xBB, 0x61, 0x9A, 0x44, 0xE6, 0x91, 0x2F, 0x70, 0xC6, 0x6F, 0xD1, 0x27, 0x43, 0x08, 0xDA, 0xFD, 0x52, 0x71, 0x77, 0xED, 0xE2, 0xAD, 0x16, 0x8E, 0x12, 0x4C, 0x31, 0x3C, 0x39, 0x78, 0x90, 0xBF, 0x1A, 0x76, 0x75, 0x41, 0x99, 0xD0, 0x80, 0xB7, 0x66, 0x24, 0xD3, 0x7F, 0x4B, 0x45, 0x5C, 0x53, 0x4D, 0x26, 0x32, 0xA0, 0xFB, 0xB3, 0x38, 0x6B, 0xAF, 0xA6, 0xD9, 0x02, 0xA4, 0xEA, 0x6C, 0xAC, 0x58, 0x93]
by1380 = [0x91, 0x67, 0x1A, 0xBE, 0xAB, 0xC2, 0x85, 0xD5, 0xDA, 0xCC, 0xF7, 0x5B, 0x54, 0x61, 0x05, 0xDF, 0x02, 0x70, 0x65, 0x69, 0x9A, 0x7A, 0x09, 0x92, 0x5D, 0x2A, 0xA7, 0x37, 0xFF, 0x19, 0xE6, 0x99, 0xF3, 0x1E, 0xBD, 0x82, 0x48, 0x3C, 0xE8, 0xC8, 0x66, 0x17, 0xB7, 0xA9, 0xC5, 0x4E, 0x33, 0x84, 0x45, 0xD3, 0x8B, 0x49, 0x50, 0x43, 0x8F, 0xCD, 0x73, 0x29, 0x04, 0xDC, 0x01, 0x0C, 0xDD, 0x2E, 0xFB, 0x6E, 0x0F, 0x24, 0x57, 0xE9, 0xC9, 0x7D, 0xB3, 0x40, 0x4B, 0x56, 0x6C, 0x68, 0xE2, 0x22, 0xF6, 0x80, 0xAA, 0x95, 0xD4, 0x97, 0x94, 0x21, 0x53, 0xD1, 0xE3, 0x59, 0xD2, 0xED, 0x41, 0x4D, 0x74, 0xA3, 0xA0, 0x32, 0x0D, 0xFC, 0x46, 0x34, 0xFA, 0xB1, 0x5E, 0xC6, 0x71, 0xC0, 0xE0, 0x3F, 0x13, 0x12, 0xD7, 0xEE, 0xF8, 0x26, 0xE1, 0x25, 0x88, 0x77, 0xB0, 0x8D, 0x6A, 0xEA, 0x0E, 0xD6, 0x3E, 0x03, 0x64, 0xBF, 0x8C, 0x96, 0xD9, 0xA4, 0x42, 0xAD, 0xFD, 0x16, 0x5A, 0xE4, 0x06, 0x9D, 0x07, 0x87, 0x5F, 0xAF, 0xDB, 0xC1, 0x93, 0x1C, 0xF1, 0xDE, 0xA6, 0x3A, 0xF4, 0x2C, 0x1B, 0x39, 0xE7, 0x4A, 0xC7, 0x35, 0xFE, 0x0A, 0x62, 0xF0, 0xCA, 0xEC, 0x27, 0x52, 0x23, 0x7F, 0xA5, 0x79, 0x7C, 0x75, 0x86, 0xEB, 0x60, 0xA8, 0xF5, 0x1F, 0x20, 0xC3, 0x63, 0x5C, 0x72, 0x18, 0xE5, 0x51, 0xAC, 0xB9, 0x90, 0x9F, 0x4C, 0xB2, 0xCB, 0x00, 0x6F, 0x28, 0xA1, 0xB6, 0x9B, 0xD0, 0x7B, 0x36, 0x4F, 0x9C, 0xCF, 0x98, 0x8A, 0x0B, 0x78, 0xB4, 0x7E, 0x2B, 0xEF, 0x58, 0xB5, 0xBA, 0x55, 0xB8, 0x10, 0x2F, 0x44, 0xAE, 0x89, 0x08, 0xC4, 0x3B, 0x9E, 0xF9, 0x6D, 0xF2, 0x15, 0x1D, 0x30, 0x47, 0x8E, 0x31, 0x2D, 0xD8, 0x6B, 0x3D, 0x11, 0x14, 0xA2, 0x83, 0xCE, 0xBB, 0x81, 0xBC, 0x76, 0x38]
by1780 = [0x38, 0x5A, 0xC7, 0x98, 0x15, 0x6A, 0xC9, 0x28, 0x33, 0xEA, 0xF4, 0xD9, 0xDB, 0x77, 0xB8, 0x49, 0x1B, 0x79, 0xF5, 0xFD, 0x3E, 0xA2, 0xDE, 0x17, 0xC4, 0x5E, 0xE5, 0x11, 0xB6, 0x1D, 0x86, 0xF9, 0x90, 0x78, 0x8A, 0x14, 0x12, 0xB1, 0xC2, 0x21, 0xF1, 0x02, 0x58, 0xA1, 0x23, 0x0C, 0xAD, 0xA5, 0x50, 0x48, 0x1E, 0x6D, 0xF8, 0x96, 0x9D, 0x19, 0x00, 0xBD, 0x26, 0xCE, 0xA7, 0x24, 0x2E, 0x39, 0x7B, 0xFA, 0x5F, 0xCC, 0x1A, 0x0B, 0x40, 0x0F, 0x4B, 0x82, 0xE2, 0x97, 0x10, 0x2A, 0xFC, 0x3B, 0xB2, 0x66, 0x27, 0x54, 0x07, 0xE3, 0x08, 0xA3, 0xA6, 0xED, 0x62, 0x13, 0x9C, 0x20, 