SCTF

@TOC

这次比赛还是发现了自己的很多不足，第一个是内核类的题目比较陌生，导致有几个内核题我帮不上什么忙，再一个就是开发水平太菜了，推箱子那个游戏硬是卡了好长时间，最后差一点点但是放弃了
比赛后，也是打算好好的把这次题目复现一下，虽然题目难，但也不至于像看雪那么难~

被师傅们带飞

godness dance

这个应该是签到re题里面的签到题，赛后也是看了一下别的wp，直接动态调试，测试几组数据就可以理解程序的逻辑，我当时是动调到一半发现了规律，后面那一大串代码并没有什么阻碍后，把正向算法直接列了出来。

输入长度28位 a~z各一个 再加个i和u
正向算法 一共三个循环

#include<stdio.h>
char a[100]={
     0x00000002, 0x0000001A, 0x00000011, 0x0000001C, 0x00000018, 0x0000000B, 0x00000015, 
    0x0000000A, 0x00000010, 0x00000014, 0x00000013, 0x00000012, 0x00000003, 0x00000008, 0x00000006, 
    0x0000000C, 0x00000009, 0x0000000E, 0x0000000D, 0x00000016, 0x00000004, 0x0000001B, 0x0000000F, 
    0x00000017, 0x00000001, 0x00000019, 0x00000007, 0x00000005
};

char flag[100]="0abcdefghijklmnopqrstuvwxyziu";
char flag2[100];
char xb[400];
int main(){
        flag[0]=0;
        for(int i=1;i<=28;i++){
                xb[flag[i]]++;    //记录下标
        }
        int v7=0;
        for(int i=1;i<=200;i++){
                v7+=xb[i];
                xb[i]=v7;          //求累加和
        }
        int v10,v11;
        for(int i=28;i>0;i--){
                v10=flag[i];     
                v11=xb[v10];
                flag2[v11]=i;
                xb[v10]=v11-1;
        }
        for(int i=0;i<=28;i++){
                printf("%x ",flag2[i]);
        }  
        return 0;
}

这个直接可逆

#include<stdio.h>
char xb[500]={
0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005, 0x00000006, 0x00000007, 0x00000008, 0x0000000A, 0x0000000B, 0x0000000C, 0x0000000D, 0x0000000E, 0x0000000F, 0x00000010, 0x00000011, 0x00000012, 0x00000013, 0x00000014, 0x00000015, 0x00000017, 0x00000018, 0x00000019, 0x0000001A, 0x0000001B, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C, 0x0000001C};
char a[100]={
     0,0x00000002, 0x0000001A, 0x00000011, 0x0000001C, 0x00000018, 0x0000000B, 0x00000015, 
    0x0000000A, 0x00000010, 0x00000014, 0x00000013, 0x00000012, 0x00000003, 0x00000008, 0x00000006, 
    0x0000000C, 0x00000009, 0x0000000E, 0x0000000D, 0x00000016, 0x00000004, 0x0000001B, 0x0000000F, 
    0x00000017, 0x00000001, 0x00000019, 0x00000007, 0x00000005
};
char flag[100];
int main(){
        int v11,v10;
        for(int i=28;i>0;i--){
                for(int j=1;j<=28;j++){
                        if(a[j]==i){
                                v11=j;
                                //printf("%d,",v11);
                                break;
                        }
                }
                //for(int q=97;q<=122;q++){
                //        printf("%x ",xb[q]);
                //}
                //printf("!%x ",v11);
                for(int q=97;q<=122;q++){
                        if(xb[q]==v11){
                                v10=q;
                                printf("%c ",q);
                                
                        }
                }
                printf("\n");
                xb[v10]=v11-1;
        }
        return 0;
}

求出来的更具输入的限制，还原flag即可

CplusExceptionEncrypt

这个c++的核心逻辑被异常处理隐藏了，不能看到反编译的结果，但是题目好在把符号都给还原了，可以看汇编边调边做
主要加密是魔改的tea和魔改的aes，代码量确实很多，不过对加密算法熟悉的话会很快的做出来
cslime的代码

#include <iostream>
unsigned char roundkeys[] = { 0x57, 0x65, 0x6C, 0x63, 0x6F, 0x6D, 0x65, 0x5F, 0x74, 0x6F, 0x5F, 0x73, 0x63, 0x74, 0x66, 0x21, 0xC4, 0x56, 0x91, 0x98, 0xAB, 0x3B, 0xF4, 0xC7, 0xDF, 0x54, 0xAB, 0xB4, 0xBC, 0x20, 0xCD, 0x95, 0x71, 0xEB, 0xBB, 0xFD, 0xDA, 0xD0, 0x4F, 0x3A, 0x05, 0x84, 0xE4, 0x8E, 0xB9, 0xA4, 0x29, 0x1B, 0x3C, 0x4E, 0x14, 0xAB, 0xE6, 0x9E, 0x5B, 0x91, 0xE3, 0x1A, 0xBF, 0x1F, 0x5A, 0xBE, 0x96, 0x04, 0x9A, 0xDE, 0xE6, 0x15, 0x7C, 0x40, 0xBD, 0x84, 0x9F, 0x5A, 0x02, 0x9B, 0xC5, 0xE4, 0x94, 0x9F, 0xE3, 0xFC, 0x3D, 0xB3, 0x9F, 0xBC, 0x80, 0x37, 0x00, 0xE6, 0x82, 0xAC, 0xC5, 0x02, 0x16, 0x33, 0xB4, 0xBB, 0xFE, 0x15, 0x2B, 0x07, 0x7E, 0x22, 0x2B, 0xE1, 0xFC, 0x8E, 0xEE, 0xE3, 0xEA, 0xBD, 0xE5, 0x3C, 0x84, 0x3D, 0xCE, 0x3B, 0xFA, 0x1F, 0xE5, 0xDA, 0x06, 0x91, 0x0B, 0x39, 0xEC, 0x2C, 0x77, 0xF2, 0xF5, 0x16, 0xB9, 0xC9, 0x0F, 0x09, 0x5C, 0x13, 0x09, 0x98, 0x57, 0x2A, 0xE5, 0xB4, 0x89, 0x2B, 0x78, 0x4D, 0x30, 0xE2, 0x77, 0x44, 0x6C, 0xF1, 0x7E, 0xDC, 0x3B, 0xDB, 0x9B, 0x68, 0x06, 0x3F, 0x3D, 0xAF, 0x36, 0xDD, 0x4A, 0xEB, 0x5A, 0x2C, 0x34, 0x37, 0x61, 0xF7, 0xAF, 0x5F };;

void AddRoundKeys(unsigned char* data, unsigned char* key) {
    for (int i = 0; i < 0x10; i++) {
        data[i] ^= key[i];
    }
}
void SubBytes(unsigned char* plaintext, unsigned char* plaintextencrypt, int count)/*S盒置换*/
{
        unsigned int row, column;
        unsigned char Sbox[16][16] = {
                /* 0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f */
                /*0*/{ 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76 },
                /*1*/{ 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0 },
                /*2*/{ 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15 },
                /*3*/{ 0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75 },
                /*4*/{ 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84 },
                /*5*/{ 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf },
                /*6*/{ 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8 },
                /*7*/{ 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2 },
                /*8*/{ 0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73 },
                /*9*/{ 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb },
                /*a*/{ 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79 },
                /*b*/{ 0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08 },
                /*c*/{ 0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a },
                /*d*/{ 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e },
                /*e*/{ 0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf },
                /*f*/{ 0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 }
        };// 填充Sbox矩阵
        for (int i = 0; i < count; i++)
        {
                row = (plaintext[i] & 0xF0) >> 4;
                column = plaintext[i] & 0x0F;
                plaintextencrypt[i] = Sbox[row][column];
        }
}
void SubBytesRe(unsigned char* plaintext, unsigned char* plaintextencrypt, int count)/*S盒逆置换*/
{
        unsigned int row, column;
        unsigned char Sbox[16][16] = {
                /* 0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f */
                {0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb},
                {0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb},
                {0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e},
                {0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25},
                {0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92},
                {0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84},
                {0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06},
                {0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b},
                {0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73},
                {0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e},
                {0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b},
                {0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4},
                {0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f},
                {0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef},
                {0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61},
                {0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d}
        };        // 填充Sbox矩阵
        for (int i = 0; i < count; i++)
        {
                row = (plaintext[i] & 0xF0) >> 4;
                column = plaintext[i] & 0x0F;
                plaintextencrypt[i] = Sbox[row][column];
        }
}

void ShiftRows(unsigned char* state)/*行移位*/
{
        unsigned char temp = 0;

        temp = state[1];
        state[1] = state[5];
        state[5] = state[9];
        state[9] = state[13];
        state[13] = temp;
        temp = state[2];
        state[2] = state[10];
        state[10] = temp;
        temp = state[6];
        state[6] = state[14];
        state[14] = temp;
        temp = state[15];
        state[15] = state[11];
        state[11] = state[7];
        state[7] = state[3];
        state[3] = temp;

}
void ShiftRowsRe(unsigned char* state)/*行移位的逆*/
{
        unsigned char temp = 0;

        temp = state[13];
        state[13] = state[9];
        state[9] = state[5];
        state[5] = state[1];
        state[1] = temp;
        temp = state[14];
        state[14] = state[6];
        state[6] = temp;
        temp = state[10];
        state[10] = state[2];
        state[2] = temp;
        temp = state[3];
        state[3] = state[7];
        state[7] = state[11];
        state[11] = state[15];
        state[15] = temp;
}

static uint8_t xtime(uint8_t x)
{
        return ((x << 1) ^ (((x >> 7) & 1) * 0x1b));
}
void MixColumns(unsigned char* text)
{
        uint8_t i;
        uint8_t Tmp, Tm, t;
        for (i = 0; i < 4; ++i)
        {
                t = text[i * 4 + 0];
                Tmp = text[i * 4 + 0] ^ text[i * 4 + 1] ^ text[i * 4 + 2] ^ text[i * 4 + 3];
                Tm = text[i * 4 + 0] ^ text[i * 4 + 1]; Tm = xtime(Tm);  text[i * 4 + 0] ^= Tm ^ Tmp;
                Tm = text[i * 4 + 1] ^ text[i * 4 + 2]; Tm = xtime(Tm);  text[i * 4 + 1] ^= Tm ^ Tmp;
                Tm = text[i * 4 + 2] ^ text[i * 4 + 3]; Tm = xtime(Tm);  text[i * 4 + 2] ^= Tm ^ Tmp;
                Tm = text[i * 4 + 3] ^ t;              Tm = xtime(Tm);  text[i * 4 + 3] ^= Tm ^ Tmp;
        }

        return;
}

static uint8_t Multiply(uint8_t x, uint8_t y)
{
        return (((y & 1) * x) ^
                ((y >> 1 & 1) * xtime(x)) ^
                ((y >> 2 & 1) * xtime(xtime(x))) ^
                ((y >> 3 & 1) * xtime(xtime(xtime(x)))) ^
                ((y >> 4 & 1) * xtime(xtime(xtime(xtime(x)))))); /* this last call to xtime() can be omitted */
}
void MixColumnsRe(unsigned char* text)
{

        int i;
        uint8_t a, b, c, d;
        for (i = 0; i < 4; ++i)
        {
                a = text[i * 4 + 0];
                b = text[i * 4 + 1];
                c = text[i * 4 + 2];
                d = text[i * 4 + 3];

                text[i * 4 + 0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^ Multiply(d, 0x09);
                text[i * 4 + 1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^ Multiply(d, 0x0d);
                text[i * 4 + 2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^ Multiply(d, 0x0b);
                text[i * 4 + 3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^ Multiply(d, 0x0e);
        }

        return;
}

void dec_data(unsigned char *data) {
        unsigned char* proundkey = &roundkeys[16 * 10];
        AddRoundKeys(data, proundkey);
        ShiftRowsRe(data);
        SubBytesRe(data, data, 16);
        proundkey -= 16;
    for (int i = 0; i < 9; i++) {
                AddRoundKeys(data, proundkey);
                if (*proundkey == 0xC4) {
                        printf("1");
                }
                MixColumnsRe(data);
                ShiftRows(data);
                SubBytes(data, data, 16);
                proundkey -= 16;
    }
        for (int i = 0; i < 16; i++) {
                data[i] ^= roundkeys[i];
                data[i] ^= 0x66;
        }
        unsigned int& v0 = *(unsigned int*)(data);
        unsigned int& v1 = *(unsigned int*)(data+4);
        unsigned int& v2 = *(unsigned int*)(data+8);
        unsigned int& v3 = *(unsigned int*)(data+12);

        unsigned int& k0 = *(unsigned int*)(roundkeys);
        unsigned int& k1 = *(unsigned int*)(roundkeys + 4);
        unsigned int& k2 = *(unsigned int*)(roundkeys + 8);
        unsigned int& k3 = *(unsigned int*)(roundkeys + 12);

        unsigned int delta = 0x73637466;
        unsigned char *byte_delta = (unsigned char*)&delta;
        v0 ^= byte_delta[3];
        v1 ^= byte_delta[2];
        v2 ^= byte_delta[1];
        v3 ^= byte_delta[0];

        unsigned int sum1 = 0x6c6e8cc0;
        unsigned int sum2 = 0x6c6e8cc0;

        for (int i = 0x1F; i >= 0; i--) {
                v1 -= (sum1 + i) ^ (k1 + (v0 >> 5)) ^ (sum1 + v0) ^ (k0 + (v0 << 4));
                v3 -= (sum2 + i) ^ (k1 + (v2 >> 5)) ^ (sum1 + v2) ^ (k0 + (v2 << 4));

                v0 -= (sum1 + i) ^ (k3 + (v1 >> 5)) ^ (sum1 + v1) ^ (k2 + (v1 << 4));
                v2 -= (sum2 + i) ^ (k3 + (v3 >> 5)) ^ (sum2 + v3) ^ (k2 + (v3 << 4));

                sum1 -= delta;
                sum2 -= delta;
        }

}

int main()
{
        unsigned int sum1 = 0;
        unsigned int sum2 = 0;
        unsigned int delta = 0x73637466;
        for (int i = 0; i < 0x20; i++) {
                sum1 += delta;
                sum2 += delta;
        }
        printf("%x\n", sum1);
        printf("%x\n", sum2);

