-
unicorn CPU 模拟器
-
查看main
-
int __fastcall sub_CBA(const char *a1, __int64 a2, const char *a3) { size_t v3; // rax int v5; // [rsp+20h] [rbp-30h] BYREF int v6; // [rsp+24h] [rbp-2Ch] BYREF int v7; // [rsp+28h] [rbp-28h] BYREF int v8; // [rsp+2Ch] [rbp-24h] BYREF __int64 v9; // [rsp+30h] [rbp-20h] BYREF FILE *stream; // [rsp+38h] [rbp-18h] void *ptr; // [rsp+40h] [rbp-10h] unsigned __int64 v12; // [rsp+48h] [rbp-8h] v12 = __readfsqword(0x28u); stream = fopen(a3, "rb"); ptr = malloc(0x7100uLL); fread(ptr, 1uLL, 0x7100uLL, stream); v5 = 270532544; v6 = 270532544; v7 = 270531328; v8 = 270531072; uc_open(3LL, 1073741828LL, &v9); uc_mem_map(v9, 0x400000LL, 0x200000LL, 7LL); uc_mem_map(v9, 0x10000000LL, 0x200000LL, 7LL); v3 = strlen(a1); uc_mem_write(v9, 270531328LL, a1, v3); uc_mem_write(v9, 0x400000LL, ptr, 28928LL); uc_reg_write(v9, 31LL, (__int64)&v5); uc_reg_write(v9, 32LL, (__int64)&v6); uc_reg_write(v9, 7LL, (__int64)&v8); uc_reg_write(v9, 6LL, (__int64)&v7); uc_emu_start(v9, 0x400000LL, 4223084LL, 0LL, 0LL); uc_mem_read(v9, 270531072LL, a2, 200LL); uc_close(v9); return fclose(stream); } -
babyunic会通过un.so.1去模拟执行func
-
un.so.1反汇编后发现是对上述main函数中的一些函数进行解释，其实就是模拟CPU
-
查看unicorn.h文件
-
找到参数对应常量意义
-
typedef enum uc_arch { UC_ARCH_ARM = 1, // ARM architecture (including Thumb, Thumb-2) UC_ARCH_ARM64, // ARM-64, also called AArch64 UC_ARCH_MIPS, // Mips architecture UC_ARCH_X86, // X86 architecture (including x86 & x86-64) UC_ARCH_PPC, // PowerPC architecture UC_ARCH_SPARC, // Sparc architecture UC_ARCH_M68K, // M68K architecture UC_ARCH_RISCV, // RISCV architecture UC_ARCH_S390X, // S390X architecture UC_ARCH_TRICORE, // TriCore architecture UC_ARCH_MAX, } uc_arch; // Mode type typedef enum uc_mode { UC_MODE_LITTLE_ENDIAN = 0, // little-endian mode (default mode) UC_MODE_BIG_ENDIAN = 1 << 30, // big-endian mode // arm / arm64 UC_MODE_ARM = 0, // ARM mode UC_MODE_THUMB = 1 << 4, // THUMB mode (including Thumb-2) // Depreciated, use UC_ARM_CPU_* with uc_ctl instead. UC_MODE_MCLASS = 1 << 5, // ARM's Cortex-M series. UC_MODE_V8 = 1 << 6, // ARMv8 A32 encodings for ARM UC_MODE_ARMBE8 = 1 << 10, // Big-endian data and Little-endian code. // Legacy support for UC1 only. // arm (32bit) cpu types // Depreciated, use UC_ARM_CPU_* with uc_ctl instead. UC_MODE_ARM926 = 1 << 7, // ARM926 CPU type UC_MODE_ARM946 = 1 << 8, // ARM946 CPU type UC_MODE_ARM1176 = 1 << 9, // ARM1176 CPU type // mips UC_MODE_MICRO = 1 << 4, // MicroMips mode (currently unsupported) UC_MODE_MIPS3 = 1 << 5, // Mips III ISA (currently unsupported) UC_MODE_MIPS32R6 = 1 << 6, // Mips32r6 ISA (currently unsupported) UC_MODE_MIPS32 = 1 << 2, // Mips32 ISA UC_MODE_MIPS64 = 1 << 3, // Mips64 ISA // x86 / x64 UC_MODE_16 = 1 << 1, // 16-bit mode UC_MODE_32 = 1 << 2, // 32-bit mode UC_MODE_64 = 1 << 3, // 64-bit mode // ppc UC_MODE_PPC32 = 1 << 2, // 32-bit mode UC_MODE_PPC64 = 1 << 3, // 64-bit mode (currently unsupported) UC_MODE_QPX = 1 << 4, // Quad Processing eXtensions mode (currently unsupported) // sparc UC_MODE_SPARC32 = 1 << 2, // 32-bit mode UC_MODE_SPARC64 = 1 << 3, // 64-bit mode UC_MODE_V9 = 1 << 4, // SparcV9 mode (currently unsupported) // riscv UC_MODE_RISCV32 = 1 << 2, // 32-bit mode UC_MODE_RISCV64 = 1 << 3, // 64-bit mode // m68k } uc_mode; -
发现是mips32位大端
-
后用ghidra进行反编译
-
./ghidrarun，codebrowser
-
void UndefinedFunction_00000000(byte *param_1,int *param_2) { int iStack_10; int iStack_c; for (iStack_c = 0; param_1[iStack_c] != 0; iStack_c = iStack_c + 1) { } for (iStack_10 = 0; iStack_10 < iStack_c; iStack_10 = iStack_10 + 1) { param_1[iStack_10] = (param_1[iStack_10] << 3 | param_1[iStack_10] >> 5) ^ (byte)iStack_10; } *param_2 = ((((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2]) - (uint)param_1[3]) + (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8]) + (uint)param_1[9] + (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf]) - (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12] + (uint)param_1[0x13]) - (uint)param_1[0x14]) + (uint)param_1[0x15] + (uint)param_1[0x16] + (uint)param_1[0x17] + (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c] + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22] + (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[1] = (((((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2]) - (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5]) - (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) + (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc]) - (uint)param_1[0xd] ) - (uint)param_1[0xe]) + (uint)param_1[0xf]) - (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14] + (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) - (uint)param_1[0x18]) + (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) + (uint)param_1[0x1e] + (uint)param_1[0x1f] + (uint)param_1[0x20] + (uint)param_1[0x21] + (uint)param_1[0x22] + (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) + (uint)param_1[0x29]; param_2[2] = ((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5]) - (uint)param_1[6]) - (uint)param_1[7]) + (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe]) - (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11] + (uint)param_1[0x12] + (uint)param_1[0x13] + (uint)param_1[0x14] + (uint)param_1[0x15]) - (uint)param_1[0x16]) + (uint)param_1[0x17] + (uint)param_1[0x18] + (uint)param_1[0x19] + (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c]) - (uint)param_1[0x1d]) + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20] + (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) + (uint)param_1[0x24] + (uint)param_1[0x25] + (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[3] = ((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12] + (uint)param_1[0x13] + (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16] + (uint)param_1[0x17] + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d] + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22]) - (uint)param_1[0x23]) + (uint)param_1[0x24] + (uint)param_1[0x25] + (