0x01, 0x92, 0xE8, 0xAE, 0xBE, 0xE1, 0x0A, 0x41, 0x94, 0x80, 0xA9, 0x2F, 0x29, 0x70, 0x35, 0x16, 0xF7, 0x6B, 0xFE, 0x9E, 0x0D, 0xD3, 0x7F, 0x1F, 0xA0, 0x32, 0xD2, 0x52, 0x05, 0x76, 0x89, 0x9B, 0x7A, 0x8F, 0x99, 0xEF, 0xCF, 0x51, 0x0E, 0xEC, 0x59, 0x5C, 0x37, 0xD5, 0x8E, 0x31, 0x34, 0x2D, 0x93, 0x25, 0x1C, 0xC8, 0x5B, 0x47, 0x9F, 0x03, 0x67, 0x7E, 0x42, 0x7D, 0x3A, 0xAA, 0x57, 0xDA, 0x9A, 0xAB, 0x74, 0x72, 0xE4, 0xB7, 0x5D, 0xCD, 0x87, 0x46, 0x2B, 0x43, 0xF3, 0xD0, 0x85, 0x55, 0xBB, 0xD4, 0xC6, 0x61, 0x56, 0x04, 0x65, 0x7C, 0x88, 0xC3, 0x73, 0xBC, 0xEB, 0xDD, 0x4D, 0xE0, 0xE6, 0xC0, 0x63, 0x8D, 0xF2, 0x81, 0xF6, 0xA8, 0x3D, 0x3F, 0xA4, 0xE9, 0x4A, 0xB5, 0xF0, 0xCA, 0x8B, 0x2C, 0xD7, 0xAC, 0xC5, 0xC1, 0xBF, 0x53, 0xD1, 0x6F, 0x06, 0xE7, 0xD6, 0x09, 0x95, 0x44, 0x71, 0xB9, 0x83, 0x4C, 0x22, 0xAF, 0xB4, 0x75, 0x36, 0x30, 0xCB, 0xEE, 0x91, 0x45, 0x8C, 0x4E, 0x6E, 0x6C, 0x4F, 0x84, 0xBA, 0xFF, 0x64, 0xB3, 0x60, 0xFB, 0xB0, 0x18, 0xD8, 0xDF, 0x3C, 0x68, 0xDC, 0x69]
by1d80 = [0xD1, 0x9C, 0x68, 0xC0, 0x13, 0xAC, 0x48, 0x32, 0xA3, 0xBA, 0x4C, 0xE7, 0x6D, 0xC8, 0x1C, 0xAB, 0xE2, 0x7A, 0x42, 0xE1, 0x7B, 0x16, 0x67, 0x03, 0xAE, 0x7E, 0xAA, 0x38, 0x22, 0x02, 0x39, 0x51, 0xC7, 0x79, 0xD7, 0xCB, 0xEF, 0x62, 0x98, 0xDC, 0x53, 0x72, 0x89, 0xA5, 0x4B, 0xC6, 0x86, 0xF6, 0xFC, 0x77, 0x5A, 0xF5, 0x2E, 0x3D, 0xB2, 0xFE, 0x59, 0x27, 0x80, 0x63, 0xDD, 0x1A, 0x12, 0x5E, 0xED, 0xB0, 0xBC, 0xC4, 0x5F, 0x11, 0xC9, 0x09, 0xC5, 0x75, 0x96, 0x0A, 0x2F, 0x00, 0x17, 0x81, 0x14, 0x47, 0xBB, 0x9D, 0x8E, 0x3C, 0xD6, 0xA1, 0xE0, 0xA2, 0x26, 0x5D, 0x08, 0x6E, 0x4E, 0xF1, 0xCF, 0x73, 0x8A, 0x90, 0x0B, 0xB3, 0x3E, 0xB6, 0x1F, 0xC3, 0xB7, 0xDA, 0x8D, 0x05, 0xEE, 0x18, 0x93, 0x3A, 0x6A, 0x8C, 0x43, 0x8F, 0xEB, 0xE9, 0x5B, 0x29, 0x37, 0x1E, 0x46, 0x33, 0x31, 0xFB, 0x35, 0x34, 0x61, 0x04, 0x0E, 0x2B, 0x74, 0xF9, 0x8B, 0x2C, 0x20, 0x0C, 0x7C, 0x28, 0x5C, 0xCA, 0xE6, 0x6B, 0xD8, 0x30, 0xE4, 0x21, 0x44, 0x70, 0x06, 0xA6, 0x60, 0x41, 0x84, 0x10, 0x95, 0x4F, 0x64, 0x83, 0xD2, 0x9A, 0xBE, 0xAF, 0x9F, 0x07, 0xC1, 0xB8, 0x3B, 0x65, 0xCC, 0x57, 0xB5, 0xD9, 0x92, 0xDE, 0x0D, 0xE3, 0xF3, 0xA4, 0xBD, 0x6F, 0xD3, 0x25, 0x88, 0x71, 0xFF, 0xA9, 0x36, 0xB1, 0x78, 0x24, 0x69, 0xAD, 0x19, 0xBF, 0xFD, 0xCD, 0x4A, 0xEA, 0x87, 0x91, 0xA8, 0x66, 0x82, 0x50, 0x0F, 0x99, 0x45, 0xF2, 0xD5, 0x9B, 0x94, 0x7D, 0xCE, 0xDB, 0xB9, 0x52, 0xE5, 0xF4, 0x01, 0x7F, 0xD4, 0x15, 0x2D, 0x3F, 0x1D, 0xA7, 0xC2, 0xFA, 0x40, 0xE8, 0xA0, 0x55, 0x6C, 0xF7, 0x1B, 0x58, 0x85, 0x56, 0x9E, 0xEC, 0x97, 0x23, 0xF0, 0x4D, 0xD0, 0xF8, 0x2A, 0x49, 0xB4, 0x76, 0x54, 0xDF]

