Featured image of post MiniL
Ctf

MiniL

BigBanana

  • 第一次做vm题，做了挺久就来好好记录一下 那CTF，那VMre，那些事（一） VM逆向，一篇就够了 这两篇文章让我收获很大，了解了基础的vm组成结构，和基础的解题方法。

    这道题虽说是vm题，但又不完全是，总体结构很简单，一个类似于 VM 的东西，有一个栈、一个指令序列和 4 个寄存器。 打开主函数能很明显的看到操作字节码与对应的handle函数，不过需要注意的是这里的是已经减一后的结果 再查看函数过程中遇到的问题是有点看不懂处理函数的作用，并且提取出来的opcode是byte类型不是dword（byte类型也能做，后面会讲） 提取出opcode后，能很明显看到，前面很长一段都是用来打印一段话的，没有什么用，主要是eip=2888后面的（即input后面的) 思路文档如下

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

F4, 01 ⽴即数加法         F4是R1加 ，01是R2加
F3 两个数异或             赋值给R1
F2 cmp 后⾯跟着应该的结果
FE 对cmp的结果进行check
F0 把上⼀次结果保存
10 getchar并推上栈
F8 push 栈[0]字符        出R2
F7 push 栈[1]字符        出R1
这里f8(R2)指向694e694d，f7(R1)指向74632d4c
10 10 f8 f7 f4 694e694d 01 74632d4c f4 00 f3 f2 1d2d440f fe
(R1+694e694d+00)^(R2+74632d4c)=1d2d440f,检查，保存
66 f0 10 f8 f4 16 01 21 f4 114514 f3 f2 74747250 fe
此时输入的值弹到R2里了 所以就是(input+21)^(74632d4c(R1即前一个字符)+16+114514)
66 f0 10 f8 f4 21 01 2c f4 228a28 f3 f2 228a4d fe
66 f0 10 f8 f4 2c 01 0b f4 33cf3c f3 f2 33cfaa fe
66 f0 10 f8 f4 0b 01 16 f4 451450 f3 f2 4514cb fe
66 f0 10 f8 f4 16 01 21 f4 565964 f3 f2 565966 fe
66 f0 10 f8 f4 21 01 2c f4 679e78 f3 f2 679fbc fe
66 f0 10 f8 f4 2c 01 0b f4 78e38c f3 f2 78e4cc fe
66 f0 10 f8 f4 0b 01 16 f4 8a28a0 f3 f2 8a2949 fe
66 f0 10 f8 f4 16 01 21 f4 9b6db4 f3 f2 9b6ec8 fe
66 f0 10 f8 f4 21 01 2c f4 acb2c8 f3 f2 acb3e0 fe
66 f0 10 f8 f4 2c 01 0b f4 bdf7dc f3 f2 bdf8f6 fe
66 f0 10 f8 f4 0b 01 16 f4 cf3cf0 f3 f2 cf3d22 fe
66 f0 10 f8 f4 16 01 21 f4 e08204 f3 f2 e082eb fe
66 f0 10 f8 f4 21 01 2c f4 f1c718 f3 f2 f1c745 fe
66 f0 10 f8 f4 2c 01 0b f4 1030c2c f3 f2 1030c9c fe
66 f0 10 f8 f4 0b 01 16 f4 1145140 f3 f2 114518e fe
66 f0 10 f8 f4 16 01 21 f4 1259654 f3 f2 1259634 fe
66 f0 10 f8 f4 21 01 2c f4 136db68 f3 f2 136dc9c fe
66 f0 10 f8 f4 2c 01 0b f4 148207c f3 f2 148217d fe
66 f0 10 f8 f4 0b 01 16 f4 1596590 f3 f2 15965ae fe
66 f0 10 f8 f4 16 01 21 f4 16aaaa4 f3 f2 16aabb8 fe
66 f0 10 f8 f4 21 01 2c f4 17befb8 f3 f2 17bf02f fe
66 f0 10 f8 f4 2c 01 0b f4 18d34cc f3 f2 18d352a fe
66 f0 10 f8 f4 0b 01 16 f4 19e79e0 f3 f2 19e7ae7 fe
66 f0 10 f8 f4 16 01 21 f4 1afbef4 f3 f2 1afbf19 fe
66 f0 10 f8 f4 21 01 2c f4 1c10408 f3 f2 1c1043c fe
66 f0 10 f8 f4 2c 01 0b f4 1d2491c f3 f2 1d249a4 fe
66 f0 10 f8 f4 0b 01 16 f4 1e38e30 f3 f2 1e38e3e fe
66 f0 10 f8 f4 16 01 21 f4 1f4d344 f3 f2 1f4d3b0 fe
66 f0 10 f8 f4 21 01 2c f4 2061858 f3 f2 2061853 fe
66 f0 10 f8 f4 2c 01 0b f4 2175d6c f3 f2 2175e76 fe
66 f0 10 f8 f4 0b 01 16 f4 228a280 f3 f2 228a241 fe
66 f0 10 f8 f4 16 01 21 f4 239e794 f3 f2 239e866 fe
66 f0 10 f8 f4 21 01 2c f4 24b2ca8 f3 f2 24b2d81 fe
66 f0 10 f8 f4 2c 01 0b f4 25c71bc f3 f2 25c72f0 fe
66 f0 10 f8 f4 0b 01 16 f4 26db6d0 f3 f2 26db738 fe
66 f0 10 f8 f4 16 01 21 f4 27efbe4 f3 f2 27efcfc fe
66 f0 10 f8 f4 21 01 2c f4 29040f8 f3 f2 29041f1 fe
66 f0 10 f8 f4 2c 01 0b f4 2a1860c f3 f2 2a186e7 fe
66 f0 10 f8 f4 0b 01 16 f4 2b2cb20 f3 f2 2b2cbe3 fe
66 f0 10 f8 f4 16 01 21 f4 2c41034 f3 f2 2c4105d fe
66 f0 10 f8 f4 21 01 2c f4 2d55548 f3 f2 2d55595 fe
66 f0 10 f8 f4 2c 01 0b f4 2e69a5c f3 f2 2e69a7b fe