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[4] = ((((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) + (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7] + (uint)param_1[8] + (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb] + (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10] + (uint)param_1[0x11]) - (uint)param_1[0x12]) + (uint)param_1[0x13]) - (uint)param_1[0x14] ) + (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) - (uint)param_1[0x18]) + (uint)param_1[0x19]) - (uint)param_1[0x1a]) - (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d] + (uint)param_1[0x1e] + (uint)param_1[0x1f]) - (uint)param_1[0x20]) + (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) + (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[5] = (((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4] + (uint)param_1[5] + (uint)param_1[6] + (uint)param_1[7] + (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb] ) - (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11]) - (uint)param_1[0x12]) + (uint)param_1[0x13] + (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a] + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) + (uint)param_1[0x1f] + (uint)param_1[0x20] + (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) + (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[6] = ((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7] + (uint)param_1[8] + (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb] + (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe] + (uint)param_1[0xf] + (uint)param_1[0x10] + (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18] + (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b] + (uint)param_1[0x1c] + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) + (uint)param_1[0x24] + (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[7] = (((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5] + (uint)param_1[6]) - (uint)param_1[7]) + (uint)param_1[8] + (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17]) - (uint)param_1[0x18]) + (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b] + (uint)param_1[0x1c] + (uint)param_1[0x1d] + (uint)param_1[0x1e] + (uint)param_1[0x1f] + (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22]) - (uint)param_1[0x23]) + (uint)param_1[0x24] + (uint)param_1[0x25] + (uint)param_1[0x26] + (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[8] = ((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7] + (uint)param_1[8] + (uint)param_1[9] + (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf] + (uint)param_1[0x10] + (uint)param_1[0x11] + (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14] + (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18] + (uint)param_1[0x19] + (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) + (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[9] = ((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2]) - (uint)param_1[3]) + (uint)param_1[4] + (uint)param_1[5] + (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb] + (uint)param_1[0xc] + (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf] + (uint)param_1[0x10]) - (uint)param_1[0x11] ) - (uint)param_1[0x12]) + (uint)param_1[0x13] + (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c] + (uint)param_1[0x1d] + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20] + (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[10] = (((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc] + (uint)param_1[0xd] + (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12] + (uint)param_1[0x13] + (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17] ) - (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a] ) - (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) + (uint)param_1[0x1f] + (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[0xb] = (((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) + (uint)param_1[9] + (uint)param_1[10] ) - (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf] ) - (uint)param_1[0x10]) - (uint)param_1[0x11]) - (uint)param_1[0x12]) + (uint)param_1[0x13] + (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18] + (uint)param_1[0x19] + (uint)param_1[0x1a] + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d] + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) + (uint)param_1[0x24] + (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0xc] = ((((((((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) + (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7] + (uint)param_1[8]) - (uint)param_1[9]) + (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12]) - (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16] ) + (uint)param_1[0x17]) - (uint)param_1[0x18]) + (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20] + (uint)param_1[0x21] + (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0xd] = ((((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2]) - (uint)param_1[3]) + (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6]) - (uint)param_1[7]) + (uint)param_1[8] ) - (uint)param_1[9]) + (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc] + (uint)param_1[0xd] + (uint)param_1[0xe] + (uint)param_1[0xf]) - (uint)param_1[0x10]) - (uint)param_1[0x11]) - (uint)param_1[0x12]) + (uint)param_1[0x13] + (uint)param_1[0x14] + (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18] + (uint)param_1[0x19]) - (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c] + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) + (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) + (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0xe] = ((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2]) - (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6]) - (uint)param_1[7]) + (uint)param_1[8] + (uint)param_1[9] + (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf] + (uint)param_1[0x10] + (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16] + (uint)param_1[0x17] + (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