def fun2():
    for i in range(1,len(flag)-1):
        for j in range(len(by280)):
            if flag[i] == by280[j]:
                flag[i] = j
                break

def fun3():
    for i in range(1,len(flag)-1):
        for j in range(len(by380)):
            if flag[i] == by380[j]:
                flag[i] = j
                break

def fun5():
    for i in range(1,len(flag)-1):
        for j in range(len(by580)):
            if flag[i] == by580[j]:
                flag[i] = j
                break

def fun7():
    for i in range(1,len(flag)-1):
        for j in range(len(by780)):
            if flag[i] == by780[j]:
                flag[i] = j
                break

def funb():
    for i in range(1,len(flag)-1):
        for j in range(len(byb80)):
            if flag[i] == byb80[j]:
                flag[i] = j
                break

def fund():
    for i in range(1,len(flag)-1):
        for j in range(len(byd80)):
            if flag[i] == byd80[j]:
                flag[i] = j
                break
                
                
def fun11():
    for i in range(1,len(flag)-1):
        for j in range(len(by1180)):
            if flag[i] == by1180[j]:
                flag[i] = j
                break
                
def fun13():
    for i in range(1,len(flag)-1):
        for j in range(len(by1380)):
            if flag[i] == by1380[j]:
                flag[i] = j
                break
                
def fun17():
    for i in range(1,len(flag)-1):
        for j in range(len(by1780)):
            if flag[i] == by1780[j]:
                flag[i] = j
                break

def fun1d():
    for i in range(1,len(flag)-1):
        for j in range(len(by1d80)):
            if flag[i] == by1d80[j]:
                flag[i] = j
                break

fun1d()
fun17()
fun13()
fun11()
fund()
funb()
fun7()
fun5()
fun3()
fun2()
print(bytearray(flag))
index = ['2', '3', '5', '7', 'b', 'd', '11', '13', '17', '1d']
# #y0u_4r3_7h3_m4573r_0f_r3v3r51n6_!

image-20221130172748967

==然后这里注意的是flag[i] = j后一定要加break,不然会无,然后第二段数据有多解,在移位操作处加&0xfffffff,比如((a1[12] << 6)&0xffffffff),这样才算和c代码成功转换==



转载请注明来源,欢迎对文章中的引用来源进行考证,欢迎指出任何有错误或不够清晰的表达。可以在下面评论区评论,也可以邮件至 jaytp@qq.com

×

喜欢就点赞,疼爱就打赏