    /*srand(0x53435446);

    for (int i = 0; i < 3; i++) {
        printf("0x%x\n", rand());
    }*/

    unsigned char dst[0x21] = { 0xBE, 0x1C, 0xB3, 0xF3, 0xA1, 0xF4, 0xE4, 0x63, 0x11, 0xE1, 0x1C, 0x6B, 0x54, 0x0A, 0xDF, 0x74, 0xF2, 0x93, 0x55, 0xDA, 0x48, 0xFC, 0xA2, 0x3C, 0x89, 0x63, 0x2E, 0x7F, 0x8D, 0xA4, 0x6D, 0x4E };;

        dec_data(dst);
        dec_data(dst+0x10);
        dst[0x20] = 0;
        printf("%s\n", dst);
}

其他的解法还有
su战队的师傅们修改一些代码让其把关键加密显示出来
s0uthwood再begin_catch后下断点让其ida可以调试
不过如何 了解c++的异常处理机制是最主要的
c++的异常处理机制

SycGame

这是个推箱子游戏，这个游戏 其实还是不容易看出来的，刚开始就在函数里面绕来绕去，这里索引一个表，那里索引一个表，但是慢慢分析，加上每次400个随机数有那么几个固定的负数，可以发现出这个游戏。

每次的400个数据里有4个-1 4个-3 和一个-2
-2是玩家位置
-1是箱子
-3是目的地

再通过动态调试的时候会发现有一个3005大小的01表 这个代表着墙还是路，那400个随机数用20*20排开，大数直接索引01表，生成地图。

到这里虽然逻辑理清楚了，但是要写自动化脚本还是比较困难的。。。
这里放一个南邮师傅们的代码

from pwn import *
import copy
import os
import time

class addr:
    def __init__(self, x, y):
        self.x = x
        self.y = y

boxs = []
storage = []
used_storaged = [0] * 4

def isprime(n):
    i = 2
    while i * i < n:
        if n % i == 0:
            return False
        i += 1
    return True

def generate_map(content):
    arr = []
    cur = 0
    for i in range(0, len(content)):
        if content[i] != " ":
            continue
        # print(s[cur:i][1:])
        arr.append(int(content[cur:i][1:]))
        cur = i
        # print(cur, end = " :")
    arr.append(int(content[cur:][1:]))
    map = ['#'] * 400
    for i in range(0, 20):
        for j in range(0 ,20):
            if arr[20 * i + j] == -1:
                map[20 * i + j] = '$'
                continue
            if arr[20 * i + j] == -3:
                map[20 * i + j] = '.'
                continue
            if arr[20 * i + j] == -2:
                map[20 * i + j] = '@'
                continue
            if isprime(arr[20 * i + j]):
                map[20 * i + j] = '#'
            else:
                map[20 * i + j] = '_'
    return map

def judge(x, y, map):
    if map[20 * y + x] == '#' or map[20 * y + x] == '$' or map[20 * y + x] == '*' or map[20 * y + x] == '.':
        return False
    return True

def judge_1(x, y, map):
    if map[20 * y + x] == '#' or map[20 * y + x] == '$' or map[20 * y + x] == '*':
        return False
    return True

def judge_2(x, y, map):
    if map[20 * y + x] == '#' or map[20 * y + x] == '$' or map[20 * y + x] == '*' or map[20 * y + x] == '.':
        return False
    return True

def judge_pre(x, y, map):
    if map[20 * y + x] == '#' or map[20 * y + x] == '$' or map[20 * y + x] == '*' or map[20 * y + x] == '.':
        return False
    return True

def judge_connect(des_x, des_y, map):
    if judge(des_x, des_y, map) == False:
        return False
    cur_x = 0
    cur_y = 0
    for yy in range(0, 20):
        for xx in range(0 ,20):
            if map[yy * 20 + xx] == '@':
                cur_x = xx
                cur_y = yy
    queue = [addr(cur_x, cur_y)]
    check_map = [0] * 400
    while len(queue) > 0:
        cur_x = queue[0].x
        cur_y = queue[0].y
        queue.pop(0)
        check_map[cur_y * 20 + cur_x] = 1
        x_offset = [0, 0, -1, 1]
        y_offset = [-1, 1, 0, 0]
        for i in range(0, 4):
            next_x = cur_x + x_offset[i]
            next_y = cur_y + y_offset[i]
            if next_x < 0 or next_x > 19 or next_y < 0 or next_y > 19:
                continue
            if judge(next_x, next_y, map) and check_map[next_y * 20 + next_x] == 0:
                if next_x == des_x and next_y == des_y:
                    return True
                queue.append(addr(next_x, next_y))
                check_map[next_y * 20 + next_x] = 1
    return False

def map_update(cur_x, cur_y, destination, map):
    if destination == 'w':
        map[cur_y * 20 + cur_x] = '_'
        for j in range(0, 4):
            if cur_x == storage[j].x and cur_y == storage[j].y:
                map[cur_y * 20 + cur_x] = '.'
        cur_y -= 1
        if map[cur_y * 20 + cur_x] == '$' or map[cur_y * 20 + cur_x] == '*':
            if map[(cur_y - 1) * 20 + cur_x] == '.':
                map[(cur_y - 1) * 20 + cur_x] = '*'
            else:
                map[(cur_y - 1) * 20 + cur_x] = '$'
        map[cur_y * 20 + cur_x] = '@'
    if destination == 's':
        map[cur_y * 20 + cur_x] = '_'
        for j in range(0, 4):
            if cur_x == storage[j].x and cur_y == storage[j].y:
                map[cur_y * 20 + cur_x] = '.'
        cur_y += 1
        if map[cur_y * 20 + cur_x] == '$' or map[cur_y * 20 + cur_x] == '*':
            if map[(cur_y + 1) * 20 + cur_x] == '.':
                map[(cur_y + 1) * 20 + cur_x] = '*'
            else:
                map[(cur_y + 1) * 20 + cur_x] = '$'
        map[cur_y * 20 + cur_x] = '@'
    if destination == 'a':
        map[cur_y * 20 + cur_x] = '_'
        for j in range(0, 4):
            if cur_x == storage[j].x and cur_y == storage[j].y:
                map[cur_y * 20 + cur_x] = '.'
        cur_x -= 1
        if map[cur_y * 20 + cur_x] == '$' or map[cur_y * 20 + cur_x] == '*':
            if map[cur_y * 20 + cur_x - 1] == '.':
                map[cur_y * 20 + cur_x - 1] = '*'
            else:
                map[cur_y * 20 + cur_x - 1] = '$'
        map[cur_y * 20 + cur_x] = '@'
    if destination == 'd':
        map[cur_y * 20 + cur_x] = '_'
        for j in range(0, 4):
            if cur_x == storage[j].x and cur_y == storage[j].y:
                map[cur_y * 20 + cur_x] = '.'
        cur_x += 1
        if map[cur_y * 20 + cur_x] == '$' or map[cur_y * 20 + cur_x] == '*':
            if map[cur_y * 20 + cur_x + 1] == '.':
                map[cur_y * 20 + cur_x + 1] = '*'
            else:
                map[cur_y * 20 + cur_x + 1] = '$'
        map[cur_y * 20 + cur_x] = '@'
    return cur_x,cur_y

def BFS_box2storage(box_x, box_y, storage_x, storage_y, map):
    cur_x = box_x
    cur_y = box_y
    queue = [addr(cur_x, cur_y)]
    check_map = [0] * 400
    from_map = [addr(0, 0) for i in range(400)]
    flag = False #标识到达终点
    choose = -1
    while len(queue) > 0:
        if flag:
            break
        cur_x = queue[0].x
        cur_y = queue[0].y
        queue.pop(0)
        check_map[cur_y * 20 + cur_x] = 1
        x_offset = [0, 0, -1, 1]
        y_offset = [-1, 1, 0, 0]
        pre_offset = [1, -1, 1, -1]
        for i in range(0, 4):
            next_x = cur_x + x_offset[i]
            next_y = cur_y + y_offset[i]
            pre_x = cur_x
            pre_y = cur_y
            if x_offset[i] != 0:
                pre_x += pre_offset[i]
            if y_offset[i] != 0:
                pre_y += pre_offset[i]
            if next_x < 0 or next_x > 19 or next_y < 0 or next_y > 19 or pre_x < 0 or pre_x > 19 or pre_y < 0 or pre_y > 19:
                continue
            if judge_1(next_x, next_y, map) and judge_pre(pre_x, pre_y, map) and check_map[next_y * 20 + next_x] == 0:
                for j in range(0, 4):
                    if next_x == storage[j].x and next_y == storage[j].y:
                        from_map[20 * next_y + next_x].x = cur_x
                        from_map[20 * next_y + next_x].y= cur_y
                        flag = True
                        choose = j
                        break
                if flag == True:
                    break
                queue.append(addr(next_x, next_y))
                from_map[20 * next_y + next_x].x = cur_x
                from_map[20 * next_y + next_x]. y= cur_y
                ##########################################
                check_map[next_y * 20 + next_x] = 1
    #路径回溯部分
    if flag == False:
        print("boxs (%2d, %2d) no solver" % (box_x, box_y))
        exit(0)
    order = [addr(storage[choose].x, storage[choose].y)]
    cur_x = from_map[20 * storage[choose].y + storage[choose].x].x
    cur_y = from_map[20 * storage[choose].y + storage[choose].x].y
    while cur_x != 0 and cur_y != 0:
        order.append(addr(cur_x, cur_y))
        temp_cur_x = from_map[20 * cur_y + cur_x].x
        temp_cur_y = from_map[20 * cur_y + cur_x].y
        cur_x = temp_cur_x
        cur_y = temp_cur_y
    order = order[::-1]
    ## print debug information
    # for i in range(0, len(order)):
    #     print("-> (%2d,%2d) " % (order[i].x, order[i].y), end = "")
    # print("")
    used_storaged[choose] = 1
    return order

def BFS_cur2des(x, y, des_x, des_y, map):
    if judge_connect(des_x,des_y, map) == False:
        print("no connected")
        exit(0)
    cur_x = x
    cur_y = y
    queue = [addr(cur_x, cur_y)]
    check_map = [0] * 400
    from_map = [addr(0, 0) for i in range(400)]
    flag = False #标识到达终点
    while len(queue) > 0:
        if flag:
            break
        cur_x = queue[0].x
        cur_y = queue[0].y
        queue.pop(0)
        check_map[cur_y * 20 + cur_x] = 1
        x_offset = [0, 0, -1, 1]
        y_offset = [-1, 1, 0, 0]
        for i in range(0, 4):
            next_x = cur_x + x_offset[i]
            next_y = cur_y + y_offset[i]
            if next_x < 0 or next_x > 19 or next_y < 0 or next_y > 19 :
                continue
            if judge_2(next_x, next_y, map) and check_map[next_y * 20 + next_x] == 0:
                if next_x == des_x and next_y == des_y:
                    from_map[20 * next_y + next_x].x = cur_x
                    from_map[20 * next_y + next_x].y= cur_y
                    flag = True
                    break
                queue.append(addr(next_x, next_y))
                from_map[20 * next_y + next_x].x = cur_x
                from_map[20 * next_y + next_x]. y= cur_y
                ########################################
                check_map[next_y * 20 + next_x] = 1
    order = [addr(des_x, des_y)]
    cur_x = from_map[20 * des_y + des_x].x
    cur_y = from_map[20 * des_y + des_x].y
    while cur_x != 0 and cur_y != 0:
        order.append(addr(cur_x, cur_y))
        temp_cur_x = from_map[20 * cur_y + cur_x].x
        temp_cur_y = from_map[20 * cur_y + cur_x].y
        cur_x = temp_cur_x
        cur_y = temp_cur_y
    order = order[::-1]
    # for i in range(0, len(order)):
    #     print("-> (%2d,%2d) " % (order[i].x, order[i].y), end = "")
    solve = ""
    for i in range(0, len(order) - 1):
        if (order[i].x - order[i + 1].x) == 0:
            if (order[i].y - order[i + 1].y) == 1:
                solve += "w"
            else:
                solve += "s"
        else:
            if (order[i].x- order[i + 1].x) == 1:
                solve += "a"
            else:
                solve += "d"
    return solve