a] + (uint)param_1[0x1b] + (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20] + (uint)param_1[0x21] + (uint)param_1[0x22] + (uint)param_1[0x23] + (uint)param_1[0x24] + (uint)param_1[0x25] + (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0xf] = (((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4] + (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb] + (uint)param_1[0xc] + (uint)param_1[0xd]) - (uint)param_1[0xe]) - (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16] + (uint)param_1[0x17] + (uint)param_1[0x18] + (uint)param_1[0x19] + (uint)param_1[0x1a] + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22] + (uint)param_1[0x23] + (uint)param_1[0x24] + (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27] + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x10] = (((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7] + (uint)param_1[8] + (uint)param_1[9] + (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe] + (uint)param_1[0xf] + (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) - (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a] + (uint)param_1[0x1b] + (uint)param_1[0x1c] + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23]) - (uint)param_1[0x24]) + (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27]) - (uint)param_1[0x28]) + (uint)param_1[0x29]; param_2[0x11] = (((((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7] + (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd] + (uint)param_1[0xe] + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17]) - (uint)param_1[0x18]) + (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23]) - (uint)param_1[0x24]) + (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27] + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x12] = (((((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) + (uint)param_1[4] + (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7]) - (uint)param_1[8]) + (uint)param_1[9] + (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe]) - (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11] + (uint)param_1[0x12] + (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) - (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c] + (uint)param_1[0x1d] + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) + (uint)param_1[0x29]; param_2[0x13] = (((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe] + (uint)param_1[0xf] + (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12] + (uint)param_1[0x13] + (uint)param_1[0x14] + (uint)param_1[0x15]) - (uint)param_1[0x16]) + (uint)param_1[0x17] + (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a] + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d] + (uint)param_1[0x1e] + (uint)param_1[0x1f] + (uint)param_1[0x20] + (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27] + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x14] = (((((((((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) + (uint)param_1[10] + (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe]) - (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14] + (uint)param_1[0x15]) - (uint)param_1[0x16]) + (uint)param_1[0x17] + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) - (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) + (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23] + (uint)param_1[0x24] ) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x15] = ((((((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) + (uint)param_1[4] + (uint)param_1[5] + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) - (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16] + (uint)param_1[0x17] + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) + (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) + (uint)param_1[0x29]; param_2[0x16] = ((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4] + (uint)param_1[5] + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) + (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd] + (uint)param_1[0xe] + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11] + (uint)param_1[0x12]) - (uint)param_1[0x13]) - (uint)param_1[0x14]) + (uint)param_1[0x15] + (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d] + (uint)param_1[0x1e] + (uint)param_1[0x1f]) - (uint)param_1[0x20]) + (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[0x17] = ((((((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) - (uint)param_1[7]) + (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb] + (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf]) - (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12] + (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18] + (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d] + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x18] = ((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1]) - (uint)param_1[2]) + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) + (uint)param_1[9] + (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf] + (uint)param_1[0x10] + (uint)param_1[0x11]) - (uint)param_1[0x12]) + (uint)param_1[0x13] + (uint)param_1[0x14] + (uint)param_1[0x15] + (uint)param_1[0x16] + (uint)param_1[0x17] + (uint)param_1[0x18] + (uint)param_1[0x19]) - (uint)param_1[0x1a]) - (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d] + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) + (uint)param_1[0x20] + (uint)param_1[0x21] + (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24] ) - (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27] + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x19] = (((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5] + (uint)param_1[6]) - (uint)param_1[7]) + (uint)param_1[8] + (uint)param_1[9] + (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11] + (uint)param_1[0x12] + (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16] + (uint)param_1[0x17]) - (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c]) - (uint)param_1[0x1d]) + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) + (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[0x1a] = ((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12]) - (uint)param_1[0x13]) - (uint)param_1[0x14]) + (uint)param_1[0x15] + (uint)param_1[0x16] + (uint)param_1[0x17] + (uint)param_1[0x18] + (uint)param_1[0x19]) - (uint)param_1[0x1a]) - (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) + (uint)param_1[0x1e] + (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23] + (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27] + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[0x1b] = ((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2]) - (uint)param_1[3]) + (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc] + (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf] + (uint)param_1[0x10] + (uint)param_1[0x11] + (uint)param_1[0x12] + (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18] + (uint)param_1[0x19] + (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c] + (uint)param_1[0x1d] + (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x1c] = (((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) + (uint)param_1[10] + (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11] + (uint)param_1[0x12] + (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17]) - (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) + (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22] + (uint)param_1[0x23] + (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27] + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[0x1d] = (((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5] + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) + (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) + (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe] + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11] + (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14] + (uint)param_1[0x15] + (uint)param_1[0x16] + (uint)param_1[0x17]) - (uint)param_1[0x18]) + (uint)param_1[0x19] + (uint)param_1[0x1a]) - (uint)param_1[0x1b]) + (uint)param_1[0x1c] + (uint)param_1[0x1d] + (uint)param_1[0x1e] + (uint)param_1[0x1f] + (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23] + (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26] + (uint)param_1[0x27]) - (uint)param_1[0x28]) + (uint)param_1[0x29]; param_2[0x1e] = (((((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) - (uint)param_1[7]) + (uint)param_1[8] + (uint)param_1[9]) - (uint)param_1[10]) - (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd]) - (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10]) - (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16]) + (uint)param_1[0x17] + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23] + (uint)param_1[0x24] + (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27] + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[0x1f] = (((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1]) - (uint)param_1[2]) + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7] + (uint)param_1[8] + (uint)param_1[9] + (uint)param_1[10] + (uint)param_1[0xb] + (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10] + (uint)param_1[0x11] + (uint)param_1[0x12] + (uint)param_1[0x13]) - (uint)param_1[0x14]) + (uint)param_1[0x15]) - (uint)param_1[0x16]) + (uint)param_1[0x17]) - (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a] + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) + (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23]) - (uint)param_1[0x24]) + (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x20] = ((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5] + (uint)param_1[6] + (uint)param_1[7] + (uint)param_1[8]) - (uint)param_1[9]) + (uint)param_1[10] + (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd] + (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12] + (uint)param_1[0x13] + (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16]) + (uint)param_1[0x17]) - (uint)param_1[0x18]) + (uint)param_1[0x19] + (uint)param_1[0x1a] + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22] + (uint)param_1[0x23] + (uint)param_1[0x24] + (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27]) - (uint)param_1[0x28]) + (uint)param_1[0x29]; param_2[0x21] = ((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) + (uint)param_1[3] + (uint)param_1[4] + (uint)param_1[5] + (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8]) + (uint)param_1[9] + (uint)param_1[10] + (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe] + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11]) - (uint)param_1[0x12]) + (uint)param_1[0x13]) - (uint)param_1[0x14]) + (uint)param_1[0x15] + (uint)param_1[0x16] + (uint)param_1[0x17]) - (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a] + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) + (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x22] = (((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1]) - (uint)param_1[2]) + (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7] + (uint)param_1[8] + (uint)param_1[9] + (uint)param_1[10] + (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11]) - (uint)param_1[0x12]) + (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16] + (uint)param_1[0x17]) - (uint)param_1[0x18]) - (uint)param_1[0x19]) + (uint)param_1[0x1a] + (uint)param_1[0x1b] + (uint)param_1[0x1c] + (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24] ) + (uint)param_1[0x25] + (uint)param_1[0x26] + (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x23] = (((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7] + (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb] + (uint)param_1[0xc] + (uint)param_1[0xd]) - (uint)param_1[0xe]) - (uint)param_1[0xf]) + (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12] + (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) - (uint)param_1[0x16]) + (uint)param_1[0x17] + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b] + (