Logo: 2024

len(ROIS_LOGO) * .2024 = 449.5304
default_guarded_getitem # No restrictions可以getattr

也就是把代码长度限制在449以下，可以考虑对 logo 这样加密：

1. 除去所有换行符，这样就只有空格和#了
2. 把所有连续的同种字符的个数记录，变成列表。这样的话，列表中第1个数是#的，第2个数是空格的，第3个数是#的，依次类推。
3. 把这个列表中每个数和96（0x60）异或，变成bytes，这样大部分都是可见字符，减少长度

这样得到下面的l（为了使得l的长度是偶数，最后加上了一个x60，异或回去表示0个字符，不会有影响），解密即可。

l=b'\xe0aaa)cbgkababjkshmjcbkiojsfrgchghezdmdldfckefdkcndldvdmdedkdmdldvdncddmcmcmdvdndcdmdlcnetdndccoclcofrdncdcoclcqfpdmddcockdtfmdldecockdvelddkfcndkdxejddihdmdkdzdididicmcldzdidjdhdkcmdzdidkdhdidmdmdididlciefclgoedejcnakilrikma\x7fbNd\x10\x60'
a=''
i=0
c=0
while i<len(l):
    a=a+'#'*(l[i]^96)+' '*(l[i+1]^96)
    i=i+2
i=100
while i<len(a):
    a=a[:i]+'\n'+a[i:]
    i=i+101
logo=a

s1ayth3sp1re

Score>3000 to obtain a flag
找到关键部分

写出解密脚本

public class Main {
    public static void main(String[] args) {
        int[] iArr = {164, 158, 95, 107, 4, 215, 108, 115, 5, 8, 25, 57, 41, 236, 231, 17, 85};
        int[] iArr2 = {246, 221, 11, 45, 127, 148, 45, 36, 70, 73, 78, 8, 98, 141, 140, 112, 40};
        String str = "";
        for (int i = 0; i < iArr.length; i++) {
            str = str + String.valueOf((char) (iArr[i] ^ iArr2[i]));
        }
        System.out.println(str);
        // RCTF{CAWCAW1Kaka}
    }
}

Find a Hacker

翻了一堆东西（扫文件，剪贴板，浏览器balabala）然后走投无路跑了下进程，发现一个idaq64.exe和一个poner.exe，给ida的进程memdump下来放进gimp里一通爆查
idaq64.exe：


poner.exe

0x7e577070        \Users\Administrator\Desktop\enc.til        216
0x7e578330        \Users\Administrator\Desktop\enc.i64        216

拿到了一个二进制，打开ida稍微分析一下，即可写出exp

>>> a = bytes.fromhex("0C0F2B486F5D46536459594B5F475B5B6B5F15165D12766B071B334A67071100")
>>> b = bytes.fromhex("353F4E2B566B746A5D6D6F736C773868596E20213C714F09367D557251322766")
>>> for i in a:
...     print()
KeyboardInterrupt
>>> for i in range(32):
...     print(chr(a[i] ^ b[i]),end='')
...
90ec9629946830c32157ac9b1ff8656f

# 题目没说加RCTF前缀，加上后对了
RCTF{90ec9629946830c32157ac9b1ff8656f}

PPTT

首先，通过Hook VirtualProtect函数，可以注意到程序有动态代码段修改行为，且调用者是RCTF.exe（主程序段），再通过栈回溯可以注意到，strcmp函数被修改，后续调用的strcmp会让第二个参数的一个确定的字节+1。

通过IDA里面的分析，可以了解到，在最后的大IF语句中，有一个strcmp，Str2是用户输入经过打乱后的值（只取11个字节以后），Str1则是字符串常量值，经过动态调试（IDA里面静态无法进行观察），可以发现strcmp对Str1进行了一些修改，通过反着打乱值，并且通过RCTF{}这样的模式，我们可以确定flag是RCTF{sj***emqrp****tyua}，注意，s字符是r字符在strcmp函数中+1而来的。

所以我们可以了解，flag只有7位需要知道了，由于在已知中没有大写字符和数字，我们推测全部都是小写字符（并且如果加上所有字符，那么复杂度是非常大的），下面我们观察对于flag的其他判定规则。

经过反复动态调试和确认后，我们可以注意到上下两个图，v10的LODWORD和HIDWORD分别表示了两个开关，当v10不为0但是v10低位为0的时候，才能通过最后的IF判定，所以我们可以确定，下图第一个if的条件是假的，不能成立的。