起初我是提取出的byte类型的opcode，学着别的师傅做得爆破，这里附一份带注释的爆破代码

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205

#define _CRT_SECURE_NO_WARNINGS 0
#include <iostream>
#include <stack>
using namespace std;

// 定义指令列表，存储虚拟机的指令
//unsigned char intr_list[] = { 246, 0, 0, 0, 108, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, ... };
unsigned char intr_list[] = {
        246, 0, 0, 0, 108, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 71, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 13, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 5, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 19, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 10, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 2, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 9, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 9, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 1, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 74, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 21, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 18, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 19, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 8, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 15, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 11, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 20, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0,
        246, 0, 0, 0, 14, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 18, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 20, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 9, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 0, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 2, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 21, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 21, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 20, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 22, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 2, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 20, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 7, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 14, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 4, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 10, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 10, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 15, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 17, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 19, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 9, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 31, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 74, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 31, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 10, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 18, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 5, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 20, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 20, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 9, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 5, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 8, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 15, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 1, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 7, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 10, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 0, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 14, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 18, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 20, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 3, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 17, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 21, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 8, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 7, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 19, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 9, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 31, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 70, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 0, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 246, 0, 0, 0, 47, 0, 0, 0, 246, 0, 0, 0, 102, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 247, 0, 0, 0, 248, 0, 0, 0, 243, 0, 0, 0, 17, 0, 0, 0, 16, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 247, 0, 0, 0, 244, 0, 0, 0, 77, 105, 78, 105, 1, 0, 0, 0, 76, 45, 99, 116, 244, 0, 0, 0, 0, 0, 0, 0, 243, 0, 0, 0, 242, 0, 0, 0, 15, 68, 45, 29, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 20, 69, 17, 0, 243, 0, 0, 0, 242, 0, 0, 0, 80, 114, 116, 116, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 40, 138, 34, 0, 243, 0, 0, 0, 242, 0, 0, 0, 77, 138, 34, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 60, 