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) + (uint)param_1[0x1f] + (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22] + (uint)param_1[0x23] + (uint)param_1[0x24] + (uint)param_1[0x25] + (uint)param_1[0x26] + (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x24] = ((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2]) - (uint)param_1[3]) - (uint)param_1[4]) - (uint)param_1[5]) - (uint)param_1[6]) + (uint)param_1[7] + (uint)param_1[8] + (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb] + (uint)param_1[0xc]) - (uint)param_1[0xd]) + (uint)param_1[0xe] + (uint)param_1[0xf] + (uint)param_1[0x10] + (uint)param_1[0x11] + (uint)param_1[0x12] + (uint)param_1[0x13] + (uint)param_1[0x14] + (uint)param_1[0x15]) - (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) - (uint)param_1[0x1b]) - (uint)param_1[0x1c]) + (uint)param_1[0x1d] + (uint)param_1[0x1e] + (uint)param_1[0x1f] + (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) + (uint)param_1[0x25]) - (uint)param_1[0x26]) + (uint)param_1[0x27] + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x25] = (((((((((((((((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) + (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5] ) - (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8] ) - (uint)param_1[9]) + (uint)param_1[10]) - (uint)param_1[0xb] ) - (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe] ) - (uint)param_1[0xf]) - (uint)param_1[0x10]) + (uint)param_1[0x11] + (uint)param_1[0x12]) - (uint)param_1[0x13]) - (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18]) - (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) + (uint)param_1[0x1e] + (uint)param_1[0x1f]) - (uint)param_1[0x20]) + (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x26] = (((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2] + (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5] + (uint)param_1[6] + (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb] + (uint)param_1[0xc] + (uint)param_1[0xd]) - (uint)param_1[0xe]) - (uint)param_1[0xf]) - (uint)param_1[0x10]) - (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14] + (uint)param_1[0x15]) - (uint)param_1[0x16]) + (uint)param_1[0x17] + (uint)param_1[0x18] + (uint)param_1[0x19] + (uint)param_1[0x1a] + (uint)param_1[0x1b]) - (uint)param_1[0x1c]) - (uint)param_1[0x1d]) + (uint)param_1[0x1e] + (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) + (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24] ) - (uint)param_1[0x25]) + (uint)param_1[0x26] + (uint)param_1[0x27] + (uint)param_1[0x28]) - (uint)param_1[0x29]; param_2[0x27] = ((((((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) - (uint)param_1[4]) + (uint)param_1[5]) - (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8]) + (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd] + (uint)param_1[0xe]) - (uint)param_1[0xf]) - (uint)param_1[0x10]) - (uint)param_1[0x11]) + (uint)param_1[0x12] + (uint)param_1[0x13] + (uint)param_1[0x14] + (uint)param_1[0x15] + (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18] + (uint)param_1[0x19] + (uint)param_1[0x1a] + (uint)param_1[0x1b] + (uint)param_1[0x1c]) - (uint)param_1[0x1d]) + (uint)param_1[0x1e] + (uint)param_1[0x1f] + (uint)param_1[0x20] + (uint)param_1[0x21] + (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) + (uint)param_1[0x25] + (uint)param_1[0x26] + (uint)param_1[0x27]) - (uint)param_1[0x28]) + (uint)param_1[0x29]; param_2[0x28] = (((((((((((((((((((((((uint)*param_1 - (uint)param_1[1]) - (uint)param_1[2]) - (uint)param_1[3]) + (uint)param_1[4] + (uint)param_1[5] + (uint)param_1[6] ) - (uint)param_1[7]) + (uint)param_1[8] + (uint)param_1[9]) - (uint)param_1[10]) + (uint)param_1[0xb]) - (uint)param_1[0xc]) - (uint)param_1[0xd]) - (uint)param_1[0xe]) + (uint)param_1[0xf] + (uint)param_1[0x10] + (uint)param_1[0x11] + (uint)param_1[0x12] + (uint)param_1[0x13] + (uint)param_1[0x14] + (uint)param_1[0x15] + (uint)param_1[0x16]) - (uint)param_1[0x17]) + (uint)param_1[0x18] + (uint)param_1[0x19]) - (uint)param_1[0x1a]) + (uint)param_1[0x1b] + (uint)param_1[0x1c]) - (uint)param_1[0x1d]) + (uint)param_1[0x1e] + (uint)param_1[0x1f] + (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) + (uint)param_1[0x23] + (uint)param_1[0x24]) - (uint)param_1[0x25]) + (uint)param_1[0x26] + (uint)param_1[0x27] + (uint)param_1[0x28] + (uint)param_1[0x29]; param_2[0x29] = ((((((((((((((((((((((((((((((((uint)*param_1 + (uint)param_1[1] + (uint)param_1[2] + (uint)param_1[3] + (uint)param_1[4] + (uint)param_1[5] + (uint)param_1[6]) - (uint)param_1[7]) - (uint)param_1[8]) - (uint)param_1[9]) + (uint)param_1[10] + (uint)param_1[0xb]) - (uint)param_1[0xc]) + (uint)param_1[0xd]) - (uint)param_1[0xe]) - (uint)param_1[0xf]) - (uint)param_1[0x10]) - (uint)param_1[0x11]) - (uint)param_1[0x12]) - (uint)param_1[0x13]) + (uint)param_1[0x14]) - (uint)param_1[0x15]) + (uint)param_1[0x16]) - (uint)param_1[0x17]) - (uint)param_1[0x18]) + (uint)param_1[0x19] + (uint)param_1[0x1a] + (uint)param_1[0x1b] + (uint)param_1[0x1c]) - (uint)param_1[0x1d]) - (uint)param_1[0x1e]) - (uint)param_1[0x1f]) - (uint)param_1[0x20]) - (uint)param_1[0x21]) - (uint)param_1[0x22]) - (uint)param_1[0x23]) - (uint)param_1[0x24]) - (uint)param_1[0x25]) - (uint)param_1[0x26]) - (uint)param_1[0x27]) - (uint)param_1[0x28]) + (uint)param_1[0x29]; return; } -
一个简单异或，再用z3解
-
注意原始密文应该改成大端序排列
-