拿到打乱的顺序列表后，我们有z3-solver

from z3 import *
from Crypto.Util.number import *
from copy import deepcopy
from typing import List

def solve():
    s = Solver()
    x = z3_create_bvs("x", 3, 64)
    v23 = x[0]
    v24 = x[1]
    v25 = x[2]
    
    v20 = v24 & v23
    v19 = (v24 & v23 | v25 & v23) + 65670
    v18 = (v25 & v23 ^ v25 & v24) - 1131796
    v17 = v24 & v23 ^ v25 & v23
    
    s.add((v24 & v23 & (~(v24 | v23) | v25 & v23 | v25 & v24 & ~v18) | v25 & v24 & v18) != 1732474390)
    s.add((v23 ^ (v20 & ~v18 | v20 & ~v19 | v17 & v19 | v25 & v23 & ~v18)) == 0x400010000622000)
    s.add((v18 ^ (v19 - v20)) == 0x2100A0203EFBB8B)
    s.add((v17 ^ v19 ^ v20) == 0x4083102108E)
    s.add((v19 ^ v17) - v18 == 0x1551566F3C6485ED)
    s.add((v18 ^ v19 ^ v25 & v24) == 0x40836ECAB9A)
    s.add((v17 ^ v20) - v18 == 0x3E51566F3C718563)
    s.add(v23 - v24 == 0x1AEFF6FDFC121BF1)
    s.add((v25 + v24 + v23) % 10 == 8)
    z3_all_bv_is_printable(s, [v23, v24, v25])
    
    v23_s = '*p*qyeam'
    v24_s = 'sT*u{**R'
    v25_s = '}CtF*js*'
    for i in range(8):
        if v23_s[i] != '*':
            s.add(v23 & (0xff << (i*8)) == ord(v23_s[i]) << (i*8))
        if v24_s[i] != '*':
            s.add(v24 & (0xff << (i*8)) == ord(v24_s[i]) << (i*8))
        if v25_s[i] != '*':
            s.add(v25 & (0xff << (i*8)) == ord(v25_s[i]) << (i*8))
    
    # answers
    while s.check() == sat:
        m = s.model()
        z3_exclude(s, x, m)
        result = z3_concat_bv_aslong(x, m).decode()
        sbox = [15, 17, 9, 19, 12, 8, 21, 23, 13, 20, 5, 7, 3, 22, 1, 2, 0, 10, 14, 18, 4, 11, 6, 16]
        assert(len(sbox) == len(result))
        for i in range(len(result)):
            print(result[sbox[i]], end='')
        print('')

# Create BitVectors
def z3_create_bvs(name: str, size: int, bvLen: int):
    x = [BitVec(f"{name}{i}", bvLen) for i in range(size)]
    return x

# Copy var
def z3_copy(var: ExprRef):
    return deepcopy(var)

# exclude curr solve to get all solvers
def z3_exclude(solver: Solver, var: List[BitVecRef], model: ModelRef):
    for i in var:
        solver.add(i != model[i])

# concat bitvec(i32/i64) to a byte array
def z3_concat_bv_aslong(var: List[BitVecRef], model: ModelRef) -> bytes:
    ans = b''
    for i in var:
        ans += long_to_bytes(model[i].as_long())[::-1]
    return ans

# filter: printable
def z3_all_bv_is_printable(solver: Solver, var: List[BitVecRef]) -> None:
    for v in var:
        for i in range(v.size() // 8):
            solver.add((v >> (i*8)) & 0xff >= 0x20)
            solver.add((v >> (i*8)) & 0xff <= 0x7f)

if __name__ == '__main__':
    solve()

bloker_vm

本题相当于一个SEH VM，并且它开了个自己，自己调试自己（通过IDA分析，CreateMutex如果发现已经开了，就走另一个地方，不走正常main函数），不过我们只需要在每个vm handler中下断点，（因为这个程序其实是不存在反调试的，只是异常会让程序跑飞），然后研究输入会如何进行变换即可，通过分析，还好RC4是标准RC4，不过有一个细节点就是，RC4的Key是一个字符串，而最后一个字符是不取的，因为有长度限制，我们即可写出EXP：

from z3 import *
from Crypto.Util.number import *
from copy import deepcopy
from typing import List

def solve():
    s = Solver()
    x = z3_create_bvs('x', 25, 8)
    y = z3_copy(x)
    for i in range(25):
        x[i] ^= 0x7d
        x[i] = (x[i] << 6) | (x[i] >> 2)  & 0x3f

    # a通过动态调试获得，并通过CyberChef进行RC4解密，密钥注意最后一个没有y
    # #https://gchq.github.io/CyberChef/#recipe=RC4(%7B'option':'UTF8','string':'thisisyoursecretke'%7D,'Hex','Hex')&input=ODAwNUUzMkYxODJGQzU4QzI1NzBCQzA1MUM0RkYyMDJFNTNFMDIyRkU1MTFBM0Mw&oeol=NEL
    a = bytes.fromhex("cb8f4ace810788c707c701884606c7028688c744848506c300")
    for i in range(len(a)):
        s.add(a[i] == x[i])
    # result = Z3_get_string_bytes()
    while s.check() == sat:
        m = s.model()
        z3_exclude(s, y, m)
        result = z3_concat_bv_aslong(y, m)
        print(result) 

# Create BitVectors
def z3_create_bvs(name: str, size: int, bvLen: int):
    x = [BitVec(f"{name}{i}", bvLen) for i in range(size)]
    return x

# Copy var
def z3_copy(var: ExprRef):
    return deepcopy(var)

# exclude curr solve to get all solvers
def z3_exclude(solver: Solver, var: List[BitVecRef], model: ModelRef):
    for i in var:
        solver.add(i != model[i])