207, 51, 0, 243, 0, 0, 0, 242, 0, 0, 0, 170, 207, 51, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 80, 20, 69, 0, 243, 0, 0, 0, 242, 0, 0, 0, 203, 20, 69, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 100, 89, 86, 0, 243, 0, 0, 0, 242, 0, 0, 0, 102, 89, 86, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 120, 158, 103, 0, 243, 0, 0, 0, 242, 0, 0, 0, 188, 159, 103, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 140, 227, 120, 0, 243, 0, 0, 0, 242, 0, 0, 0, 204, 228, 120, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 160, 40, 138, 0, 243, 0, 0, 0, 242, 0, 0, 0, 73, 41, 138, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 180, 109, 155, 0, 243, 0, 0, 0, 242, 0, 0, 0, 200, 110, 155, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 200, 178, 172, 0, 243, 0, 0, 0, 242, 0, 0, 0, 224, 179, 172, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 220, 247, 189, 0, 243, 0, 0, 0, 242, 0, 0, 0, 246, 248, 189, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 240, 60, 207, 0, 243, 0, 0, 0, 242, 0, 0, 0, 34, 61, 207, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 4, 130, 224, 0, 243, 0, 0, 0, 242, 0, 0, 0, 235, 130, 224, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 24, 199, 241, 0, 243, 0, 0, 0, 242, 0, 0, 0, 69, 199, 241, 0, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 44, 12, 3, 1, 243, 0, 0, 0, 242, 0, 0, 0, 156, 12, 3, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 64, 81, 20, 1, 243, 0, 0, 0, 242, 0, 0, 0, 142, 81, 20, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 84, 150, 37, 1, 243, 0, 0, 0, 242, 0, 0, 0, 52, 150, 37, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 104, 219, 54, 1, 243, 0, 0, 0, 242, 0, 0, 0, 156, 220, 54, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 124, 32, 72, 1, 243, 0, 0, 0, 242, 0, 0, 0, 125, 33, 72, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 144, 101, 89, 1, 243, 0, 0, 0, 242, 0, 0, 0, 174, 101, 89, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 164, 170, 106, 1, 243, 0, 0, 0, 242, 0, 0, 0, 184, 171, 106, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 184, 239, 123, 1, 243, 0, 0, 0, 242, 0, 0, 0, 47, 240, 123, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 204, 52, 141, 1, 243, 0, 0, 0, 242, 0, 0, 0, 42, 53, 141, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 224, 121, 158, 1, 243, 0, 0, 0, 242, 0, 0, 0, 231, 122, 158, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 244, 190, 175, 1, 243, 0, 0, 0, 242, 0, 0, 0, 25, 191, 175, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 8, 4, 193, 1, 243, 0, 0, 0, 242, 0, 0, 0, 60, 4, 193, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 28, 73, 210, 1, 243, 0, 0, 0, 242, 0, 0, 0, 164, 73, 210, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 48, 142, 227, 1, 243, 0, 0, 0, 242, 0, 0, 0, 62, 142, 227, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 68, 211, 244, 1, 243, 0, 0, 0, 242, 0, 0, 0, 176, 211, 244, 1, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 88, 24, 6, 2, 243, 0, 0, 0, 242, 0, 0, 0, 83, 24, 6, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 108, 93, 23, 2, 243, 0, 0, 0, 242, 0, 0, 0, 118, 94, 23, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 128, 162, 40, 2, 243, 0, 0, 0, 242, 0, 0, 0, 65, 162, 40, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 148, 231, 57, 2, 243, 0, 0, 0, 242, 0, 0, 0, 102, 232, 57, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 168, 44, 75, 2, 243, 0, 0, 0, 242, 0, 0, 0, 129, 45, 75, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 188, 113, 92, 2, 243, 0, 0, 0, 242, 0, 0, 0, 240, 114, 92, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 208, 182, 109, 2, 243, 0, 0, 0, 242, 0, 0, 0, 56, 183, 109, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 228, 251, 126, 2, 243, 0, 0, 0, 242, 0, 0, 0, 252, 252, 126, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 248, 64, 144, 2, 243, 0, 0, 0, 242, 0, 0, 0, 241, 65, 144, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 12, 134, 161, 2, 243, 0, 0, 0, 242, 0, 0, 0, 231, 134, 161, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 11, 0, 0, 0, 1, 0, 0, 0, 22, 0, 0, 0, 244, 0, 0, 0, 32, 203, 178, 2, 243, 0, 0, 0, 242, 0, 0, 0, 227, 203, 178, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 22, 0, 0, 0, 1, 0, 0, 0, 33, 0, 0, 0, 244, 0, 0, 0, 52, 16, 196, 2, 243, 0, 0, 0, 242, 0, 0, 0, 93, 16, 196, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 33, 0, 0, 0, 1, 0, 0, 0, 44, 0, 0, 0, 244, 0, 0, 0, 72, 85, 213, 2, 243, 0, 0, 0, 242, 0, 0, 0, 149, 85, 213, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240, 0, 0, 0, 16, 0, 0, 0, 248, 0, 0, 0, 244, 0, 0, 0, 44, 0, 0, 0, 1, 0, 0, 0, 11, 0, 0, 0, 244, 0, 0, 0, 92, 154, 230, 2, 243, 0, 0, 0, 242, 0, 0, 0, 123, 154, 230, 2, 254, 0, 0, 0, 102, 0, 0, 0, 240,
};
// 定义答案数组，存储可能的输入值
unsigned char ans[0x1000];
// 当前答案数组的索引
int ans_i;