def do_it(map):
    cur_x = 10
    cur_y = 10
    for i in range(0, 20):
        for j in range(0 ,20):
            if map[20 * i + j] == '.':
                storage.append(addr(j ,i))
            if map[20 * i + j] == '$':
                boxs.append(addr(j, i))
    sol = ""
    # return
    for k in range(0, 4):
        solve = ""
        t = 0
        while t < 4:
            if used_storaged[t] == 0:
                order = BFS_box2storage(boxs[k].x, boxs[k].y, storage[t].x, storage[t].y, map)
                break
            t += 1
        for i in range(0, len(order) - 1):
            cur_des_x = order[i].x - order[i + 1].x + order[i].x
            cur_des_y = order[i].y - order[i + 1].y + order[i].y
            if cur_des_x == cur_x and cur_des_y == cur_y:
                if (order[i].x - order[i + 1].x) == 0:
                    if (order[i].y - order[i + 1].y) == 1:
                        solve += "w"
                        temp_des = "w"
                    else:
                        solve += "s"
                        temp_des = "s"
                else:
                    if (order[i].x- order[i + 1].x) == 1:
                        solve += "a"
                        temp_des = "a"
                    else:
                        solve += "d"
                        temp_des = "d"
                # cur_x = order[i].x
                # cur_y = order[i].y
                cur_x, cur_y = map_update(cur_x, cur_y, temp_des, map)
            else:
                # if i != 0:
                #     map[boxs[k].y * 20 + boxs[k].x] = '_'
                #     map[order[i].y * 20 + order[i].x] = '$'
                #     boxs[k].y = order[i].y
                #     boxs[k].x = order[i].x
                temp = BFS_cur2des(cur_x, cur_y, cur_des_x, cur_des_y, map)
                solve += temp
                for j in range(0, len(temp)):
                    cur_x, cur_y = map_update(cur_x, cur_y, temp[j], map)
                if (order[i].x - order[i + 1].x) == 0:
                    if (order[i].y - order[i + 1].y) == 1:
                        solve += "w"
                        temp_des = "w"
                    else:
                        solve += "s"
                        temp_des = "s"
                else:
                    if (order[i].x- order[i + 1].x) == 1:
                        solve += "a"
                        temp_des = "a"
                    else:
                        solve += "d"
                        temp_des = "d"
                # cur_x = order[i].x
                # cur_y = order[i].y
                cur_x, cur_y = map_update(cur_x, cur_y, temp_des, map)
        # map[boxs[k].y * 20 + boxs[k].x] = '_'
        # map[storage[cur_choose].y * 20 + storage[cur_choose].x] = '*'
        sol += solve
        # print(solve)
    # print(sol)
    return sol

def my_init():
    global boxs
    global storage
    global used_storaged
    boxs = copy.copy([])
    storage = copy.copy([])
    used_storaged = copy.copy([0] * 4)

if __name__ == "__main__":
    # p = process('./sycgame')
    context.log_level = "debug"
    p = remote("124.70.152.166", 1448)
    for i in range(0, 5):
        my_init()
        p.recvuntil("(Y/n)")
        p.send("Y\n")
        p.recvuntil("gift:\n")
        content = p.recvuntil("\n")[:-2]
        # print("*********************************")
        # print(content)
        content = content.decode()
        # print(content)
        map = generate_map(content)
        sol = do_it(map)
        print(sol)
        # p.interactive()
        p.recvuntil("Tell me sol:")
        p.send(sol)
        # print(p.recv())
    print('&' * 200)

    p.interactive()

#!/bin/bash
int=1
while(( $int<=1000 ))
do
    python3 exp.py >> out.txt
    let "int++"
    sleep 0.5
    echo "" >> out.txt
    echo "" >> out.txt
done

要是我自己写的话，至少要搞7h+ 我算法学的不是特别好

SycOS

好吧，看了以后感觉和内核没啥关系，我再感觉还不如那个异常处理的题难呢？
主函数很简单，两次加密 然后比较
加密一
加密一的核心逻辑
加密二

又是tea

0x91a是调用了一个0x16的系统调用
可以动调，也可以分析，当然也可以猜
是个交换

逆向脚本（还是cslime的脚本）

#include <iostream>
#include "windows.h"