from z3 import * import ctypes from pwn import * import struct data=[0xFF, 0xFF, 0xFF, 0x94, 0xFF, 0xFF, 0xFF, 0x38, 0x00, 0x00, 0x01, 0x26, 0xFF, 0xFF, 0xFF, 0x28, 0xFF, 0xFF, 0xFC, 0x10, 0x00, 0x00, 0x02, 0x94, 0xFF, 0xFF, 0xFC, 0x9E, 0x00, 0x00, 0x06, 0xEA, 0x00, 0x00, 0x00, 0xDC, 0x00, 0x00, 0x00, 0x06, 0xFF, 0xFF, 0xFF, 0x0C, 0xFF, 0xFF, 0xFD, 0xF6, 0xFF, 0xFF, 0xFA, 0x82, 0xFF, 0xFF, 0xFC, 0xD0, 0x00, 0x00, 0x01, 0x82, 0x00, 0x00, 0x03, 0xDE, 0x00, 0x00, 0x01, 0x4E, 0x00, 0x00, 0x02, 0xB2, 0xFF, 0xFF, 0xF8, 0xD8, 0x00, 0x00, 0x01, 0x74, 0xFF, 0xFF, 0xFA, 0xA6, 0xFF, 0xFF, 0xF9, 0xD4, 0x00, 0x00, 0x01, 0xC2, 0xFF, 0xFF, 0xF9, 0x7C, 0x00, 0x00, 0x03, 0x5A, 0x00, 0x00, 0x01, 0x46, 0xFF, 0xFF, 0xFF, 0x3C, 0xFF, 0xFF, 0xFA, 0x14, 0x00, 0x00, 0x01, 0xCE, 0x00, 0x00, 0x07, 0xDC, 0xFF, 0xFF, 0xFD, 0x48, 0x00, 0x00, 0x00, 0x98, 0x00, 0x00, 0x08, 0x5E, 0xFF, 0xFF, 0xFD, 0xB0, 0xFF, 0xFF, 0xFF, 0xBC, 0x00, 0x00, 0x03, 0x6E, 0xFF, 0xFF, 0xFF, 0x4E, 0xFF, 0xFF, 0xF8, 0x36, 0x00, 0x00, 0x05, 0xC0, 0x00, 0x00, 0x06, 0xAE, 0x00, 0x00, 0x06, 0x94, 0x00, 0x00, 0x00, 0x22, 0x00, 0x00, 0x00, 0x00] ee=[] e=[] # 将列表转换为字节流 byte_data = bytes(data) # 按照大端序解析字节流为32位整数 for i in range(0, len(byte_data), 4): value = struct.unpack('>I', byte_data[i:i+4])[0] ee.append(hex(value)) print(ee) for i in range(len(ee)): e.append(int(ee[i],16)) print(e) #e = [0xFFFFFF94,0xFFFFFF38,0x00000126,0xFFFFFF28,0xFFFFFC10,0x00000294,0xFFFFFC9E,0x000006EA,0x000000DC,0x00000006,0xFFFFFF0C,0xFFFFFDF6,0xFFFFFA82,0xFFFFFCD0,0x00000182,0x000003DE,0x0000014E,0x000002B2,0xFFFFF8D8,0x00000174,0xFFFFFAA6,0xFFFFF9D4,0x000001C2,0xFFFFF97C,0x0000035A,0x00000146,0xFFFFFF3C,0xFFFFFA14,0x000001CE,0x000007DC,0xFFFFFD48,0x00000098,0x0000085E,0xFFFFFDB0,0xFFFFFFBC,0x0000036E,0xFFFFFF4E,0xFFFFF836,0x000005C0,0x000006AE,0x00000694,0x00000022] en = map(lambda x: ctypes.c_int32(x).value,e) enc = [IntVal(i) for i in en] c = [Int('c%d' % i) for i in range(42)] flag = [] s = Solver() for v in c : s.add(v >= 0x0) s.add(v <= 0xff) s.add(enc[0]==(((((((((((((((((((((((((((((((c[0]+c[1]+c[2])-c[3])+c[4])-c[5])-c[6])-c[7])-c[8])+c[9]+c[10])-c[0xb])+c[0xc])-c[0xd])-c[0xe])+c[0xf])-c[0x10])-c[0x11])+c[0x12]+c[0x13])-c[0x14])+c[0x15]+c[0x16]+c[0x17]+c[0x18])-c[0x19])+c[0x1a])-c[0x1b])+c[0x1c]+c[0x1d])-c[0x1e])-c[0x1f])+c[0x20])-c[0x21])+c[0x22]+c[0x23])-c[0x24])-c[0x25])+c[0x26])-c[0x27])+c[0x28]+c[0x29]) s.add(enc[1]==((((((((((((((((((((((((((((((((((c[0]-c[1])+c[2])-c[3])-c[4])+c[5])-c[6])-c[7])-c[8])-c[9])+c[10])-c[0xb])+c[0xc])-c[0xd])-c[0xe])+c[0xf])-c[0x10])-c[0x11])+c[0x12])-c[0x13])+c[0x14]+c[0x15])-c[0x16])-c[0x17])-c[0x18])+c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])-c[0x1d])+c[0x1e]+c[0x1f]+c[0x20]+c[0x21]+c[0x22]+c[0x23])-c[0x24])-c[0x25])-c[0x26])-c[0x27])-c[0x28])+c[0x29]) s.add(enc[2]==(((((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3])-c[4])+c[5])-c[6])-c[7])+c[8])-c[9])-c[10])-c[0xb])-c[0xc])-c[0xd])+c[0xe])-c[0xf])-c[0x10])+c[0x11]+c[0x12]+c[0x13]+c[0x14]+c[0x15])-c[0x16])+c[0x17]+c[0x18]+c[0x19]+c[0x1a])-c[0x1b])+c[0x1c])-c[0x1d])+c[0x1e])-c[0x1f])+c[0x20]+c[0x21])-c[0x22])-c[0x23])+c[0x24]+c[0x25]+c[0x26])-c[0x27])+c[0x28])-c[0x29]) s.add(enc[3]==(((((((((((((((((((((((((((((((c[0]-c[1])-c[2])-c[3])-c[4])-c[5])+c[6]+c[7])-c[8])-c[9])-c[10])-c[0xb])+c[0xc])-c[0xd])+c[0xe])-c[0xf])+c[0x10])-c[0x11])+c[0x12]+c[0x13]+c[0x14])-c[0x15])+c[0x16]+c[0x17]+c[0x18])-c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])+c[0x1d]+c[0x1e])-c[0x1f])-c[0x20])-c[0x21])+c[0x22])-c[0x23])+c[0x24]+c[0x25]+c[0x26])-c[0x27])+c[0x28]+c[0x29]) s.add(enc[4]==(((((((((((((((((((((((((((((((((c[0]-c[1])-c[2])+c[3])-c[4])-c[5])+c[6]+c[7]+c[8]+c[9])-c[10])+c[0xb]+c[0xc])-c[0xd])+c[0xe])-c[0xf])+c[0x10]+c[0x11])-c[0x12])+c[0x13])-c[0x14])+c[0x15])-c[0x16])-c[0x17])-c[0x18])+c[0x19])-c[0x1a])-c[0x1b])-c[0x1c])+c[0x1d]+c[0x1e]+c[0x1f])-c[0x20])+c[0x21])-c[0x22])-c[0x23])+c[0x24])-c[0x25])+c[0x26])-c[0x27])-c[0x28])-c[0x29]) s.add(enc[5]==((((((((((((((((((((((((((((c[0]+c[1]+c[2]+c[3]+c[4]+c[5]+c[6]+c[7]+c[8])-c[9])-c[10])-c[0xb])-c[0xc])-c[0xd])-c[0xe])+c[0xf])-c[0x10])+c[0x11])-c[0x12])+c[0x13]+c[0x14])-c[0x15])+c[0x16])-c[0x17])+c[0x18])-c[0x19])+c[0x1a]+c[0x1b])-c[0x1c])+c[0x1d])-c[0x1e])+c[0x1f]+c[0x20]+c[0x21])-c[0x22])-c[0x23])-c[0x24])+c[0x25])-c[0x26])-c[0x27])+c[0x28]+c[0x29]) s.add(enc[6]==(((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3]+c[4])-c[5])+c[6]+c[7]+c[8]+c[9])-c[10])+c[0xb]+c[0xc])-c[0xd])+c[0xe]+c[0xf]+c[0x10]+c[0x11])-c[0x12])-c[0x13])-c[0x14])-c[0x15])-c[0x16])-c[0x17])+c[0x18]+c[0x19])-c[0x1a])+c[0x1b]+c[0x1c]+c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])-c[0x23])+c[0x24]+c[0x25])-c[0x26])-c[0x27])+c[0x28])-c[0x29]) s.add(enc[7]==((((((((((((((((((((((((((((((c[0]+c[1])-c[2])-c[3])-c[4])+c[5]+c[6])-c[7])+c[8]+c[9])-c[10])+c[0xb])-c[0xc])+c[0xd])-c[0xe])+c[0xf])-c[0x10])+c[0x11])-c[0x12])-c[0x13])+c[0x14])-c[0x15])+c[0x16])-c[0x17])-c[0x18])+c[0x19])-c[0x1a])+c[0x1b]+c[0x1c]+c[0x1d]+c[0x1e]+c[0x1f]+c[0x20])-c[0x21])+c[0x22])-c[0x23])+c[0x24]+c[0x25]+c[0x26]+c[0x27])-c[0x28])-c[0x29]) s.add(enc[8]==(((((((((((((((((((((((((((((c[0]-c[1])-c[2])+c[3]+c[4])-c[5])+c[6]+c[7]+c[8]+c[9]+c[10])-c[0xb])-c[0xc])+c[0xd])-c[0xe])+c[0xf]+c[0x10]+c[0x11]+c[0x12])-c[0x13])+c[0x14]+c[0x15])-c[0x16])-c[0x17])+c[0x18]+c[0x19]+c[0x1a])-c[0x1b])+c[0x1c])-c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])-c[0x21])+c[0x22])-c[0x23])-c[0x24])+c[0x25])-c[0x26])-c[0x27])+c[0x28])-c[0x29]) s.add(enc[9]==(((((((((((((((((((((((((((((c[0]+c[1]+c[2])-c[3])+c[4]+c[5]+c[6])-c[7])-c[8])-c[9])-c[10])+c[0xb]+c[0xc]+c[0xd])-c[0xe])+c[0xf]+c[0x10])-c[0x11])-c[0x12])+c[0x13]+c[0x14])-c[0x15])-c[0x16])-c[0x17])+c[0x18])-c[0x19])-c[0x1a])-c[0x1b])+c[0x1c]+c[0x1d]+c[0x1e])-c[0x1f])+c[0x20]+c[0x21])-c[0x22])-c[0x23])-c[0x24])-c[0x25])+c[0x26])-c[0x27])+c[0x28]+c[0x29]) s.add(enc[10]==((((((((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3])-c[4])-c[5])+c[6]+c[7])-c[8])-c[9])-c[10])-c[0xb])+c[0xc]+c[0xd]+c[0xe])-c[0xf])+c[0x10])-c[0x11])+c[0x12]+c[0x13]+c[0x14])-c[0x15])+c[0x16])-c[0x17])-c[0x18])-c[0x19])+c[0x1a])-c[0x1b])-c[0x1c])+c[0x1d])-c[0x1e])+c[0x1f]+c[0x20])-c[0x21])-c[0x22])+c[0x23])-c[0x24])-c[0x25])+c[0x26])-c[0x27])+c[0x28]+c[0x29]) s.add(enc[0xb]==((((((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3]+c[4])-c[5])+c[6]+c[7])-c[8])+c[9]+c[10])-c[0xb])-c[0xc])-c[0xd])-c[0xe])+c[0xf])-c[0x10])-c[0x11])-c[0x12])+c[0x13]+c[0x14])-c[0x15])+c[0x16])-c[0x17])+c[0x18]+c[0x19]+c[0x1a]+c[0x1b])-c[0x1c])+c[0x1d]+c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])-c[0x23])+c[0x24]+c[0x25])-c[0x26])-c[0x27])-c[0x28])-c[0x29]) s.add(enc[0xc]==(((((((((((((