// 指令列表的起始索引，0xb40 / 4 是将地址 0xb40 转换为指令索引
int idx = 0xb40 / 4;

// 定义一个栈，用于存储中间值
stack<int> s;

// 检查当前答案数组是否满足虚拟机的指令逻辑
int check()
{
    unsigned char tmp;
    // 当前指令索引
    int now_idx = idx;
    // 当前答案数组的索引
    int now_ans_i = 0;
    // 将指令列表转换为 int 类型的指针，方便访问
    int* intr_list_i = (int*)intr_list;
    // 定义一些变量，用于存储中间值
    int p1 = 0, p2 = 0, p3 = 0, p4 = 0;
    // 标志位，用于控制条件跳转
    int flag = 0;

    // 清空栈
    while (!s.empty())
        s.pop();

    // 遍历指令列表，直到遇到终止指令（值为 0）
    while (intr_list_i[now_idx] != 0) {
        // 根据指令类型执行不同的操作
        switch (intr_list_i[now_idx]) {
        case 1:
            // 将 p2 的值加上指令中的值
            p2 += intr_list_i[now_idx + 1];
            // 跳过指令中的值
            now_idx += 2;
            break;
        case 16:
            // 从答案数组中读取一个字符并压入栈
            tmp = ans[now_ans_i++];
            s.push(tmp);
            now_idx += 1;
            break;
        case 17:
            // 打印 p1 的值
            printf("%c", p1);
            now_idx += 1;
            break;
        case 240:
            // 将 p2 的值赋给 p1
            p1 = p2;
            now_idx += 1;
            break;
        case 241:
            // 将 p2 的值赋给 p4
            p4 = p2;
            now_idx += 1;
            break;
        case 242:
            // 比较 p1 和指令中的值
            if (p1 == intr_list_i[now_idx + 1]) {
                flag = 1;  // 如果相等，设置标志位
                if (now_ans_i == ans_i)  // 如果答案数组已全部处理
                    return 1;  // 返回 1，表示验证通过
            }
            else {
                flag = 0;  // 如果不相等，清除标志位
            }
            now_idx += 2;
            break;
        case 243:
            // 将 p1 和 p2 进行异或操作
            p1 ^= p2;
            now_idx += 1;
            break;
        case 244:
            // 将 p1 的值加上指令中的值
            p1 += intr_list_i[now_idx + 1];
            now_idx += 2;
            break;
        case 245:
            // 从指令中读取两个值，进行减法操作
            intr_list_i[now_idx + 1] -= intr_list_i[now_idx + 2];
            now_idx += 3;
            break;
        case 246:
            // 将指令中的值压入栈
            s.push(intr_list_i[now_idx + 1]);
            now_idx += 2;
            break;
        case 247:
            // 从栈中弹出一个值赋给 p1
            p1 = s.top();
            s.pop();
            now_idx += 1;
            break;
        case 248:
            // 从栈中弹出一个值赋给 p2
            p2 = s.top();
            s.pop();
            now_idx += 1;
            break;
        case 249:
            // 从栈中弹出一个值赋给 p3
            p3 = s.top();
            s.pop();
            now_idx += 1;
            break;
        case 250:
            // 从栈中弹出一个值赋给 p4
            p4 = s.top();
            s.pop();
            now_idx += 1;
            break;
        case 254:
            // 如果标志位为 0，返回 0，表示验证失败
            if (flag == 0) {
                return 0;
            }
            now_idx += 2;
            break;
        case 255:
            // 条件跳转，如果标志位为 1，则跳过指令中的值
            if (flag)
                now_idx += intr_list_i[now_idx + 1];
            now_idx += 2;
            break;
        default:
            break;
        }
    }
    return 1;  // 如果所有指令都执行完毕，返回 1，表示验证通过
}