unsigned char dst1[] = "\x58\xC0\x98\x44\x55\x04\x41\x2C\x7E\x4B\x49\x50\xE1\x97\x57\x16\x3D\xC7\x6F\xDB\xEA\x4F\xCE\xEA\x2A\xDC\x2D\x39\x8F\x39\x92\x98\xA3\x78\x90\x69\x17\x65\x16\x8B\x4E\xC7\xB2\x12\x45\xE4\x15\xA6\x6C\xCC\x36\xDD\xE2\xFC\x47\x51\xF3\x8F\xC4\xBF\x07\x16\xD5\x17\xC9\x72\x8D\x42\xA4\x23\x18\xB1\x3A\x94\x03\x09\x75\xFD\x04\xF4\xD4\x39\x1D\xA6\xAD\xA4\x69\xDD\xC2\x38\xCF\x06\x56\xB6\x98\xB6\xE3\x67\x5C\x18\x88\x98\xC8\xCA\x46\x16\x57\x33\xDD\x5B\xA8\xFE\x23\x7A\x7C\x85\x67\xD1\x53\x53\xF2\x53\xD4\x7D\x97\x93\xB7\x7F\x49\x47\xB9\xE7\x5A\x5B\x4A\xCD\x19\xB9\xB3\x53\xD5\xF6\xD7\xB0\x47\xCD\xBA\x5A\x7E\x9D\x27\x72\x9D\x78\xD3\x1D\xB0\xA7\x28\x45\xD9\x6D\xE0\xEA\xC6\x66\x9A\x07\x9A\xB7\x09\x18\xBD\x3E\xD0\x35\x64\xA4\xC2\x26\x9D\x34\xFE\x85\x4C\x01\xA6\xF3\x02\x4A\xD5\x6C\x83\xD1\xC7\x4E\xE8\xC5\xC2\x27\xAD\x70\x0F\x26\x7F\xB9\x9B\xCB\x76\xA9\x7E\xCA\x64\x5C\x31\x56\xB7\xFE\xB8\xCE\xAC\xB0\x3F\xCA\x4B\x9A\x8E\x85\x4E\x36\x87\x5A\x74\xE5\x7D\x73\x1F\xD1\xFD\x26\xC0\xB2\xE6\xB1\xFA\x06\x95\x4E\xC9\xEC\x50\xFE\x1A\x13\xE4\x6F\x69\x48\xA4\xCD\xED\xAB\xAD\xEA\x2E\x05\x92\x7C\xBE\xBE\xB0\xE7\xBE\x7F\x53\xA4\x1D\xEF\x4A\x4F\xC1\xFE\x86\xD9\x20\x4A\x28\x2D\xE5\x15\x80\x43\x3E\x8F\x03\x2F\xB5\x75\x1D\x7E\x78\x92\x12\x2E\xAB\x47\x6A\xA0\xF7\x0C\x49\x85\xFD\x0A\x6B\x7D\x85\x4E\x5B\xD4\x07\xCC\x3C\xCF\x7D\x6C\xEF\xF7\xDE\x78\x54\x41\x0C\x9E\x56\xC4\x7B\xD7\x9D\xC1\xFF\x4D\x28\x78\x96\xC0\x78\x48\xF7\xA4\xFE\xEE\x96\xEE\x16\xAB\x31\x85\xE4\x4F\xBA\xB8\xFE\x8B\xF5\x99\xA4\xB5\xE2\x8F\xE5\xF8\x9B\xC2\xBA\x75\xC0\x39\x04\xD1\x0D\xCC\x69\x2F\x4D\xB1\x2A\x3F\x1E\x09\xE6\x1E\xF7\x63\xDF\x1C\xBB\xD4\x23\x17\xF0\x3D\xED\xA5\xCD\x74\x5F\x10\xDE\x94\xA2\x9E\x3D\x99\xA6\xBB\x08\xCD\x59\x7A\x2A\x67\xBE\xB5\xA8\x1C\x2C\x18\xDA\xD9\x29\x22\x83\xCD\x77\xBD\xAC\xF1\x65\x87\x45\xBF\x75\x95\xE6\x61\xCF\x47\xB4\xBE\x94\x62\x6C\x87\x7B\xC3\x9A\x55\x54\x44\xD8\xFE\x28\xB9\x05\xB3\xED\xF6\x14\x54\xEC\x26\x1E\xB2\xAC\xE3\x44\x41\x87\xC0\x2E\x7A\xAA\x5E\x3A\xB3\xA9\x43\xA7\x31\x1F\x2B\x03\x36\x91\x87\x49\x93\x6F\x1F\xB6\x84\x2E\x33\xB9\x82\x65\x75\xC9\x5B\x40\x65\x6F\x52\x48\x5B\xBC\x2A\xB5\xEC\x98\x37\xEA\x9C\x79\x70\x4A\xBF\x49\x36\xB2\x45\xCD\x38\xD0\xFE\xCE\x99\xAC\xBD\x33\x1D\x1E\x02\xAD\xB2\xD3\xA6\x81\xED\x07\x35\xB5\xD8\x04\x42\x39\xB4\xFC\xF4\x85\xE0\x66\x53\x4F\x2F\x0B\x17\x58\x14\xED\x6A\xA5\xB5\x0E\x13\x6C\x35\x98\x8D\x25\x48\x60\x7C\xD3\xEB\x94\x2A\x5C\xAD\x49\x86\x92\xD7\xA0\xD0\xF3\x8C\x75\x9F\xD3\xC6\x74\xDE\x54\x4C\x71\xE3\x40\x0C\x4E\xFC\x0A\xB8\xD9\x12\x29\x0B\xDC\x74\x62\x44\x89\xE8\x99\x29\x66\x62\x77\xD6\x2D\xBE\xCF\x25\xF8\xF2\x4A\x2D\x73\x94\xA6\x3A\xA5\xF2\x05\x43\x86\x04\x98\x4B\x48\x2D\x80\xF7\x84\x6B\x6F\xC9\x1C\x93\x46\x01\x83\xBE\x68\x61\xB8\xCF\xA4\x2B\xA6\xF3\xBC\x7B\xA8\x29\x9F\x47\xA5\xF7\xD6\x3E\x6C\x37\x06\x88\xEC\xD1\x74\xC9\xA1\x1E\xD1\x99\x77\xB7\x95\x86\x52\xF2\xFC\x88\x24\x49\x51\x9D\xC1\x24\xB9\x96\x70\x3B\x9C\xAD\xEB\xAE\x62\xAE\x13\x55\x23\xB8\x75\x2B\x58\xDB\xE7\x24\xF5\xFF\x57\xBA\x5F\x45\xE5\xF9\xCF\xD0\x5F\xC2\x12\x60\x6A\x5D\xC8\x23\x20\x5E\x38\x0B\x05\xFA\x9C\x7D\xA8\x8C\x15\xC2\xC4\x2F\xDD\xED\x22\x97\x88\x43\xEE\xCE\xFC\x69\x15\x2D\xFE\x75\xD3\x9A\x6F\x60\xE8\x4B\x20\xEB\x53\x7D\x41\x31\x7B\xF8\x5B\x6C\xC8\x82\xFD\xC4\x9E\xB2\xAC\xAE\x00\xF1\xB7\x40\x7D\xBD\xFE\xA3\xB2\x16\x51\xAE\xA5\x50\x6B\xB4\x1D\xB8\x41\xFC\x27\x8D\xD5\x73\xA5\x86\xA5\x43\x3F\x4F\x35\xCE\x54\xE0\xA2\xCD\xA1\x93\x8A\xA4\xC6\x2F\xD9\xF9\x2D\xA2\xA2\x7A\x41\x90\x41\xD3\xD6\xF3\x0C\x52\x40\x39\x5B\x79\xA3\xA1\xA6\xF8\xF1\xA7\xF0\x04\x47\x6B\x22\x9E\x47\x78\x63\x84\x42\xC5\x7D\x9F\xE1\xE2\x32\x93\x9F\xFA\x2C\x61\xBE\x7B\xFE\x83\xB5\xBF\x9B\xEC\x52\xAE\x03\xBD\xA0\x13\x77\xBE\x8C\x4A\x4C\xE1\x1B\x0C\x9E\x76\x9E\x4B\x95\x74\x82\xC2\x7E\x09\xA2\x23\xA4\x94\x12\x92\x3E\xFD\x98\xDC\xF2\x6F\x27\xE7\xC8\xCB\x55\x67\x6F\x9D\x44\x5F\x03\x89\x05\x3F\x70\xF1\x9C\xD9\x0C\x3F\x91\xF6\x98\x20\xAD\x96\x6D\x18\xFA\xE1\x58\x0D\x6C\x55\x9A\xF9\x14\x14\x60\x2C\x8B\x72\xD2\x8A\x57\x95\x02\x01\x8D\x4C\x9F\x86\x08\xE6\x4A\xE9\xF1\x93\xFF\xAF\xC8\xD0\x64\xA9\x2B\xD9\xBB\xFB\x71\x16\x5B\x62\x12\x8D\x7D\xC2\x6C\x85\x39\xA9\xDE\xD8\xF9\x87\x4A\xB9\xF1\x6A\xDF\xC0\x0D\x39\x96\x00\x8C\x12\xFD\x1F\xE0\xFE\xFE\x2A\xB1\x6B\x02\x0F\xAF\x11\x38\x36\x04\xBE\x43\xEE\xD5\xFB\xB9\x17\x3A\x5E\xEF\x22\x0F\x5B\x7E\xB0\x5E\x17\x69\x3C\xE1\x63\x2E\x20\x61\x54\x61\x4C\x24\x9F\x9D\x5D\xE3\x35\x1D\x66\x41\xE1\x8C\xEF\xD4\xFD\x3E\x6C\xA3\x1D\xF9\x5A\x52\x72\x4B\x89\x7D\x1F\xC6\xFB\x66\xFD\x26\x46\x64\x37\x6F\xCE\x23\x0A\x21\x18\xDA\x38\x9C\x99\x58\x8D\xB3\x23\x1D\xB4\x00\x74\x9A\x24\x83\x94\xE9\x75\x3C\xC0\x38\x83\xBB\x97\x42\xA1\x98\x71\xE9\x6E\xE0\x70\xC0\xB1\x55\xDE\xBC\x17\xCA\x78\x5A\x4C\x94\xBB\x52\x6A\xC1\x6B\x8C\xD4\xA6\x87\x52\xA8\x05\xC7\xCB\x83\x97\x30\x5D\xAF\xC6\x50\xA8\x2A\xEE\xFB\xB5\x5B\xA7\x5E\xEF\x1E\x34\xCF\x8C\x62\x30\xFD\xB2\x3F\x44\x0B\xFF\x42\xAA\x6E\x47\x60\x9C\x9F\xF3\x08\x27\x02\xF3\x29\x53\x83\x7B\x1C\x3E\xB4\x95\x4B\x70\xE4\x99\x3B\xFE\x3E\xF0\x89\x7A\xD2\xB1\xAA\x64\x3D\xF7\xB2\xCE\x4F\x91\x1B\xAE\x6D\xC8\x7D\xD5\x64\xED\xAE\x6F\xD5\x23\x7D\x2A\x7A\x26\xB5\x73\x05\x6E\x9A\x26\x7F\x45\xE2\xA8\xAE\x1F\x1F\x6D\x9D\x40\xFD\x2E\x81\x59\xA7\x80\x69\xA7\x49\xCA\x9C\x1F\x32\x2E\x48\x15\x69\x69\x5A\x54\x4E\xF0\xD7\xB7\xFF\xB9\x5B\x69\x47\xF0\xD3\xDE\x1D\xF3\x4E\x45\x23\x24\xD2\x93\x29\x83\x56\x61\x4F\x88\x46\xF0\x7A\xB6\x2D\xE5\x1D\x4B\x73\xEF\xE5\x1A\xB3\x96\xD9\xAC\xAC\xC1\xDF\x64\x1E\x06\x4F\x66\x48\x81\x68\xE5\xF3\xE0\x6B\xB7\xCB\x9A\x59\xCC\x70\xEB\xCC\x07\x1D\xA9\x23\xCF\x1A\x5D\x71\x57\x0C\x67\xF4\xE0\xA5\x26\x30\x04\x7A\x0A\xE8\xF9\x52\x3E\x6B\x04\x8C\x11\xB7\x28\x56\xE6\xF9\xC5\x5B\xFE\x86\xD8\x35\xC7\x16\x70\xBC\x32\xEA\xA5\xBE\x0C\x59\x9B\x9C\x57\x7B\xDE\x3D\x6E\x65\xD2\xE3\xAA\x29\xFA\x57\xFB\xB7\x94\x50\xD3\x92\xB2\x41\x9E\xD2\x6A\xBB\x7A\x28\xAC\xD5\x6F\xF8\x0B\x8A\xEC\x4E\x15\x30\x53\x39\xB4\x64\xEC\x30\x64\x4D\x39\x89\xE3\x38\xB1\x3F\x8C\xFA\x34\x4B\xCC\xCB\xE8\xEF\x0F\xAF\x32\x03\x9F\x41\x22\x2D\x05\xBD\x4F\xDB\xAB\x3B\x98\x86\x47\xA7\xE9\x12\x45\x87\xED\x63\x86\xF2\x74\x08\xD8\x20\x10\x99\x57\x93\x71\xBA\xF2\x65\x5F\x88\x29\xBE\x4C\x0F\xCD\x1B\x10\xB0\x3F\x4A\xED\x69\x0C\x8C\x43\x81\xDB\x20\x6F\x29\x65\x8C\x34\xA2\xBE\xB4\x96\x75\xD7\xC8\xAA\x89\x40\x38\xBB\xB8\xEE\x41\x1A\x2B\xC6\xC5\xD0\x99\x41\x73\x82\x1F\xFB\x41\x52\xF4\x84\x1C\x31\x3D\x9B\x5A\xFB\xB6\x95\x07\x67\x32\x9F\x95\x12\xC6\x86\x20\x1B\x6C\x5D\x3D\x18\xCF\x99\xB5\x7C\x45\x60\x59\xBB\xFD\x20\xD3\x82\xA6\x92\x56\x06\x56\x64\x51\x87\x92\x46\x7B\x6C\xB0\x79\x12\xA1\x3E\x69\x8F\x2F\xA4\xCE\x24\x4F\x89\x11\x11\xA3\x50\x80\xA3\xF0\xCB\xAA\xB5\x59\x04\x77\x52\xF5\x3A\x18\xB0\x05\x24\x67\xE6\xBB\xD3\x62\xC4\xBB\x5C\x60\x5E\xD9\xFE\xFA\x66\x35\x02\x9B\x55\xA2\x27\xE2\xCB\x0B\xB8\x43\x2D\xB0\xD1\x11\x42\x10\x07\x67\x7D\x6B\x11\xC3\xE2\x37\xFF\x0A\x64\xF9\x2A\x61\xE2\xD6\x38\x5A\x91\xC3\x18\x75\xE9\xE8\xDA\x4C\xEA\x1A\x3B\xDB\x04\xC9\x50\x45\xBD\x1C\xE6\x0F\x01\xFA\x3E\xFC\x85\x52\x88\x3F\xFC\x56\x78\xF8\x35\xBC\x72\x09\x1F\x58\xFF\x86\xEE\x4E\xB7\x9C\xC8\xC0\x69\x18\xEF\x62\xBF\xF7\x19\x69\xF8\x11\x62\xDD\xC5\x59\xBA\xF2\x37\x6A\x25\x21\x96\x4E\x4B\xDC\xBA\x2C\xFD\x6E\x1C\x55\x9E\x0A\x34\x68\xE6\x2B\x10\x1C\x2D\x9E\x39\xF4\x6B\x44\x60\x9B\x2D\xA0\xC9\x19\x9C\x7A\x28\x19\x2A\xDD\x58\x49\xD6\x52\xF8\x83\x3A\x36\xEA\xEF\x35\xA2\xEB\xDB\xB5\x1C\x86\xC8\x34\xBC\xA4\x57\xE9\x75\x0A\x8D\x2F\x9F\x53\x90\xC1\x6F\xB1\x97\x83\x8A\x28\x5A\x1F\x71\x59\x46\x2F\xCA\x29\x23\xA3\x5F\x26\x46\x63\x07\xFE\x70\x9A\x54\xA2\x9E\x36\xAC\xEA\xFD\xAA\xAE\xB9\x9E\xC4\xD3\xAF\x99\x20\x85\x00\xA3\x11\xAA\x25\x02\x8C\x76\xAF\x82\x88\xEA\x00\x10\x9A\x48\x73\xCC\xB9\xBE\x73\xB9\xF2\x6D\x72\xE5\x85\x80\xBE\x8B\x28\x57\x76\x30\x34\x48\x30\x0E\x94\x7F\x8E\x06\x37\x00\xB4\x5F\xD9\xA7\xCA\x31\x8D\xE2\x42\xA6\x9C\x05\x8B\xB8\x10\x2A\xBC\x22\xA0\x1A\x56\x76\xA2\xAD\xB7\x3F\x3B\xEA\xB8\x50\xE7\x95\xF5\x15\x76\xC0\x35\x48\x0B\xF3\xED\xE4\x45\x4A\x2C\x88\x3A\x02\x4E\xDE\x53\x43\x42\xCD\x6D\x4C\xFE\x65\xDD\xDA\x13\x84\x57\xF6\xD1\xCD\x86\xDF\x96\xE2\xE1\xAB\xC1\x8E\xA0\x7B\x5C\x4E\xA9\xEE\x2C\x47\x1F\xC4\x02\x0A\xA4\xA4\x9D\xFA\x56\xCE\x0A\x9A\xCE\xB8\xD9\xFC\x32\x0A\x9C\x6E\xE6\xF8\x42\x14\x32\x90\xAC\xA6\x39\x4E\x05\xA3\xF7\xFB\x63\x16\x8B\x42\xCD\x5A\x8B\x92\xC2\xA4\x14\x21\x3C\x6C\xA2\xAE\xBF\x4C\xA8\x36\x4B\x14\xFC\x93\x3B\x3D\xAF\x95\xE4\x50\xD4\x76\xDA\x9A\xC0\xF3\xED\x80\x6C\x6A\xF0\x68\xFC\x1E\x4D\x9C\x4B\xDD\x1C\x1E\x55\x0A\xBC\x8C\xDA\xAF\x34\x5C\xB0\x3F\x78\xCC\x19\x0C\x4E\x41\xBE\x1B\x27\x33\xC2\xA5\xC4\xF6\x85\xF3\x55\x7B\xD2\xDB\xBC\xE2\x18\xB1\x06\x43\xC4\x63\x37\x30\x2A\x98\xFF\x4F\x85\xA8\x21\xA6\xA4\xA1\xDE\x56\xF4\x25\xBB\xAF\xEE\x6C\x0C\x56\x10\x4B\xD7\x72\x5C\xCA\x03\x42\x3B\xE7\xE4\x39\x82\xFF\x6D\x5A\xD0\x97\x8C\x99\x82\x32\x72\x2C\x7D\x19\x5D\xAF\x0C\x1C\xC5\x0B\xCB\xBB\x9C\x18\x91\xB7\x46\x5A\xCE\x73\xEC\xC4\x4A\xE4\x1F\xBE\x51\xA2\x45\xE2\x82\x09\x0B\x9E\x69\x1F\x2F\xED\x97\x90\xEA\x0F\x05\x37\xC9\x60\x64\x03\x6F\x62\xD7\xED\x49\xD7\xD9\x04\x84\x55\x02\x86\x62\x21\x61\xD2\xB4\x3B\xAF\x4C\x28\x69\xE3\xD8\xAC\xB6\x20\x4B\x16\x72\x32\xEB\x56\x54\xCE\x57\x4E\x67\x0D\x3E\x2A\xEE\xB6\xA7\x97\x8E\x4D\xFB\xDC\x0B\xDE\x09\xC2\x44\x15\x76\x09\x6F\x7C\x37\xAE\x3B\x22\x3A\xD7\xAE\xC5\xCA\x3C\xDE\x25\xBD\x6D\x4A\x8E\x5A\xF2\xF1\x6A\x52\xF2\xD7\xFE\xCB\x73\xBB\x37\xD5\x48\xFE\xA2\x67\x64\x7A\xB8\x82\x8E\xC4\x95\x40\x4A\x19\x15\x20\x52\x2A\x88\x4C\x03\x84\xF1\x17\x09\x6C\x69\x28\xF4\x15\xA3\x7F\x13\x95\xC7\x7F\x4D\xEE\x03\x09\x87\x72\x32\x49\xC4\x08\x52\xC5\x30\x6A\xC7\xDB\x39\xAD\xB0\x88\xBE\x02\x40\x10\x25\x10\xAF\xCC\x1B\xDD\x1E\x9D\x1C\x60\xB4\xFC\xA3\x69\x68\x45\xEC\x5D\x48\x5F\xDE\x3F\xEF\x94\x33\x2C\xB4\x4F\xA1\xB6\x5E\x2E\xC3\x9C\x47\x02\x1D\xFA\x08\xB5\x06\x63\x40\xB3\xC7\xCE\x42\x71\x26\x23\x37\x3D\x05\x8E\xC3\x99\x98\xA5\xD2\x93\x4B\x83\x7E\xF5\xB6\xD9\xE1\x3B\xA7\x6E\x86\xEB\xC0\x61\xA0\xAD\x9C\x89\x5A\x42\x3D\x58\xCD\xAF\x55\x9D\x13\x3C\x65\xB1\x23\xDB\xDB\x6E\x37\x4C\x46\x0F\x6E\xDD\x74\x85\x17\x40\x79\x81\xC5\x4D\x41\xED\x21\xE5\x5B\xE0\xF4\x41\x93\x4D\x77\xB1\x79\x63\xE8\x12\x3B\x53\x1E\xED\x36\xF0\x1A\xDC\x60\x6C\x84\xFC\x72\xAB\x8A\xD6\x8E\xF1\xB4\xDA\xD4\xDD\x3E\x00\x71\x95\x00\x02\x2F\x3C\x59\x05\x5F\xEF\x4C\xF7\x13\x07\x36\xFB\xEC\x14\xA8\xB1\xE4\xE9\x0A\x05\x6F\x1D\x7B\x16\xE8\xF2\x1C\x37\xBA\x72\x88\x1E\x14\x43\x95\xE5\x2C\xC6\xD8\x4D\x5B\xF3\x93\x2A\x54\xF2\xC3\xF9\x9F\x35\x8A\x6C\x63\x8E\xA1\x83\xDA\x1E\x22\x01\x8B\x2C\xD3\x53\x12\x21\xAC\x41\xF6\x09\x7C\xE6\xF9\xD7\xC2\x93\xFC\xCF\x59\xF1\x28\xC8\x51\x61\x43\x78\x66\xDF\x18\x51\xAA\xD8\xE2\x08\xA1\x66\x8F\x81\x6F\xBD\x9F\xDE\x67\xF4\x71\x2A\xEC\x7A\x7A\x5F\x78\x6C\x71\x4F\x19\x53\xE9\x87\x31\xE5\x23\xAD\x94\x2E\x30\xB4\xA1\x3D\xFF\x85\xCB\x26\x46\x54\x75\x32\x07\x4A\xC2\x8C\xDF\xE3\x80\x4A\xC6\x6E\x97\xC9\xD7\x1C\x9D\x5D\x28\x10\xA5\x47\x1D\xE2\x5F\x6E\xF4\x09\x27\x63\x55\x0D\xC7\xED\x6D\x27\xF4\x8F\xA4\xCD\x91\xA8\xC7\x57\xC6\x7E\x5A\xEC\xA6\x30\x52\x50\x8A\x3C\x6E\x22\xC7\x7F\xFB\x10\x06\xB5\xC6\x52\x8D\x8E\x13\xC7\xB8\x6A\x9D\xE6\xD5\x94\x0E\xD5\x08\x25\xF9\xBB\x2F\xE4\x9B\x8C\xBC\x25\x8F\xA3\xDA\xA6\xCA\x34\x51\x3D\x19\xE5\x78\xEB\x1F\x86\xC2\x71\x13\xE7\xF8\xB0\x54\x74\xE4\x5E\xE7\x1E\xFF\xF0\xAD\x9A\xB6\x19\xB9\xEC\xBD\x2E\x88\xBF\xB4\xD4\xE8\x52\x04\x36\xF9\x8E\x44\xB2\x82\x53\x03\x10\x80\x9B\x8D\xBE\x03\xE6\x61\x00\x59\xC6\x87\x80\xE6\xAD\x0E\x65\x43\x20\x6C\x8C\x31\x98\x41\x30\xA2\x04\x0F\x1F\x31\xC5\x32\xF6\x03\x30\x13\x72\xCB\x8B\xE2\x6C\xAC\x20\x9F\x54\xA3\x43\x30\x99\x33\x74\x50\x0D\x95\xFA\x07\xB8\x76\xEB\x19\x00\xE1\x65\x6C\xC2\x5A\x8E\x9C\x10\x59\x1E\x3D\x4A\xC1\xB1\x5C\x62\x1D\x72\x41\x53\x34\x08\x61\x40\xD0\xCE\xD6\xD5\xA5\xD6\x94\xE4\x14\x29\x2F\x66\x2B\x03\xD6\xB4\xB0\x01\x22\xDA\x67\x3F\xBF\xE4\x82\xE2\xFF\x6C\x40\x01\xA3\x07\xB1\xD2\x6C\x75\x50\x98\x0B\xE9\xBC\x77\xBA\xA9\x18\xA5\xA0\xDF\x4C\x70\x3B\x22\xBC\x02\xB9\x22\xD4\x17\xBC\x2F\x73\xDD\x1D\xA0\xE2\x73\xAE\xA3\x0D\xBB\xE1\x1A\x22\x12\xD9\xA7\xBE\x2F\xC4\xC6\xA7\xD2\xDA\x60\xF4\xDF\x66\x43\xCE\xAF\x02\xDB\xCB\x14\x22\x22\x93\x31\xEB\x78\x21\x27\x88\x59\x9A\xCF\x59\x60\xA5\x32\x80\x04\xCF\xA7\x6D\xB6\xAD\xA4\x2B\xA6\x02\x59\x50\xC8\x49\xC7\x9A\xB3\x17\x10\x84\x74\xCC\x21\x90\xE9\x42\x9A\xD2\xCE\x7D\x5C\x65\x03\x27\x51\x91\x4B\xA0\x9D\x54\xD6\x88\x93\x18\xA8\xBF\x31\xA1\xFA\xCE\xC7\xE1\x35\x42\x97\x27\xD3\x15\x83\x41\xE3\xA0\xF6\xC3\xC5\x76\x89\xBA\x8A\x7A\x37\x2B\xB7\xB2\x14\xE1\x32\xC1\x81\x6C\x2C\xC2\x30\xD3\x90\xAD\xA5\x94\x7E\x51\x20\x90\xBD\xE9\x1A\x68\x71\x57\x28\xDD\x71\xFC\x11\x29\x09\x0D\x9D\x7F\xAC\x00\x69\x69\xFC\x62\xA1\x0C\x44\x38\x2F\xAB\xA7\x8A\xD6\xA8\x69\x30\x9B\x6A\x38\xDF\xA8\xCA\x38\x75\x06\xF8\xDB\x29\xAB\xDA\xBD\xB4\x96\xE3\x8B\x2F\x6E\xB8\x0C\xD2\xBC\xC5\x1E\x2E\xAA\xF4\xF1\xAC\x7D\x31\x61\xC5\xF5\xA1\xA3\xAD\xEC\x83\x8B\x12\x0F\x78\x07\x6B\xBB\x80\x8C\xEE\x67\xE2\x27\x55\x52\xFD\x46\xC1\x2F\xC9\x5D\x0D\x62\x4B\xE0\xEF\x55\xA9\x75\x90\x41\xD6\xB8\x48\x63\x24\xFB\xFA\xE7\x59\xB8\xE8\xDF\x20\x22\x53\x94\x8C\x2B\x9E\xB3\x38\x52\xE0\x7B\xE2\xE5\x83\x1D\xE2\x6E\x39\x99\xAF\x63\xC4\x92\x24\x38\x74\x33\xCE\xAE\x0D\xBF\x75\xBC\xA6\x82\x50\x5D\x36\x7C\x97\x4E\x6D\x66\x19\xAB\x3E\xC0\x88\x05\x6C\x31\x37\x5A\x08\x3F\x5B\x08\x6D\x27\x43\x31\x5B\xB2\x84\xCE\xEC\xCB\xF2\x8E\x94\xA6\xEA\x58\x27\xAA\xCD\x8C\x45\xFC\x6D\x6B\x88\x8D\x63\x2C\x88\xA1\xA3\x8D\xEB\xB8\x67\xDF\xB6\xDF\x01\x3E\xBE\x97\xA9\x03\x36\x48\x8C\x66\x75\xC5\x83\x60\x77\x90\x0C\xA7\xE7\x21\x2A\xF3\x03\xF3\x8F\xEA\x22\xAA\x0F\x47\x8B\xC1\x85\x9B\x4E\x26\x28\x85\xF8\x05\x82\x95\x4C\xDC\x29\x2E\xF7\xC2\x1F\x3D\x0A\x60\x97\x2F\xB2\xE8\xAE\x8C\x82\xE6\xE0\x02\xC1\x11\xF9\x14\x2C\x21\xE9\x06\x0B\x2D\x2E\x51\x6D\x3D\xD4\x82\x9C\x85\x30\x23\x9A\x64\xDE\x28\x66\x09\x26\x8D\x7F\xFB\xFD\xA0\x3D\x0A\x85\x23\x70\x6C\xA2\x44\xE0\x90\x19\x6A\x8D\x61\xC5\xD8\x06\x6F\xD3\xAC\x80\xC8\xF4\xC5\x07\x3E\x65\xBC\xCA\x2E\x26\x7F\x82\x84\x8E\x71\xC0\x36\x8F\x44\x59\x9B\xAB\x1C\x88\xCC\x9F\x0E\xE9\x67\x4D\x3F\xC3\x09\xFD\x6E\xCB\x3E\xBF\xA7\x18\xA1\xC7\x73\x0B\xA2\xD2\x73\xD4\x99\x7C\xC3\xDD\xE5\x37\x5A\xD8\x28\xD9\xEE\x1D\xCA\x6F\x1B\x56\xAF\x9C\x63\xA9\x7B\xBE\xC7\xC8\x5F\x1D\xC3\xC2\x85\xFE\x72\x32\xEF\x24\x22\x12\xA6\x1C\x85\x60\x3C\x13\x59\x6E\x6B\x5A\x96\x65\xF6\x6C\x0A\x64\xF7\xED\x13\x66\xA1\x8B\x3F\x6C\xAD\xA7\x7D\xDD\x61\x91\x84\x4A\x98\xDC\x05\xF1\x47\x2D\x2D\x56\x06\x6E\x21\xED\xC7\xA1\x1C\xC2\x60\x5A\xD1\x8E\x16\xB3\xD1\xC6\xA5\x96\x1F\x71\xBC\xCA\xDF\xC5\xD5\x13\x11\x04\xB7\x85\xF1\x07\x61\x66\xB0\xAD\x16\x3B\xF7\x07\x10\x8A\xF7\x0D\x5B\xB0\xFA\xC2\x73\xC0\x11\xDE\xB1\x91\x1E\x39\x98\xB8\x85\x68\x11\x2B\x53\xC3\x73\xA4\xB0\x11\xC6\x91\x69\x98\x77\x6A\xEB\x41\x22\xD3\x09\x0B\x9E\x69\x1F\x2F\xED\x97\x90\xEA\x0F\x05\x37\xC9\x60\x64\x03\x6F\x62\xD7\xED\x49\xD7\xD9\x04\x84\x55\x02\x86\x62\x21\x61\xD2\xB4\x3B\xAF\x4C\x28\x69\xE3\xD8\xAC\xB6\x20\x4B\x16\x72\x32\xEB\x56\x54\xCE\x57\x4E\x67\x0D\x3E\x2A\xEE\xB6\xA7\x97\x8E\x4D\xFB\xDC\x0B\xDE\x09\xC2\x44\x15\x76\x09\x6F\x7C\x37\xAE\x3B\x22\x3A\xD7\xAE\xC5\xCA\x3C\xDE\x25\xBD\x6D\x4A\x8E\x5A\xF2\xF1\x6A\x52\xF2\xD7\xFE\xCB\x73\xBB\x37\xD5\x48\xFE\xA2\x67\x64\x7A\xB8\x82\x8E\xC4\x95\x40\x4A\x19\x15\x20\x52\x2A\x88\x4C\x03\x84\xF1\x42\xD5\x71\x38\xE7\x0E\xF0\x9C\x42\xEA\xEB\xCF\x23\x5D\x3A\x8C\x3D\xD2\xFC\xC1\xD7\x79\xF7\xE4\x76\xCD\xFA\x43\x39\x81\x84\xD5\x89\x8C\x69\x70\x7D\xCA\xFE\xA4\xE9\xAD\xD8\xAA\xA3\x24\x58\x66\x85\x6A\xE9\xAB\xEF\x29\x00\x15\x4A\x27\x8E\xF4\x90\x59\x0F\xDA\x46\xF8\x90\x0E\x96\x86\x61\x37\xB5\xA5\x7E\xE1\xD9\x32\xD5\x75\x1C\x85\xA7\xE4\x77\xBE\x2B\x1A\xB7\xDB\x7D\xF1\x3C\xB0\xF1\xFB\xF3\x25\xC4\x51\xAB\x7C\x6F\xE1\xDC\x9B\x8E\x32\x65\xC4\x4D\x83\x4F\x48\x83\x9A\xF0\xD0\xF6\xC1\x7F\xC4\xAB\x52\x69\x65\x4D\x0C\xF3\x00\xCF\x5C\x33\xF4\xA0\x17\xDE\x82\xB6\xDE\x3D\x57\xCA\xD8\x9F\x4A\xEB\xCF\x33\x89\x94\x08\xE0\x6F\x27\x3A\xC7\x24\xAE\xB1\x1F\x7A\x2B\x77\xA3\xEC\x03\x3E\x7E\x61\x4E\x9A\x11\x4C\xB8\x1C\xB2\x12\x40\x3D\x8F\x7C\x0B\x2F\x98\x61\xA0\xAB\xA6\x40\xDF\x20\x49\x41\xCC\x09\x74\x39\x89\xF6\x42\xE5\x02\x10\xE6\x9E\x45\x27\x0A\xD6\x93\xA1\xFE\x8B\xA7\x92\xB2\x88\xA0\xA7\xF4\x53\xC7\xCE\x0F\x6D\xB5\x55\x06\x55\x16\xD7\x93\x2E\xA0\x5C\x02\xAA\x12\xC9\x3C\xE4\x75\xEB\xF7\x1E\x0A\xD1\xDF\x8D\x4F\xF3\xA2\x07\x55\x21\xC0\x8D\xA6\x5B\xAC\x02\x11\xA9\xC5\xF1\xE3\x5C\xFB\xB9\x42\x6F\x01\xA5\x5B\x32\xB7\x99\x72\x6F\xE9\xF1\xDA\xE8\x93\x91\x26\x02\xE6\x4A\x26\x9B\x87\x4C\x9C\x1F\xE1\x35\xD4\xFE\x7E\x03\x77\x3C\xDF\xA8\xC2\xE2\x0D\x83\xF5\x83\xF3\xDA\x48\x3C\xD2\xCA\xD0\xFD\xCE\x77\x05\xCE\x43\xC9\x03\x74\x7A\xD1\xC3\xEB\xD3\x13\xCA\x68\xD5\xAE\xB4\x70\x64\x21\xF9\xB1\x7A\xE3\x8E\x76\x1F\x70\xC5\xA7\x70\x47\xE2\x99\x2A\x88\x46\x72\x0F\x8D\x28\x48\x9A\x38\x48\x4F\xCA\x4F\x68\x51\xFA\x54\x8D\x72\xFE\x81\xD6\x4E\xE8\x86\xFB\x07";