((((((((((((((((((((((((c[0]-c[1])-c[2])-c[3])+c[4])-c[5])-c[6])+c[7]+c[8])-c[9])+c[10])-c[0xb])-c[0xc])-c[0xd])+c[0xe])-c[0xf])+c[0x10])-c[0x11])+c[0x12])-c[0x13])-c[0x14])-c[0x15])-c[0x16])+c[0x17])-c[0x18])+c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])+c[0x1d])-c[0x1e])-c[0x1f])+c[0x20]+c[0x21]+c[0x22])-c[0x23])-c[0x24])-c[0x25])-c[0x26])+c[0x27])-c[0x28])-c[0x29]) s.add(enc[0xd]==(((((((((((((((((((((((((((((((((c[0]-c[1])+c[2])-c[3])+c[4])-c[5])+c[6])-c[7])+c[8])-c[9])+c[10])-c[0xb])+c[0xc]+c[0xd]+c[0xe]+c[0xf])-c[0x10])-c[0x11])-c[0x12])+c[0x13]+c[0x14]+c[0x15])-c[0x16])-c[0x17])+c[0x18]+c[0x19])-c[0x1a])-c[0x1b])+c[0x1c]+c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])+c[0x21])-c[0x22])-c[0x23])+c[0x24])-c[0x25])-c[0x26])-c[0x27])+c[0x28])-c[0x29]) s.add(enc[0xe]==(((((((((((((((((((((((((c[0]+c[1]+c[2])-c[3])-c[4])-c[5])+c[6])-c[7])+c[8]+c[9]+c[10])-c[0xb])+c[0xc])-c[0xd])-c[0xe])+c[0xf]+c[0x10]+c[0x11])-c[0x12])-c[0x13])-c[0x14])-c[0x15])+c[0x16]+c[0x17]+c[0x18])-c[0x19])+c[0x1a]+c[0x1b]+c[0x1c])-c[0x1d])-c[0x1e])-c[0x1f])+c[0x20]+c[0x21]+c[0x22]+c[0x23]+c[0x24]+c[0x25]+c[0x26])-c[0x27])-c[0x28])-c[0x29]) s.add(enc[0xf]==((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3]+c[4]+c[5])-c[6])+c[7])-c[8])-c[9])-c[10])+c[0xb]+c[0xc]+c[0xd])-c[0xe])-c[0xf])-c[0x10])+c[0x11])-c[0x12])-c[0x13])-c[0x14])-c[0x15])+c[0x16]+c[0x17]+c[0x18]+c[0x19]+c[0x1a]+c[0x1b])-c[0x1c])-c[0x1d])-c[0x1e])-c[0x1f])+c[0x20])-c[0x21])+c[0x22]+c[0x23]+c[0x24]+c[0x25])-c[0x26])+c[0x27]+c[0x28])-c[0x29]) s.add(enc[0x10]==((((((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3])-c[4])-c[5])+c[6]+c[7]+c[8]+c[9]+c[10])-c[0xb])+c[0xc])-c[0xd])+c[0xe]+c[0xf]+c[0x10])-c[0x11])+c[0x12])-c[0x13])+c[0x14])-c[0x15])-c[0x16])-c[0x17])-c[0x18])-c[0x19])+c[0x1a]+c[0x1b]+c[0x1c]+c[0x1d])-c[0x1e])-c[0x1f])+c[0x20])-c[0x21])-c[0x22])+c[0x23])-c[0x24])+c[0x25])-c[0x26])+c[0x27])-c[0x28])+c[0x29]) s.add(enc[0x11]==((((((((((((((((((((((((((((((((c[0]+c[1]+c[2]+c[3]+c[4])-c[5])+c[6]+c[7]+c[8])-c[9])-c[10])+c[0xb])-c[0xc])+c[0xd]+c[0xe]+c[0xf])-c[0x10])+c[0x11])-c[0x12])-c[0x13])+c[0x14])-c[0x15])+c[0x16])-c[0x17])-c[0x18])+c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])+c[0x1d])-c[0x1e])-c[0x1f])+c[0x20])-c[0x21])-c[0x22])+c[0x23])-c[0x24])+c[0x25])-c[0x26])+c[0x27]+c[0x28])-c[0x29]) s.add(enc[0x12]==((((((((((((((((((((((((((((((((((c[0]-c[1])-c[2])-c[3])+c[4]+c[5])-c[6])+c[7])-c[8])+c[9]+c[10])-c[0xb])-c[0xc])-c[0xd])+c[0xe])-c[0xf])-c[0x10])+c[0x11]+c[0x12]+c[0x13])-c[0x14])-c[0x15])-c[0x16])-c[0x17])-c[0x18])-c[0x19])-c[0x1a])-c[0x1b])+c[0x1c]+c[0x1d]+c[0x1e])-c[0x1f])-c[0x20])-c[0x21])+c[0x22])-c[0x23])-c[0x24])-c[0x25])-c[0x26])-c[0x27])-c[0x28])+c[0x29]) s.add(enc[0x13]==((((((((((((((((((((((((((c[0]+c[1]+c[2]+c[3])-c[4])-c[5])+c[6])-c[7])-c[8])-c[9])-c[10])-c[0xb])-c[0xc])-c[0xd])+c[0xe]+c[0xf]+c[0x10])-c[0x11])+c[0x12]+c[0x13]+c[0x14]+c[0x15])-c[0x16])+c[0x17]+c[0x18])-c[0x19])+c[0x1a]+c[0x1b])-c[0x1c])+c[0x1d]+c[0x1e]+c[0x1f]+c[0x20]+c[0x21])-c[0x22])+c[0x23])-c[0x24])-c[0x25])-c[0x26])+c[0x27]+c[0x28])-c[0x29]) s.add(enc[0x14]==((((((((((((((((((((((((((((((((((((c[0]+c[1])-c[2])-c[3])-c[4])+c[5])-c[6])+c[7])-c[8])-c[9])+c[10]+c[0xb])-c[0xc])-c[0xd])+c[0xe])-c[0xf])-c[0x10])+c[0x11])-c[0x12])-c[0x13])+c[0x14]+c[0x15])-c[0x16])+c[0x17]+c[0x18])-c[0x19])-c[0x1a])-c[0x1b])-c[0x1c])-c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])+c[0x21])-c[0x22])+c[0x23]+c[0x24])-c[0x25])+c[0x26])-c[0x27])+c[0x28])-c[0x29]) s.add(enc[0x15]==(((((((((((((((((((((((((((((((((((c[0]-c[1])-c[2])-c[3])+c[4]+c[5]+c[6]+c[7])-c[8])-c[9])-c[10])-c[0xb])-c[0xc])-c[0xd])-c[0xe])-c[0xf])-c[0x10])+c[0x11])-c[0x12])-c[0x13])+c[0x14])-c[0x15])+c[0x16]+c[0x17]+c[0x18])-c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])-c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])-c[0x23])-c[0x24])+c[0x25])-c[0x26])-c[0x27])-c[0x28])+c[0x29]) s.add(enc[0x16]==(((((((((((((((((((((((((((c[0]+c[1]+c[2]+c[3]+c[4]+c[5]+c[6]+c[7])-c[8])+c[9])-c[10])+c[0xb])-c[0xc])+c[0xd]+c[0xe]+c[0xf])-c[0x10])+c[0x11]+c[0x12])-c[0x13])-c[0x14])+c[0x15]+c[0x16])-c[0x17])+c[0x18])-c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])+c[0x1d]+c[0x1e]+c[0x1f])-c[0x20])+c[0x21])-c[0x22])-c[0x23])-c[0x24])-c[0x25])+c[0x26])-c[0x27])+c[0x28]+c[0x29]) s.add(enc[0x17]==(((((((((((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3])-c[4])-c[5])-c[6])-c[7])+c[8])-c[9])-c[10])+c[0xb]+c[0xc])-c[0xd])-c[0xe])+c[0xf])-c[0x10])-c[0x11])+c[0x12]+c[0x13])-c[0x14])-c[0x15])+c[0x16])-c[0x17])+c[0x18]+c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])+c[0x1d]+c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])-c[0x23])-c[0x24])-c[0x25])+c[0x26])-c[0x27])-c[0x28])-c[0x29]) s.add(enc[0x18]==(((((((((((((((((((((((((c[0]+c[1])-c[2])+c[3]+c[4])-c[5])+c[6]+c[7])-c[8])+c[9]+c[10])-c[0xb])-c[0xc])-c[0xd])-c[0xe])+c[0xf]+c[0x10]+c[0x11])-c[0x12])+c[0x13]+c[0x14]+c[0x15]+c[0x16]+c[0x17]+c[0x18]+c[0x19])-c[0x1a])-c[0x1b])-c[0x1c])+c[0x1d]+c[0x1e])-c[0x1f])+c[0x20]+c[0x21]+c[0x22])-c[0x23])-c[0x24])-c[0x25])-c[0x26])+c[0x27]+c[0x28])-c[0x29]) s.add(enc[0x19]==((((((((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3])-c[4])+c[5]+c[6])-c[7])+c[8]+c[9]+c[10])-c[0xb])-c[0xc])+c[0xd])-c[0xe])+c[0xf])-c[0x10])+c[0x11]+c[0x12]+c[0x13])-c[0x14])-c[0x15])+c[0x16]+c[0x17])-c[0x18])-c[0x19])+c[0x1a])-c[0x1b])+c[0x1c])-c[0x1d])+c[0x1e])-c[0x1f])-c[0x20])+c[0x21])-c[0x22])-c[0x23])-c[0x24])-c[0x25])+c[0x26])-c[0x27])+c[0x28]+c[0x29]) s.add(enc[0x1a]==(((((((((((((((((((((((((((((c[0]+c[1]+c[2]+c[3]+c[4])-c[5])-c[6])+c[7])-c[8])-c[9])-c[10])-c[0xb])+c[0xc])-c[0xd])+c[0xe])-c[0xf])+c[0x10])-c[0x11])+c[0x12])-c[0x13])-c[0x14])+c[0x15]+c[0x16]+c[0x17]+c[0x18]+c[0x19])-c[0x1a])-c[0x1b])-c[0x1c])-c[0x1d])+c[0x1e]+c[0x1f])-c[0x20])-c[0x21])-c[0x22])+c[0x23]+c[0x24])-c[0x25])-c[0x26])+c[0x27]+c[0x28]+c[0x29]) s.add(enc[0x1b]==(((((((((((((((((((((((((((((((c[0]-c[1])+c[2])-c[3])+c[4])-c[5])-c[6])-c[7])-c[8])-c[9])-c[10])-c[0xb])+c[0xc]+c[0xd])-c[0xe])+c[0xf]+c[0x10]+c[0x11