// 深度优先搜索函数，用于穷举所有可能的输入值
int dfs() {
    ans_i++;  // 增加答案数组的索引
    for (unsigned char ch = 0; ch <= 0x7f; ch++) {  // 遍历所有可能的字符值
        ans[ans_i - 1] = ch;  // 将当前字符值赋给答案数组
        if (check()) {  // 调用 check 函数验证当前答案数组是否满足条件
            if (ans_i == 45 || dfs())  // 如果答案数组长度达到 45 或递归调用 dfs 返回 1
                return 1;  // 返回 1，表示找到解
        }
    }
    ans_i--;  // 回溯，减少答案数组的索引
    return 0;  // 返回 0，表示当前路径无法找到解
}

// 深度优先搜索的初始化函数
void dfs_init() {
    ans_i = 2;  // 初始化答案数组的索引为 2
    for (unsigned char ch1 = 0; ch1 <= 0x7f; ch1++) {  // 遍历 ans[0] 的所有可能值
        for (unsigned char ch2 = 0; ch2 <= 0x7f; ch2++) {  // 遍历 ans[1] 的所有可能值
            ans[0] = ch1;  // 将当前值赋给 ans[0]
            ans[1] = ch2;  // 将当前值赋给 ans[1]
            if (check() && dfs()) {  // 调用 check 函数验证当前答案数组是否满足条件，并递归调用 dfs
                cout << ans << endl;  // 如果找到解，打印答案数组
                return;  // 退出函数
            }
        }
    }
}

// 主函数
int main() {
    setbuf(stdout, 0);  // 禁用输出缓冲
    dfs_init();  // 调用初始化函数启动深度优先搜索
    return 0;
}

这份代码用的dfs爆破的，有的师傅用的z3也是可以爆破出来的 然后就是一份了解了主要逻辑后，用的dword的opcode写的代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