unsigned char dst2[] = "\x29\x3A\xD4\xFC\x39\xB0\x43\x9E\x0C\x37\x91\x78\xD7\x4A\x38\x87\xB3\x03\x71\x94\x66\x6B\x9E\x26\x0A\x09\x63\xEF\xD6\xB0\x3B\x43\x9D\xE3\x80\x83\x13\x66\x87\x77\x50\xC9\x3D\x40\xF6\x27\x4A\xE1\xFB\x8F\x7E\x97\xA0\x92\xC0\x8B\x8B\x9F\xF8\x9E\x0D\xB1\xDD\xCF\xCC\x5A\x69\x41\xE6\xDB\x7D\xDA\x6C\x73\x45\x7D\x5E\x69\x3E\x04\xCA\xDF\xDC\x30\xC8\xA8\x01\x17\x7F\x2E\xEE\x23\x50\x81\xFD\xB3\x36\x64\x42\xB0\xB0\x6D\xDF\x2F\x7B\x1C\x7D\x0F\x07\x4F\x46\x47\x9C\x20\x27\x46\x04\x88\x36\x09\x14\xAA\x4D\x5D\x31\xDF\xB6\xB2\x27\xE6\x7F\x8B\x4F\xF5\x7B\x13\xBC\xD0\x36\xD3\x74\x5F\xAF\xD1\xB0\x88\xEF\xE2\x65\x55\xFC\x68\x7D\xBA\xCB\x1E\x48\xBA\x20\x55\xB0\x96\x4F\x3E\xB7\x05\x5D\x89\xC1\xAB\x92\x3E\x41\x62\xF1\x21\xAD\x81\xA6\x99\x65\xA9\x2D\x11\xB1\x11\x9E\xB8\xA4\x67\x39\x45\xC7\x78\x77\x55\x24\xC7\xD2\xC1\x3F\x7A\x85\xB5\x6A\xE7\xB9\x45\x6E\x1D\xC2\x24\x02\xF8\x17\x99\xE9\x9E\x06\xB0\x6D\x29\x4C\x16\x17\xE5\x63\x24\xEC\x30\x69\xD3\x35\x83\x37\x26\x63\xE1\x3D\x5A\x28\x79\xCD\x35\x15\x7A\xB5\x98\x90\x3C\xE1\xA2\x5A\xE0\xB0\x80\x3D\x6E\x3A\xD8\x13\x9A\xFA\xAF\xCB\x89\x36\x99\x40\x12\xDB\x7F\x5F\x8D\xDA\xEA\xD8\xCB\xB7\x6F\x0D\xE5\xEA\x39\x98\xCF\x56\x7A\xB7\x90\xE6\xF2\x08\x9A\xE0\xD3\xD5\xAA\x5F\x35\xFA\x19\x92\xB6\x15\x9D\x77\xE5\x49\x31\x83\x71\x09\x8C\xD9\x76\x91\xD8\xBC\x1F\x41\x94\xF9\x1F\xE9\x2E\x6C\x11\xD5\x83\x5B\xC9\x53\xEC\xAC\x8F\x67\x7F\xEB\x95\x52\xCF\x9C\xC6\xF7\x77\xB0\x1F\x5D\x5D\x59\x64\x70\xBA\x6C\x54\xF0\xA9\x1B\xBC\x7D\x1F\x72\xD6\xDD\x13\xB7\x6A\x89\xF2\xE6\x95\x2F\xC9\x54\x35\xDF\x39\x5A\x7A\x95\x19\x3B\x92\x1B\x38\x87\x7D\xCC\xC8\xD5\x1B\x6E\x5D\x8B\x73\x9D\x8E\xBC\xBE\x98\xF6\xA1\x6C\x39\x21\x23\x46\x7B\xCB\x20\x4E\x8B\x48\xA2\xCD\xD5\xEC\x5A\xAE\x52\xF9\xC6\xB8\xA0\x97\x78\x02\x39\x76\x0A\xC3\xF1\x78\x3F\x7D\x2C\x38\x44\xA8\x0C\x15\x61\x79\x61\x38\x4B\x1F\x4D\x40\x7E\x3B\xA9\xF4\x1F\xCC\x3A\x49\xE0\x93\xA3\x90\xF4\xF7\xEB\xCA\x36\x3B\xB1\xDB\x53\x26\x35\x8B\x92\xEB\xC3\xFC\xB3\x76\x73\x76\x65\xF9\xDD\xC4\xF0\x55\xEE\xA3\xCE\x5C\xDA\xA1\xE7\x1F\xC2\xA4\x38\x2C\xE7\xE2\xDD\xA3\x96\x55\x79\xBF\xE4\x12\x2A\x4D\x07\xA2\x3F\x24\xDD\x97\xC9\x2D\x06\x1C\x2E\x2A\x64\xF6\xE9\x55\x02\xCD\xD3\x3B\xCC\x22\x65\xB1\x3E\x19\xCA\x1F\x34\xBA\xD6\x13\x21\x5B\x5B\xEA\x84\x38\xD0\xD9\x51\xF0\xAB\x6B\xDD\x38\xD7\x68\x7A\x4A\x25\x67\x40\xBE\xD7\x47\x4A\x20\x83\xAE\x4E\x99\x8E\x19\x00\xB5\x98\x29\x43\x0D\x9A\xA5\x74\x64\xCA\x19\xC1\x92\x44\x4B\x3F\x93\x2C\xE9\x13\x3D\x79\xD3\xB5\xDE\x8F\x5B\x95\x8A\xC0\x42\xB1\xD8\x54\x93\x64\x40\xA4\x5A\xC0\x58\xD5\xFB\xB9\xCA\x71\x64\x45\x39\xF8\x40\xCB\xA5\x64\xA9\xF5\xCC\x36\x12\x70\x56\x86\xA0\xD0\x4D\x7E\x8C\xF9\xE7\xE2\xAD\x2B\x90\x84\x6F\x60\x03\xCB\x33\x3C\x41\x92\x03\xB5\x7A\xD3\x44\x85\x18\x04\xE6\x65\x72\x19\x84\x55\x5C\x46\x47\xD1\x55\x79\x48\xC8\x9A\xFF\xB7\x6F\x0C\xDC\x82\xB1\xA2\xD2\x84\xB2\x4A\xE7\xCC\x6C\x54\x09\x26\x3A\x7C\x27\xAB\xB7\x45\x22\x5D\x81\x58\x44\xA5\xF2\xC5\x7B\xAA\x1F\xA0\xFE\xC3\x35\xD9\x7A\xC8\xF8\xDF\xAE\x61\x24\xE9\x6C\xC0\xE0\xF8\xA1\xEA\x08\x37\x37\x02\x43\xAC\x7E\x4A\x19\xF3\xE0\x25\xC7\x76\xDD\x00\xA3\xE7\x27\xB9\xDE\x7A\x3C\x25\xF6\x2D\x0F\xB0\x83\x17\xB7\xBE\x02\xDF\x39\x3F\x27\x12\x9A\x90\xEF\x40\xB0\xE1\xE9\x67\x75\xA0\x61\xDA\xCD\x43\x65\xDF\xDE\x5F\x4A\xB4\xFB\xF5\x15\x2B\x87\x4C\xFA\x27\x5D\xD4\xC0\x71\xD1\x2C\x38\xB0\x32\x2F\xD2\xBA\x51\x13\x0E\x2D\xAA\xF8\x6B\x81\x4F\xA4\xF2\x7A\xDA\x54\x9A\x19\x46\x42\x17\x19\xB1\x73\xF4\x80\xE3\x5C\xC3\xB7\x1A\xCE\xBD\xAD\xD6\xA3\xD3\x5C\x02\xF1\x9D\x40\xBB\x64\x89\xF3\x92\x18\x3C\x83\x95\x84\x42\xD0\xF4\xDD\xE4\xEE\xBB\xC7\xE2\x57\xD2\xE6\xEB\xDA\xFD\xC4\xA2\x3C\xE8\x33\xFC\xA4\x6A\xDF\xB5\xB3\xB0\xC7\x22\xD6\x5A\x78\xE8\xD9\x68\xD2\xDE\xD7\x77\xF6\xD0\x94\x40\x77\x64\x72\xD5\xB2\x0D\x1F\x18\x68\x63\xF4\xE8\xF2\xF1\x73\x76\xCD\x71\x9F\xA6\x84\x2F\x93\x60\x25\x7F\x52\xD4\x60\x64\x1C\x02\xB3\x38\x49\x54\x2F\xD5\x63\xFC\x45\x45\x36\x65\xC4\x1C\x36\xB0\x90\x56\x35\xC8\xDC\x13\x05\x08\xD4\x89\x51\x98\x49\xD5\x50\x83\xC5\x15\xCF\xF9\x4D\x65\xCE\x58\x64\x04\x8D\x78\xE8\x85\x53\x2B\x7C\xD5\xB0\x1A\xDD\xCB\xCD\x90\x46\xFD\xE1\xDE\xBD\xBA\x27\xB7\xA2\x24\x80\x3A\x30\xC7\xD2\x39\xD6\x1F\x2D\x06\x7A\x44\xC1\x83\x34\xA2\x17\xD6\x84\xD3\x77\xFC\x4C\x83\x80\x4E\x93\xD9\xDB\x3C\x4C\xDE\xDF\x9A\x9F\x88\xC6\x13\x82\x57\xF9\x89\x78\xAF\x7F\x2D\x88\x3B\x46\x34\x11\x09\x7D\xDB\xEF\x3E\x67\x58\x48\x45\xB6\xEF\xAE\x75\x97\x1F\xCA\x7C\x7D\x96\x00\x1D\x6F\xFA\x99\xAB\x88\xEF\x8D\x22\x8C\x58\xA9\x34\x36\x00\xD5\xD2\x26\xB6\xD6\x06\x29\x22\x82\xF6\xE3\xBA\x74\x80\x02\x85\xCE\x75\xFC\x25\xAD\x84\x64\x21\x02\x9A\x9A\x5B\x19\x7A\xB9\xF0\xFB\x15\xC1\xAF\x59\xF9\xC3\xD2\x71\x1B\xDE\xC6\x5E\x3F\xFD\x76\x1A\xD2\x54\x2C\x2A\xCC\x09\x74\x14\xFE\xB6\x09\x55\x04\xD5\xFD\x6A\xC2\x43\x85\xCF\x16\x23\x05\xB2\x97\x06\xA1\xA1\x2E\xF4\xF0\xEC\x11\x05\x4E\x81\x0F\x5F\x60\x68\xF5\xD6\x06\xB7\xFE\x9C\x14\x59\x6B\xBD\xDF\x9A\x29\x98\x5B\x51\x00\xAD\x80\x0A\x47\x26\x9D\x5B\xD2\x12\xF2\x97\x7A\x06\xA3\x27\x16\xCF\xB1\x93\x4A\x14\x3B\x6F\xC7\xF5\x86\xF5\xD1\xF1\x6D\x60\x43\xC3\x38\x2D\x44\x7D\x06\x3E\x92\x92\x69\xCC\xC6\x90\x2B\x52\x01\x14\xD4\x65\x52\x07\x08\x0C\x05\x6A\xA5\x0C\x28\x38\xAB\xC0\xCD\xCA\x88\xF1\xA2\x13\xC7\x93\xD2\xE4\xEE\x40\x94\xC7\x5E\x33\xEC\xBE\x6F\xE3\x98\xE4\xD5\xD8\xCD\x0D\x68\xB4\xC9\xE4\x96\x15\x94\xB0\x5A\x50\xF8\x07\xEA\x56\xDE\xEE\x54\x9B\x27\xC7\x60\xDC\x77\x1E\x4C\x8B\x8E\x31\x12\x0F\x42\xCA\x9A\xBC\x31\x2E\x97\x49\x31\x27\x47\xCC\xD2\x0E\xB3\x70\xA3\x90\xC0\x2C\x45\x78\x56\xD2\xAA\xA8\x1A\x1C\x44\xEF\x2F\x37\x87\x39\xB4\x2D\x84\xEB\xD2\x95\xDE\xFC\xDA\x4B\xDF\x91\x4E\xE9\xCD\x3C\xCF\x74\x2B\x61\x3C\x61\x2D\xF6\xAC\x6F\xA0\xC8\x3F\xAA\x29\x62\xF3\x22\x50\x36\xD8\xE2\x4B\xD9\xA3\x43\x30\x66\x18\xDD\xF1\x98\x87\x41\x9A\x87\xB7\x26\xC9\xCF\x9E\x1E\x9F\x12\xE4\xF4\xF1\x11\x55\xB8\xFB\x22\xF3\xE7\xEA\x98\xE9\x43\x66\x56\xE0\xA6\x56\xFE\x51\x66\xBA\xA2\x2B\x91\x8A\x85\x44\x76\xC6\x35\x37\x1D\xB4\xB7\x07\x91\x2F\xA4\x8A\x7E\x15\x00\x58\x31\x37\xE4\xE3\xB0\xB7\x00\xCA\x50\x59\x57\xB9\xDE\x51\x2B\x14\x9C\xC4\x95\x08\xCD\xC2\xB4\xC0\xDD\xCC\x3F\xF1\xD9\x88\xB4\x67\xF5\x31\x35\xCE\x79\x63\x28\x17\x41\x90\x95\x0A\x96\xE0\xDB\xC6\x6E\x52\x01\xAE\x8A\xE8\x73\x1D\x7C\x8F\x2B\x08\x53\xAA\x67\x09\xE3\xEB\xD3\x86\xC6\x32\x57\xE2\xE5\xE4\x13\x87\x86\x8B\xBC\x34\xBC\xA5\x02\xDA\x75\xE6\x8F\xB8\x3B\x7C\xC4\xE9\xA7\xE2\x70\x69\xE7\xA5\x27\x66\x9B\x08\x21\xF5\xC1\x72\xE3\x8A\x66\xF5\x8D\x79\x9E\x46\x1C\x20\x61\x10\xA4\x13\x0E\xCF\x5F\x87\xA1\xE5\xE5\x9F\x66\x2F\x3F\x0E\xC5\xED\xBB\x45\x6F\x0C\x30\x94\xFE\xE6\x38\xC2\x73\xCF\xB1\x5D\x32\x9B\xC1\x37\x9D\xFE\x27\xF4\x58\xDC\x7B\xF0\x88\xF7\x90\x57\xF6\x26\x98\x10\x62\x65\xF4\xA8\x3C\x18\x93\xB7\x33\x34\xF4\x0F\xD7\x5A\x3A\xD4\xEA\xF4\xDF\xBD\x72\xEA\x19\xE4\xCC\x14\x5F\x0B\x50\x86\xB8\x34\x67\xC7\xF3\xBB\xF1\xCC\x82\x5F\x93\x9E\xEB\x7E\x96\x0D\x9B\x99\x25\xB0\x99\xE2\x57\xA7\xCC\x2D\xAF\x75\xD6\x68\xAE\x01\x96\x06\x46\xB6\x22\xBA\xFB\xB3\x88\x5B\x79\x1E\x02\x4B\x45\xEB\xD7\x8E\x37\xCD\xCC\x84\x8F\xB3\x67\x14\xAA\x24\x8D\x96\xE2\x7E\x26\xC8\x63\x37\x1D\x82\x22\x72\xC6\x85\xCB\xD3\x0C\x47\x5B\xE4\xE4\x0F\x40\x92\x79\x59\x05\x4F\x55\x39\x95\x5A\xAB\x31\xA5\xBE\x49\x43\x35\x2C\x8D\x4E\x41\xEA\x53\x75\x37\x91\x5D\x4A\x54\xD4\xB8\x8A\xF8\xC1\x38\x3E\x3A\x72\x41\x39\x5B\xF9\x83\xD6\x73\xA1\x1B\xA8\xDE\x3B\x31\x3A\xB4\xD4\xC8\xEE\x7D\x17\xEF\x2C\xC8\xBC\x0B\x9D\xB2\x25\x98\x5D\xD6\x86\x9E\xA3\x5E\x3F\xD2\x6E\x0D\xC4\x2E\xEF\x37\x0D\xE6\x59\x8D\x30\xAD\x67\x81\xA2\xD0\x1B\x2F\x2A\xF4\x15\xDA\xBF\xD4\xCA\xE4\x7C\x11\x29\x0D\x2A\xA3\x47\x94\x77\x6C\x78\x04\x84\xB1\x5C\xF8\x93\xC0\x0E\xE2\xEF\x2E\x30\xAE\x8C\x7F\xAA\x9F\x3E\x27\xB7\x4E\xD2\x20\x10\x6E\x6C\x25\x1C\x4F\x3F\xD0\xAB\x2F\x36\x16\x1B\x6B\xCB\x34\x6D\xE7\x79\x65\xC0\xBD\xC9\xD5\xC8\x3E\x0A\x11\xE7\xA4\x46\xB6\x09\x04\x40\x2A\x7F\x29\xC5\x81\x78\x6E\xB6\xD0\xAD\xD3\xE3\x3C\x8D\xAD\xC9\x9E\x92\x0F\x75\x6E\x64\x6E\xB7\x93\x1D\x42\x6C\x4B\xEA\x59\xFE\xD0\x42\xEE\x88\x69\x3B\x31\x36\xE5\xA1\xAA\x63\x15\x2C\xA0\x46\x35\x85\xEB\xC0\x87\xA9\x11\x66\x25\x39\x71\x95\x19\x2E\x7B\xA0\x38\x24\xA0\x25\x6B\x5E\xCC\x16\x97\x59\x9D\x5D\x7E\x45\x24\xAA\x57\xC7\xD3\x86\x02\xE7\xE8\xCC\x7B\x6D\x03\xB0\x65\x51\xE5\xA9\x86\x6A\x57\xE7\x6E\x8E\x1B\x3C\x56\xDE\x20\x1B\xFE\xF1\xD6\x3A\x00\x09\x4A\x66\xF0\xCC\xC3\x4A\x5B\x80\x10\x58\xF6\xB8\x66\x8F\x6B\x63\x19\x8B\xC3\xF5\x3C\xF4\x4B\xD5\x38\xB6\xE0\x3F\x7D\xE7\xE9\x7B\x4E\xAE\x69\xCA\x29\x4B\x5C\xBA\x29\x41\x22\xC2\xAA\xF7\xD5\xB9\x97\x4D\xAB\x93\xD0\x8E\x28\x49\x2B\xA7\x02\x13\x2D\x9B\x93\x7F\xDD\x6D\x79\x73\x5D\x09\x96\x80\x2A\xC8\xDD\x90\xFE\xA0\xC6\x97\x2A\x37\x0A\x76\x0B\x7E\x70\xF6\x58\x3F\x37\xAE\x28\x4B\x27\x2D\x10\xCF\x14\x00\xC7\xB4\x61\x16\xC6\x72\xA1\xC5\x69\x69\xDA\xB7\xE6\x42\x14\x79\xAC\x80\xA8\x89\xAC\x87\x97\xA9\xBA\x13\xB2\x54\x22\xEF\x11\x1C\x83\x4D\x87\xCF\x1F\x8F\xEC\xA6\x7D\xCF\x42\x58\x11\xA2\x65\x0F\x74\x4D\xCD\xB6\x73\xFA\x6B\xFE\x08\x52\x79\xF7\x29\x5D\x34\x01\x25\xCD\x46\x86\xA3\x18\x9F\xDC\xDD\xC7\xF7\xFF\xFF\xE5\x63\xA2\xE5\xF3\xF9\x62\x17\x1B\xBE\xA7\xA4\x33\xD7\x87\x4B\x4E\x72\x61\x47\x66\x78\x2E\x0F\xB4\xC0\xC3\x27\xC0\xBD\xC9\x5C\xD6\x35\xAE\xA4\x22\x16\xF2\x86\x25\xC6\xE0\x3F\x05\x04\x3D\x90\xB5\x74\xFE\x66\x62\xFB\xDA\xB7\x36\x00\x64\x34\xFA\xB0\x17\x38\x96\xE2\x55\x3C\xB5\x74\xF0\xF2\x00\x3A\xDA\x2E\x39\x75\xC9\x55\x36\x86\xC6\xF7\xAF\xB9\xE7\xC4\xA2\xF4\x55\xBE\xBD\x21\x84\x79\xD5\x3C\x95\x32\x56\xAE\x02\x59\xEE\xCA\x23\xDF\x02\x28\x6B\xCC\xD2\x5F\xFA\x8A\x18\x54\x2F\x63\xBD\xC1\x56\x07\x33\xE5\x36\xF0\x74\xC5\xA1\x87\x56\xF3\x52\x8C\x3B\x24\x5E\xAE\x42\x71\x50\xF7\x7C\x02\xDC\xDA\x5C\x7A\xAA\x0E\x5C\x55\x61\xDE\xB5\x2C\x7A\x3F\x2E\x8D\x83\x15\x19\xF4\x91\x04\x51\xC8\x7C\x35\xC6\xBB\x3F\x9E\x22\x1E\x9E\x84\x71\x75\x39\xC3\x22\x28\x48\x72\xEF\x19\x3E\x69\xA0\xED\x59\x98\x91\x4E\xE4\x4D\x38\x06\x3B\xA4\x92\x31\x12\x2B\x0A\xB8\x1F\x58\x17\x7C\x9B\x27\x09\x1E\x05\xC7\x18\x2D\xEC\xBF\x61\x4A\x28\x1E\x75\xE9\xAE\xBE\xC7\xD3\x11\xA4\x1B\x38\x87\x7D\xCC\xC8\xD5\x1B\x6E\x5D\x8B\x73\x9D\x8E\xBC\xBE\x98\xF6\xA1\x6C\x39\x21\x23\x46\x7B\xCB\x20\x4E\x8B\x48\xA2\xCD\xD5\xEC\x5A\xAE\x52\xF9\xC6\xB8\xA0\x97\x78\x02\x39\x76\x0A\xC3\xF1\x78\x3F\x7D\x2C\x38\x44\xA8\x0C\x15\x61\x79\x61\x38\x4B\x1F\x4D\x40\x7E\x3B\xA9\xF4\x1F\xCC\x3A\x49\xE0\x93\xA3\x90\xF4\xF7\xEB\xCA\x36\x3B\xB1\xDB\x53\x26\x35\x8B\x92\xEB\xC3\xFC\xB3\x76\x73\x76\x65\xF9\xDD\xC4\xF0\x55\xEE\xA3\xCE\x5C\xDA\xA1\xE7\x1F\xC2\xA4\x38\x2C\xE7\xE2\xDD\xA3\x96\x55\x79\xBF\xE4\x12\x2A\x4D\x55\xD1\xEE\x13\xF2\x1B\x17\x99\x0B\x4B\x6F\xC0\x2E\x92\x24\xBC\xAA\x38\x6E\x5A\x72\x44\x12\x54\x08\x04\xFD\xD3\xAC\x3F\x58\x48\xC4\x40\xB8\x9C\x51\xA7\x5A\xBB\x48\xAA\xA2\x4E\xC6\xEB\xB3\x50\x44\xA3\xD7\x10\x7A\x82\x9F\x57\xA2\x35\x68\x0E\x32\x14\xC7\x9B\x7D\x5D\x23\x15\x4D\x65\xD8\xFD\xDE\x41\x9B\xDE\x08\x86\xC1\x8D\xD0\x91\x8E\x16\xE3\xA0\x95\xBF\x6E\x82\x0A\x65\x28\x64\x0C\x74\xA6\xCC\x50\x84\xD9\x31\x08\x11\x53\x2C\xFB\xDC\x32\x8D\x46\x61\x25\x93\xAD\x46\xAD\x14\x24\x61\x9F\x5D\x77\xAC\x25\x1F\xDA\xAD\x22\x5A\xB3\xFA\xD7\xDB\x39\xA2\x8B\x3E\x51\x7B\x9F\xCC\x68\xC0\xC9\x8C\x92\xE9\xE1\xA9\xFC\x28\x59\xE4\x36\xC4\xD1\xCE\xCD\x5B\xF7\xAA\xC3\xAC\x05\xEB\x8B\xD4\x1E\x13\x52\xB7\x51\xFA\xD2\x26\xF8\xFB\x7D\xF5\x22\x8F\x21\x23\x9A\xB3\x2B\x5B\x7F\xD8\xBD\xD6\x22\xF4\xF6\x44\xEC\xC0\xB6\x9B\x0E\x48\xD9\x4C\x29\x71\x4A\xE0\xDD\x77\xCA\x93\x5E\x6A\x0B\xB8\xE9\xAA\xBA\xC1\x6D\xA1\x01\x8E\x87\x7E\xAB\x08\xD5\xC2\x72\xFB\x4C\xAF\x40\x45\x09\xA7\x91\xEA\x83\xE2\xCB\xDC\xF3\xCA\xC3\x65\x34\x61\x78\x3B\x81\x0B\x8D\xCD\xF2\x7A\x79\xB2\x04\x74\xAD\x35\x1F\xD0\xAA\x81\x6F\x3D\xE0\x5C\x1E\xBC\xD5\x84\x22\x0E\x27\x25\x05\x01\xD9\xF5\x74\xC2\xE6\xC6\xA1\x13\x72\xFF\x14\x51\xDE\xBE\x1D\xBA\xD2\x28\x94\xD4\xB1\x59\xB3\x3C\x38\x13\xD6\x9E\xFA\x60\x9C\x10\x8F\x33\x39\x91\x04\x6D\x92\x91\x14\x56\xBA\x60\xAF\xD7\xA2\x5A\x75\x94\x83\x2C\x51\x4A\xB5\x0A\xD9\x81\x34\x2A\x45\xCC\x79\xC8\x20\x7C\x7E\x4F\x3B\xEA\xE4\x5E\x38\x53\x4D\x26\x91\x32\xE6\xE2\xDA\x56\x07\x31\x3C\x48\x9E\xD4\xA0\xFF\xBB\xFB\x32\x03\x71\xC4\xD1\xDF\xC8\x89\xDF\x19\xC9\x9E\x92\x0F\x75\x6E\x64\x6E\xB7\x93\x1D\x42\x6C\x4B\xEA\x59\xFE\xD0\x42\xEE\x88\x69\x3B\x31\x36\xE5\xA1\xAA\x63\x15\x2C\xA0\x46\x35\x85\xEB\xC0\x87\xA9\x11\x66\x25\x39\x71\x95\x19\x2E\x7B\xA0\x38\x24\xA0\x25\x6B\x5E\xCC\x16\x97\x59\x9D\x5D\x7E\x45\x24\xAA\x57\xC7\xD3\x86\x02\xE7\xE8\xCC\x7B\x6D\x03\xB0\x65\x51\xE5\xA9\x86\x6A\x57\xE7\x6E\x8E\x1B\x3C\x56\xDE\x20\x1B\xFE\xF1\xD6\x3A\x00\x09\x4A\x66\xF0\xCC\xC3\x4A\x5B\x80\x10\x58\xF6\xB8\x66\x8F\x6B\x63\x19\x8B\xC3\xF5\x3C\xF4\x4B\xD5\x38\xB6\xE0\x3F\x7D\x7F\x66\xEF\x2E\xCE\xBE\x4F\xD5\xAD\x82\x18\x2F\x43\x91\x7C\xEF\x65\x79\xBD\xDF\xA3\x18\x4A\x96\x0C\x69\xF2\x19\x82\x12\x13\x40\x2A\x9C\x53\xCA\x68\xEE\x8D\x42\x28\x6A\xF9\xB8\x7B\x31\xCB\x6F\xE2\xA2\x04\x4C\x59\x5D\x32\xF2\xC0\xD8\x85\xEF\x1C\x9F\x76\xCA\xA0\x79\xAE\x1F\x67\x95\x4D\x62\xFC\x60\xBB\x37\xDB\x37\xE8\x29\xF5\x0B\xE5\x45\x5D\x38\xAC\xCD\x3A\xB8\xA2\xA1\xE4\xB7\x0E\x45\x16\x6F\xD1\x97\x4E\xAA\xC7\xBF\xCC\x49\x4E\x84\x77\x52\xA6\xD9\xEB\x1C\x14\x8A\x08\xB9\x6E\xEA\x0E\x69\xB5\x50\xD9\xAA\x32\xD5\x4D\x70\x92\x14\xE9\x2F\x55\x4A\xAC\x56\x9D\xD8\x02\xB5\xE5\x83\x11\x98\xA8\x5F\x80\x21\x53\x2D\xDD\x11\x11\x5C\xE3\xCA\xA5\x07\x19\x11\x11\x3A\xC7\xD2\xA3\xE3\x4D\xBB\xF3\x6D\xB4\xF2\x1C\xDE\xA5\x18\x8D\x17\x99\x91\xD8\xE3\xEC\x8E\x71\x9F\x9D\x10\xFD\xCF\xC5\x8E\xBC\x19\x52\x89\xE5\x3A\xF5\x0F\x45\xB4\x78\x4B\xC1\xFA\x16\xF3\xC2\xDF\x14\x2C\xD1\x5C\xA0\xFE\xCF\x78\x49\x60\xFB\xB3\x71\x1E\x75\xE9\x30\xC9\x97\xCC\x32\x1C\x11\x2D\x4C\x19\x26\x54\xA4\x65\xB7\x86\xE2\xC0\xE7\x46\xC1\x8B\xED\x27\x38\x32\x20\x84\x47\x4E\x2B\x1D\xA6\xB6\xEE\x09\x3D\xEF\xB4\xB7\x4E\x42\x37\xCD\x26\xE5\xB8\x8B\xE9\xEE\x4C\xAF\x28\xEF\xEF\xCA\xA3\x0A\x23\xF7\x45\x82\x2B\x50\x4D\x2D\xB3\x94\xBB\xD6\x82\xE9\xE8\xF3\x4E\x8B\x8A\x3E\x37\xB7\x14\x54\xB8\xA2\x47\x0D\x26\x17\xA4\x73\xCF\xD9\x40\x00\x6D\x43\x48\x24\xBF\x4D\xAF\x9D\x47\x97\x9F\x92\x48\x0D\x8F\x51\xAC\x42\x03\xB1\xDB\x9D\x68\x67\x3E\x45\xD8\x1E\x17\x89\xCF\xE8\x5E\xA4\x0D\x82\xB2\xED\x50\x06\x0C\xA0\xE4\xE7\x91\x1C\xE3\xD0\xCE\xAA\x47\x18\xD4\xA8\x68\x5D\x98\x46\xAC\x0F\xA8\x93\x3B\x1F\x06\xE4\x3F\xA9\xA4\xB0\x9C\xD4\x94\x02\x81\xD5\xC0\x40\xB4\xEF\xFA\x16\x64\xCD\x46\xF9\x6C\x25\x82\x9B\x83\x94\x73\x18\x32\x66\xA1\x0F\x7F\x99\x4E\x2F\x2E\x5A\x74\x68\xD8\x4D\x65\xDF\xA8\x8D\x6F\x67\xB7\x64\x9D\xB0\x2E\xFD\xA8\x90\xD6\x56\xC1\xD3\xD1\x35\x7E\x46\x38\x8F\x9C\xFD\xCF\xD6\x25\x7F\x01\xB0\xE9\x3C\x2A\xB9\x6A\x81\x08\xC5\xDE\x2E\xD1\x1E\x40\x93\xB9\x72\xE1\xC5\x7F\x4F\x47\x65\xA2\x87\x8E\xF3\x5F\x63\xA5\x60\x6F\x2C\xC1\x69\xA0\xB8\xAF\x4B\x32\x93\x81\x6F\x22\x24\x00\x3A\x60\xA6\x90\xDA\x71\x37\x3F\xC2\x14\xEF\x2A\x75\xF4\xD9\xB6\x5F\xCC\xDB\xBD\x44\x5E\x22\x56\x21\xE9\x32\x23\x0D\x62\x80\xDF\xA2\xAA\xEB\x77\xF6\x5D\xD6\x0E\x0A\xE0\xFD\xA9\xC1\x34\x8D\x49\xD1\x47\x1A\xC8\xEE\xCA\x11\xF5\xB5\x4C\xDF\x2B\x58\x7D\xAB\xCB\x17\x22\x05\x75\x28\xE8\xB6\x1F\x3F\x09\x1B\xD2\x20\x03\xB4\x0F\x51\x6F\x59\xBC\xF8\x47\xC1\x5D\xC8\x05\x86\xB8\x25\x1A\xEA\xA2\x09\x62\x0B\xB1\xDF\x8C\x2B\x81\xBD\x65\x7E\x14\x13\x16\xE2\xF6\x65\xA4\xC2\x93\x2C\xF8\x20\xE9\x48\x09\x74\xAC\x0A\x37\x09\xF0\xB0\xA1\x8A\x3E\x1E\x54\x02\x36\x4B\x70\x0C\xDC\x71\xAC\x7A\x7A\x76\xE7\xD8\x81\x7B\x55\x3E\xBC\xCA\x7F\xD0\xEC\x06\xD4\x4B\x99\xFB\xC3\x87\x83\x8D\x24\xF6\x3A\x65\x76\x58\x57\x0F\x88\xB2\x7F\xB4\xFD\xD0\x06\x93\xDA\x98\x67\x3C\x7B\xE7\x49\x02\x1D\x10\x5F\xFE\xE8\xD3\xCF\xAC\xF4\xB6\x57\xC5\x10\x3D\x1D\x7D\xF1\x5F\x83\x9C\x5C\x7D\x26\x81\x56\x36\xF2\xB6\x87\xB8\x48\x92\xA3\x8C\xA1\x66\x8A\x22\xBD\x14\x83\xB5\x9C\x99\xEE\xD3\xE7\xCA\xDE\x8F\x89\xAA\xE2\xFB\x51\x24\x81\x42\x2D\x1D\xC0\xC2\x9B\xFA\xD1\x89\x73\xDD\x0C\x18\xBC\xA9\xAC\x2C\x1F\x7E\x57\x86\x98\x99\xC9\x2C\x10\x82\x49\x4B\x61\x9C\x33\x17\xA2\x72\xDC\x5E\x72\x7B\x0B\xB7\x2D\x78\x19\x96\xCD\xB1\xA8\xE5\xA2\x0D\x09\xA4\x82\x3D\xAD\xC3\x58\x38\x0A\x49\x5F\x42\x4E\xF8\xFF\x6D\x23\x09\x52\xA3\x41\x51\x65\xDC\x1C\x10\x96\x31\xAF\x46\xB3\x90\x5C\x62\xC0\xB4\xF9\x05\x18\x31\x86\xC4\xA3\xAA\xF1\xE7\x16\xDC\xAA\xA9\x4C\xE5\x6D\x2C\xFF\xCE\xBB\x9A\xE8\x55\x51\x9B\xF7\x11\x52\x4B\x57\x51\x75\x2A\xF9\xDE\x67\xFC\x37\x8C\xF1\xBC\xD0\x33\xDC\x39\x2D\x0C\x03\x90\xB8\xEE\x68\x5E\x2C\x29\xB8\x8A\xBE\xC3\x80\x34\xCF\xE1\x7A\xB7\x73\x13\xE4\x0D\xCF\xAD\x6D\xA2\x7C\x16\xA5\x5D\xAB\xBE\x8E\xCD\xB0\x80\x04\x64\xB1\x73\x81\x46\x80\x00\xC4\xA9\x88\x5C\x9F\x77\x8F\x8E\x18\x26\x1F\xC5\x4F\xA0\x7C\xAD\x7E\xD5\x1F\x1B\xC5\xEF\x97\x4A\xAE\xDD\x55\xD8\xCF\x86\xE4\xAE\x78\x37\xE2\xFE\xA4\x89\x43\x38\x1C\xF0\x43\x62\x2B\xAC\x3E\xA0\x98\xE6\x85\xC3\xAF\xF8\xD4\x95\xA5\xFC\x9A\x8E\xEA\x98\xC8\x23\xCE\x13\x47\x78\xD1\x84\x96\xC8\xA0\xBC\x4C\x89\xF8\x08\x96\x14\xCA\x79\x0E\x04\x6F\x77\x8F\x5D\x21\x50\x15\x58";