]+c[0x12]+c[0x13])-c[0x14])-c[0x15])-c[0x16])-c[0x17])+c[0x18]+c[0x19]+c[0x1a])-c[0x1b])+c[0x1c]+c[0x1d]+c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])+c[0x23])-c[0x24])-c[0x25])-c[0x26])-c[0x27])-c[0x28])-c[0x29]) s.add(enc[0x1c]==((((((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3]+c[4])-c[5])+c[6]+c[7])-c[8])-c[9])+c[10]+c[0xb])-c[0xc])+c[0xd])-c[0xe])+c[0xf])-c[0x10])+c[0x11]+c[0x12]+c[0x13])-c[0x14])-c[0x15])+c[0x16])-c[0x17])-c[0x18])-c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])-c[0x1d])-c[0x1e])+c[0x1f])-c[0x20])-c[0x21])+c[0x22]+c[0x23]+c[0x24])-c[0x25])-c[0x26])+c[0x27]+c[0x28]+c[0x29]) s.add(enc[0x1d]==((((((((((((((((((((((((((c[0]+c[1])-c[2])-c[3])-c[4])+c[5]+c[6]+c[7])-c[8])+c[9])-c[10])-c[0xb])+c[0xc])-c[0xd])+c[0xe]+c[0xf])-c[0x10])+c[0x11]+c[0x12])-c[0x13])+c[0x14]+c[0x15]+c[0x16]+c[0x17])-c[0x18])+c[0x19]+c[0x1a])-c[0x1b])+c[0x1c]+c[0x1d]+c[0x1e]+c[0x1f]+c[0x20])-c[0x21])-c[0x22])+c[0x23]+c[0x24])-c[0x25])+c[0x26]+c[0x27])-c[0x28])+c[0x29]) s.add(enc[0x1e]==((((((((((((((((((((((((((((((((c[0]+c[1]+c[2]+c[3])-c[4])-c[5])-c[6])-c[7])+c[8]+c[9])-c[10])-c[0xb])-c[0xc])+c[0xd])-c[0xe])-c[0xf])+c[0x10])-c[0x11])-c[0x12])-c[0x13])+c[0x14])-c[0x15])-c[0x16])+c[0x17]+c[0x18])-c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])-c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])+c[0x23]+c[0x24]+c[0x25])-c[0x26])+c[0x27]+c[0x28]+c[0x29]) s.add(enc[0x1f]==((((((((((((((((((((((((((((((c[0]+c[1])-c[2])+c[3]+c[4])-c[5])-c[6])+c[7]+c[8]+c[9]+c[10]+c[0xb]+c[0xc])-c[0xd])-c[0xe])-c[0xf])+c[0x10]+c[0x11]+c[0x12]+c[0x13])-c[0x14])+c[0x15])-c[0x16])+c[0x17])-c[0x18])-c[0x19])+c[0x1a]+c[0x1b])-c[0x1c])+c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])+c[0x21])-c[0x22])+c[0x23])-c[0x24])+c[0x25])-c[0x26])+c[0x27])-c[0x28])-c[0x29]) s.add(enc[0x20]==(((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3])-c[4])+c[5]+c[6]+c[7]+c[8])-c[9])+c[10]+c[0xb])-c[0xc])+c[0xd]+c[0xe])-c[0xf])+c[0x10])-c[0x11])+c[0x12]+c[0x13]+c[0x14])-c[0x15])-c[0x16])+c[0x17])-c[0x18])+c[0x19]+c[0x1a]+c[0x1b])-c[0x1c])-c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])-c[0x21])+c[0x22]+c[0x23]+c[0x24]+c[0x25])-c[0x26])+c[0x27])-c[0x28])+c[0x29]) s.add(enc[0x21]==(((((((((((((((((((((((((((((((c[0]-c[1])-c[2])+c[3]+c[4]+c[5]+c[6])-c[7])-c[8])+c[9]+c[10]+c[0xb])-c[0xc])-c[0xd])+c[0xe]+c[0xf])-c[0x10])+c[0x11])-c[0x12])+c[0x13])-c[0x14])+c[0x15]+c[0x16]+c[0x17])-c[0x18])-c[0x19])+c[0x1a]+c[0x1b])-c[0x1c])+c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])-c[0x23])+c[0x24])-c[0x25])+c[0x26])-c[0x27])-c[0x28])-c[0x29]) s.add(enc[0x22]==((((((((((((((((((((((((((((((c[0]+c[1])-c[2])+c[3])-c[4])-c[5])-c[6])+c[7]+c[8]+c[9]+c[10]+c[0xb])-c[0xc])-c[0xd])-c[0xe])+c[0xf])-c[0x10])+c[0x11])-c[0x12])+c[0x13])-c[0x14])-c[0x15])+c[0x16]+c[0x17])-c[0x18])-c[0x19])+c[0x1a]+c[0x1b]+c[0x1c]+c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])-c[0x23])-c[0x24])+c[0x25]+c[0x26]+c[0x27])-c[0x28])-c[0x29]) s.add(enc[0x23]==((((((((((((((((((((((((((c[0]-c[1])+c[2]+c[3]+c[4])-c[5])-c[6])+c[7]+c[8])-c[9])-c[10])+c[0xb]+c[0xc]+c[0xd])-c[0xe])-c[0xf])+c[0x10])-c[0x11])+c[0x12]+c[0x13])-c[0x14])-c[0x15])-c[0x16])+c[0x17]+c[0x18])-c[0x19])-c[0x1a])+c[0x1b]+c[0x1c])-c[0x1d])-c[0x1e])+c[0x1f]+c[0x20])-c[0x21])+c[0x22]+c[0x23]+c[0x24]+c[0x25]+c[0x26]+c[0x27])-c[0x28])-c[0x29]) s.add(enc[0x24]==(((((((((((((((((((((((((c[0]+c[1]+c[2])-c[3])-c[4])-c[5])-c[6])+c[7]+c[8]+c[9])-c[10])+c[0xb]+c[0xc])-c[0xd])+c[0xe]+c[0xf]+c[0x10]+c[0x11]+c[0x12]+c[0x13]+c[0x14]+c[0x15])-c[0x16])-c[0x17])+c[0x18])-c[0x19])-c[0x1a])-c[0x1b])-c[0x1c])+c[0x1d]+c[0x1e]+c[0x1f]+c[0x20])-c[0x21])-c[0x22])-c[0x23])-c[0x24])+c[0x25])-c[0x26])+c[0x27]+c[0x28])-c[0x29]) s.add(enc[0x25]==((((((((((((((((((((((((((((((((((((((c[0]-c[1])-c[2])+c[3])-c[4])+c[5])-c[6])-c[7])-c[8])-c[9])+c[10])-c[0xb])-c[0xc])-c[0xd])-c[0xe])-c[0xf])-c[0x10])+c[0x11]+c[0x12])-c[0x13])-c[0x14])-c[0x15])+c[0x16])-c[0x17])+c[0x18])-c[0x19])-c[0x1a])+c[0x1b])-c[0x1c])-c[0x1d])+c[0x1e]+c[0x1f])-c[0x20])+c[0x21])-c[0x22])+c[0x23])-c[0x24])-c[0x25])+c[0x26])-c[0x27])-c[0x28])-c[0x29]) s.add(enc[0x26]==((((((((((((((((((((((((((c[0]+c[1]+c[2]+c[3])-c[4])+c[5]+c[6]+c[7])-c[8])-c[9])-c[10])+c[0xb]+c[0xc]+c[0xd])-c[0xe])-c[0xf])-c[0x10])-c[0x11])-c[0x12])-c[0x13])+c[0x14]+c[0x15])-c[0x16])+c[0x17]+c[0x18]+c[0x19]+c[0x1a]+c[0x1b])-c[0x1c])-c[0x1d])+c[0x1e]+c[0x1f])-c[0x20])-c[0x21])+c[0x22])-c[0x23])-c[0x24])-c[0x25])+c[0x26]+c[0x27]+c[0x28])-c[0x29]) s.add(enc[0x27]==(((((((((((((((((((((((((c[0]-c[1])-c[2])-c[3])-c[4])+c[5])-c[6])-c[7])-c[8])+c[9])-c[10])+c[0xb])-c[0xc])+c[0xd]+c[0xe])-c[0xf])-c[0x10])-c[0x11])+c[0x12]+c[0x13]+c[0x14]+c[0x15]+c[0x16])-c[0x17])+c[0x18]+c[0x19]+c[0x1a]+c[0x1b]+c[0x1c])-c[0x1d])+c[0x1e]+c[0x1f]+c[0x20]+c[0x21]+c[0x22])-c[0x23])-c[0x24])+c[0x25]+c[0x26]+c[0x27])-c[0x28])+c[0x29]) s.add(enc[0x28]==((((((((((((((((((((((c[0]-c[1])-c[2])-c[3])+c[4]+c[5]+c[6])-c[7])+c[8]+c[9])-c[10])+c[0xb])-c[0xc])-c[0xd])-c[0xe])+c[0xf]+c[0x10]+c[0x11]+c[0x12]+c[0x13]+c[0x14]+c[0x15]+c[0x16])-c[0x17])+c[0x18]+c[0x19])-c[0x1a])+c[0x1b]+c[0x1c])-c[0x1d])+c[0x1e]+c[0x1f]+c[0x20])-c[0x21])-c[0x22])+c[0x23]+c[0x24])-c[0x25])+c[0x26]+c[0x27]+c[0x28]+c[0x29]) s.add(enc[0x29]==(((((((((((((((((((((((((((((((c[0]+c[1]+c[2]+c[3]+c[4]+c[5]+c[6])-c[7])-c[8])-c[9])+c[10]+c[0xb])-c[0xc])+c[0xd])-c[0xe])-c[0xf])-c[0x10])-c[0x11])-c[0x12])-c[0x13])+c[0x14])-c[0x15])+c[0x16])-c[0x17])-c[0x18])+c[0x19]+c[0x1a]+c[0x1b]+c[0x1c])-c[0x1d])-c[0x1e])-c[0x1f])-c[0x20])-c[0x21])-c[0x22])-c[0x23])-c[0x24])-c[0x25])-c[0x26])-c[0x27])-c[0x28])+c[0x29]) if s.check() == sat : r = s.model() for i in range(42) : flag.append(r[c[i]].as_long()^i) flag = ''.join(map(lambda x : chr(((x >> 3) | (x << 5)) & 0xff),flag)) print(flag) -
SUCTF{Un1c0rn_Engin3_Is@P0wer7ul_TO0ls!}
SUCTF2019 babyunic
发布于
2024-03-01
|
63分钟
|
10024字数
|
浏览量::
- 本文作者： Tanggerr
- 本文链接： https://Tanggerr.github.io/post/suctf2019-babyunic/
- 版权声明： 本博客所有文章除特别声明外，均采用 BY-NC-SA 许可协议。转载请注明出处！
0%
召唤看板娘
x
感谢您的支持，我会继续努力的!
扫码打赏，你说多少就多少