raw_data = [
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x114514,0xf3,0xf2,0x74747250,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x228a28,0xf3,0xf2,0x228a4d,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x33cf3c,0xf3,0xf2,0x33cfaa,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x451450,0xf3,0xf2,0x4514cb,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x565964,0xf3,0xf2,0x565966,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x679e78,0xf3,0xf2,0x679fbc,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x78e38c,0xf3,0xf2,0x78e4cc,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x8a28a0,0xf3,0xf2,0x8a2949,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x9b6db4,0xf3,0xf2,0x9b6ec8,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0xacb2c8,0xf3,0xf2,0xacb3e0,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0xbdf7dc,0xf3,0xf2,0xbdf8f6,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0xcf3cf0,0xf3,0xf2,0xcf3d22,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0xe08204,0xf3,0xf2,0xe082eb,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0xf1c718,0xf3,0xf2,0xf1c745,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x1030c2c,0xf3,0xf2,0x1030c9c,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x1145140,0xf3,0xf2,0x114518e,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x1259654,0xf3,0xf2,0x1259634,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x136db68,0xf3,0xf2,0x136dc9c,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x148207c,0xf3,0xf2,0x148217d,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x1596590,0xf3,0xf2,0x15965ae,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x16aaaa4,0xf3,0xf2,0x16aabb8,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x17befb8,0xf3,0xf2,0x17bf02f,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x18d34cc,0xf3,0xf2,0x18d352a,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x19e79e0,0xf3,0xf2,0x19e7ae7,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x1afbef4,0xf3,0xf2,0x1afbf19,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x1c10408,0xf3,0xf2,0x1c1043c,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x1d2491c,0xf3,0xf2,0x1d249a4,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x1e38e30,0xf3,0xf2,0x1e38e3e,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x1f4d344,0xf3,0xf2,0x1f4d3b0,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x2061858,0xf3,0xf2,0x2061853,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x2175d6c,0xf3,0xf2,0x2175e76,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x228a280,0xf3,0xf2,0x228a241,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x239e794,0xf3,0xf2,0x239e866,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x24b2ca8,0xf3,0xf2,0x24b2d81,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x25c71bc,0xf3,0xf2,0x25c72f0,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x26db6d0,0xf3,0xf2,0x26db738,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x27efbe4,0xf3,0xf2,0x27efcfc,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x29040f8,0xf3,0xf2,0x29041f1,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x2a1860c,0xf3,0xf2,0x2a186e7,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x0b,0x01,0x16,0xf4,0x2b2cb20,0xf3,0xf2,0x2b2cbe3,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x16,0x01,0x21,0xf4,0x2c41034,0xf3,0xf2,0x2c4105d,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x21,0x01,0x2c,0xf4,0x2d55548,0xf3,0xf2,0x2d55595,0xfe,
        0x66,0xf0,0x10,0xf8,0xf4,0x2c,0x01,0x0b,0xf4,0x2e69a5c,0xf3,0xf2,0x2e69a7b,0xfe
        ]
list_f4 = []
list_01 = []
list_ans = []

for i in range(len(raw_data) - 1):  # 避免索引越界
    if raw_data[i] == 0xf4:
        list_f4.append(raw_data[i + 1])                                                  
    if raw_data[i] == 0x01:
        list_01.append(raw_data[i + 1])
    if raw_data[i] == 0xf2:
        list_ans.append(raw_data[i + 1])


#print([hex(x) for x in list_f4])
#print([hex(x) for x in list_01])
#rint(len(list_ans) - 1)
#print(len(list_f4) - 1)
#print(len(list_01) - 1)

list =""
len = len(list_ans) - 1#42
#print(len)

a=125
for i in range(len):
    a=(list_ans[len]^(a+list_01[len]))-list_f4[len*2]-list_f4[len*2+1]-list_f4[len*2]
    list+=chr(a)
    len-=1
flag=list[::-1]
print("mi"+flag+"}",end=" ")

#下面也是爆破，也是可以参考的一份思路
'''
flag = "mi"
ll = 0x74632DB5
for i in range(43):
        succeed = False
        for c in range(0,256):
                aa = c
                temp_ll = ll + list_f4[i*2] + list_f4[i*2+1]
                aa += list_01[i]
                if aa ^ temp_ll == list_ans[i]:
                        ll = aa
                        flag += chr(c)
                        print(i,flag)
                        succeed  = True
                        break
        if not succeed:
                print("err",i)

                '''

s1gn1n

在字符串列表看到一个base64的字符串，交叉引用就能到主要加密函数，大概的逻辑就是输出字符串，然后将它链表化，中序遍历，然后将中序遍历的结果进行base64编码，然后有个异或，最后就是求和判断返回值是否为零，为零就正确

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111

import base64
from typing import Optional, List, Dict

def get_left_count(n: int) -> int:
    """精确计算完全二叉树左子树节点数"""
    if n <= 0:
        return 0
    h = 1
    while (2 ** (h) - 1) < n:  # 修正高度计算逻辑
        h += 1
    h -= 1  # 实际高度
    last_level = n - (2 ** h - 1)
    left_max = 2 ** (h - 1) if h >= 1 else 0
    left_actual = min(last_level, left_max)
    total = (2 ** (h) - 1) // 2 + left_actual
   #print(f"get_left_count(n={n}) h={h}, last_level={last_level}, left_max={left_max}, left_actual={left_actual}, return {total}")
    return total

def build_level_map(in_order: str, start: int, end: int, level_pos: int, level_map: Dict[int, str], depth=0):
    if start > end:
        #print(f"  {'  '*depth}start={start} > end={end}, return")
        return
    n = end - start + 1
    left_size = get_left_count(n)
    root_pos = start + left_size
   # print(f"{'  '*depth}build_level_map: start={start}, end={end}, n={n}, left_size={left_size}, root_pos={root_pos}, level_pos={level_pos}")
    