void re_tea_buf2(unsigned int *data) {
    unsigned int sum = 0;
    unsigned int v0 = data[0];
    unsigned int v1 = data[1];
    unsigned int k0 = 0x11222233;
    unsigned int k1 = 0xAABBCCDD;
    unsigned int k2 = 0x1A2B3C4D;
    unsigned int k3 = 0xCC1122AA;

    unsigned int sums[16];
    unsigned int sums_idx = 0;
    do {
        sum -= 0x61c88647;
        sums[sums_idx++] = sum;
    } while (sum != -0x1c886470);
    for (int i = 15; i >= 0; i--) {
        sum = sums[i];
        //v1 -= ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
        //v0 -= ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
        v1 -= ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
        v0 -= ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
    }
    data[0] = v0;
    data[1] = v1;

}
void re_tea_buf1(unsigned int* data) {
    unsigned int v0 = data[0];
    unsigned int v1 = data[1];
    unsigned int k0 = 0x11222233;
    unsigned int k1 = 0xAABBCCDD;
    unsigned int k2 = 0x1A2B3C4D;
    unsigned int k3 = 0xCC1122AA;

    unsigned int sumlist[8] = { 0 };
    int idx = 0;
    unsigned int sum = 0;
    do {
        sumlist[idx] = sum;
        sum = sum + -0x61c88647;
        idx++;
    } while (sum != -0xe443238);
    for (int i = 7; i >= 0; i--) {
        sum = sumlist[i];
        v0 += (v1 + sum ^ v1 * 0x10 + k0 ^ (v1 >> 5) + k1);
        v1 += (v0 * 0x10 + k2 ^ (v0 >> 5) + k3 ^ v0 + sum);
    }
    data[0] = v0;
    data[1] = v1;

}

void re_buf2() {
    for (int i = 0; i < 0x200; i++) {
        re_tea_buf2((unsigned int*)(dst2 + i * 8));
    }
}
void re_buf1() {
    for (int i = 0; i < 0x200; i++) {
        re_tea_buf1((unsigned int*)(dst1 + i * 8));
    }
}

void swap_dst() {
    unsigned char tmp[0x1000];
    memcpy(tmp, dst1, 0x1000);
    memcpy(dst1, dst2, 0x1000);
    memcpy(dst2, tmp, 0x1000);
}
void swap_data(int i){
    unsigned char tmp[0x100];
    int rev_i = 15 - i;
    memcpy(tmp, dst1 + rev_i * 0x100, 0x100);
    memcpy(dst1 + rev_i * 0x100, dst2 + i * 0x100, 0x100);
    memcpy(dst2 + i * 0x100, tmp, 0x100);
}
struct blockb {
    unsigned char data[0x80];
};
int main()
{
    
   // return 0;
    

    for (int i = 15; i >= 0; i--) {
        swap_dst();
        swap_data(i);
        re_buf1();
        re_buf2();
    }
    //printf("%x\n", dst1[0]);
    unsigned char flag[0x41] = { 0 };
    unsigned int idx = 0;
    for (int i = 0; i < 0x20; i++) {
        blockb box[256] = { 0 };
        for (ULONG64 i_1 = 0; i_1 < 256; i_1++) {
            ULONG64 pchar = i_1 + i;
            for (int j = 0; j < 0x80; j++) {
                pchar = (ULONG64)pchar * (ULONG64)0x41c64e6d + (ULONG64)0x3039;
                ULONG64 b = (pchar << 0x21) >> 0x31;
                box[i_1].data[j] = (unsigned char)b;
            }

        }
        for (int i_2 = 0; i_2 < 256; i_2++) {
            //if (dst2[0] == box[i].data[0]) {
                //printf("%x\n", i);
            //}

            if (!memcmp(dst2 + i * 0x80, box[i_2].data, 0x80)) {
                printf("%x\n", i_2);
                flag[idx++] = i_2;
            }
        }
    }
    for (int i = 0; i < 0x20; i++) {
        blockb box[256] = { 0 };
        for (ULONG64 i_1 = 0; i_1 < 256; i_1++) {
            ULONG64 pchar = i_1 + i;
            for (int j = 0; j < 0x80; j++) {
                pchar = (ULONG64)pchar * (ULONG64)0x41c64e6d + (ULONG64)0x3039;
                ULONG64 b = (pchar << 0x21) >> 0x31;
                box[i_1].data[j] = (unsigned char)b;
            }

        }
        for (int i_2 = 0; i_2 < 256; i_2++) {
            //if (dst2[0] == box[i].data[0]) {
                //printf("%x\n", i);
            //}

            if (!memcmp(dst1 + i * 0x80, box[i_2].data, 0x80)) {
                printf("%x\n", i_2);
                flag[idx++] = i_2;
            }
        }
    }
    
    flag[0x40] = 0;
    printf("%s\n", flag);

    std::cout << "Hello World!\n";

BabyDriver

CheckIn_ret2text