    # 边界检查
    if root_pos < start or root_pos > end:
        #print(f"  {'  '*depth}Invalid root_pos={root_pos}, start={start}, end={end}")
        return
    
    level_map[level_pos] = in_order[root_pos]
   # print(f"  {'  '*depth}Mapped level_pos={level_pos} -> char '{in_order[root_pos]}'")
    
    # 递归左子树
    build_level_map(in_order, start, root_pos-1, 2*level_pos+1, level_map, depth+1)
    # 递归右子树
    build_level_map(in_order, root_pos+1, end, 2*level_pos+2, level_map, depth+1)

def in_order_to_level_order(in_order_str: str) -> str:
    level_map: Dict[int, str] = {}
    build_level_map(in_order_str, 0, len(in_order_str)-1, 0, level_map)
    #print("\n层序映射表:", level_map)
    
    if not level_map:
        return ''
    max_index = max(level_map.keys())
    level_order = []
    for i in range(max_index + 1):
        level_order.append(level_map.get(i, ''))
    # 删除末尾的空字符串
    while level_order and level_order[-1] == '':
        level_order.pop()
    return ''.join(level_order)

class Node:
    def __init__(self, value: str):
        self.value = value
        self.left: Optional[Node] = None
        self.right: Optional[Node] = None

def build_tree_from_level_order(level_order: List[str]) -> Optional[Node]:
    if not level_order:
        return None
    root = Node(level_order[0])
    queue = [root]
    i = 1
    while queue and i < len(level_order):
        current = queue.pop(0)
        # 处理左子节点
        if i < len(level_order) and level_order[i]:
            current.left = Node(level_order[i])
            queue.append(current.left)
        i += 1
        # 处理右子节点
        if i < len(level_order) and level_order[i]:
            current.right = Node(level_order[i])
            queue.append(current.right)
        i += 1
    return root

def in_order_traversal(root: Optional[Node], result: List[str]):
    if root:
        in_order_traversal(root.left, result)
        result.append(root.value)
        in_order_traversal(root.right, result)



XOR_DATA = [
    0x58, 0x69, 0x7B, 0x06, 0x1E, 0x38, 0x2C, 0x20, 0x04, 0x0F, 0x01, 0x07, 0x31, 0x6B, 0x08, 0x0E,
    0x7A, 0x0A, 0x72, 0x72, 0x26, 0x37, 0x6F, 0x49, 0x21, 0x16, 0x11, 0x2F, 0x1A, 0x0D, 0x3C, 0x1F,
    0x2B, 0x32, 0x1A, 0x34, 0x37, 0x7F, 0x03, 0x44, 0x16, 0x0E, 0x01, 0x28, 0x1E, 0x68, 0x64, 0x23,
    0x17, 0x09, 0x3D, 0x64, 0x6A, 0x69, 0x63, 0x18, 0x18, 0x0A, 0x15, 0x70
]
char_list = []  
char_list.append(chr(XOR_DATA[0])) 
for j in range(1, len(XOR_DATA)):  
    XOR_DATA[j]=XOR_DATA[j] ^ XOR_DATA[j - 1]
    char_list.append(chr(XOR_DATA[j] ))  

result = ''.join(char_list) #X1JLRjFfbmlkZ197MG5GaV9pQGVycnRMfTNzM21ucmlDZ2VubkV2X1RJRXM=
#print(result)  
dec = base64.b64decode(result)
#print(dec)
#b'_RKF1_nidg_{0nFi_i@errtL}3s3mnriCgennEv_TIEs'
dec ="_RKF1_nidg_{0nFi_i@errtL}3s3mnriCgennEv_TIEs"
a1 = in_order_to_level_order(dec)
print(a1)
#miniLCTF{esrevER_gnir33nignE_Is_K1nd_0F_@rt}
MiniL
Licensed under CC BY-NC-SA 4.0
© 2025 梵殇-fanshanng
前途似海，来日方长。

<