# concat bitvec(i32/i64) to a byte array
def z3_concat_bv_aslong(var: List[BitVecRef], model: ModelRef) -> bytes:
    ans = b''
    for i in var:
        ans += long_to_bytes(model[i].as_long())[::-1]
    return ans

# filter: printable
def z3_all_bv_is_printable(solver: Solver, var: List[BitVecRef]) -> None:
    for v in var:
        for i in range(v.size() // 8):
            solver.add((v >> (i*8)) & 0xff >= 0x20)
            solver.add((v >> (i*8)) & 0xff <= 0x7f)

if __name__ == '__main__':
    solve()
# b'RCTF{a_baby_debug_bloker}'

re2

这道题是个Linux下的异常处理，但是挺迷惑的
在sub_401210有个base64解码，不过解码规则是第一个4字节解出来三个字节，第二个4字节解出两个字节，依次递减
flag通过r14, r15传到异常处理程序里，然后处理完再通过r13传回来，r13=0的时候就对了
现在问题是调试断不到有效函数里，疑似在库里有额外的长度检查和字符检查之类的
通过eh_frame段的异常处理栈帧来引导加密逻辑的:
$ readelf -wF re2
...
$ readelf -wf re2

在 eh_Frame 的结果里，sub_4011a0的栈回溯里有个tea的sum值2654435769 = 0x9e3779b9，还有几个 OP 是 11223344
感觉是main里触发了异常之后进入的第一个处理逻辑

000000a8 00000000000a0080 00000024 FDE cie=00000088 pc=00000000004011a0..000000000040120b 
  Augmentation data:     48 23 4a 00 
  DW_CFA_advance_loc: 1 to 00000000004011a1 
  DW_CFA_def_cfa_offset: 16 
  DW_CFA_offset: r6 (rbp) at cfa-16 
  DW_CFA_advance_loc: 3 to 00000000004011a4 
  DW_CFA_def_cfa_register: r6 (rbp) 
  DW_CFA_advance_loc: 4 to 00000000004011a8 
  DW_CFA_val_expression: r13 (r13) (DW_OP_lit11; DW_OP_lit22; DW_OP_constu: 33; DW_OP_constu: 44; DW_OP_constu: 2654435769; DW_OP_reg15 (r15); DW_OP_r
eg14 (r14); DW_OP_lit0; DW_OP_pick: 3; DW_OP_skip: 8; DW_OP_le; (Unknown location op 0xae)) 
  DW_CFA_advance_loc1: 89 to 0000000000401201 
  DW_CFA_def_cfa: r7 (rsp) ofs 8 
  DW_CFA_advance_loc: 1 to 0000000000401202 
  DW_CFA_def_cfa: r6 (rbp) ofs 16 
  DW_CFA_nop

https://github.com/go-delve/delve/blob/master/pkg/dwarf/op/opcodes.go
中间有花指令，去了不少花：

from ida_bytes import *

addr = 0x402241
while addr < 0x4A2347:
    addr += 1
    if get_byte(addr) == 0x2F and get_byte(addr + 2) == 0x00:
        patch_length = get_byte(addr + 1)
        patch_start = addr + 3
        for i in range(patch_start, patch_start + patch_length):
            patch_byte(i, 0x96)

找到了 巨大虚拟机

DW_OP_lit11;  # 经过调试，11 22 33 44 为TEA的Key
DW_OP_lit22; 
DW_OP_constu: 33; 
DW_OP_constu: 44; 
DW_OP_constu: 2654435769;  # 注意到这个是标准TEA加密的 delta.
DW_OP_reg15 (r15); 
DW_OP_reg14 (r14); 
DW_OP_lit0; 
DW_OP_pick: 3;  
DW_OP_plus;  
DW_OP_dup; 
DW_OP_pick: 3; 
DW_OP_dup; 
DW_OP_constu: 9246453814144344100; 
DW_OP_constu: 3482419137767051305; 
DW_OP_or; 
DW_OP_swap; 
DW_OP_drop; 
DW_OP_constu: 3355170828548290441; 
DW_OP_constu: 12456870883039105005; 
DW_OP_xor; 
.... 此处省略14w行 不过值得注意的是，后面的左右移动是没有被混淆的，也就是基本上没有垃圾，而左移64次，很容易让人联想到TEA

https://github.com/aclements/libelfin/blob/master/dwarf/expr.cc#L32 这是一个虚拟机实现
清理①下

a = open('clear1.txt').read().split('\n')
before = len(a)
a = [*map(str.strip, a)]
k = 0
cleared = ""
while k < len(a):
    if a[k].startswith('DW_OP_lit0;'):
        cleared += 'DW_OP_constu: 0;\n'
        k+=1
    elif a[k].startswith('DW_OP_lit1;'):
        cleared += 'DW_OP_constu: 1;\n'
        k+=1
    elif a[k].startswith('DW_OP_lit2;'):
        cleared += 'DW_OP_constu: 2;\n'
        k+=1
    elif a[k].startswith('DW_OP_lit3;'):
        cleared += 'DW_OP_constu: 3;\n'
        k+=1
    elif a[k].startswith('DW_OP_lit4;'):
        cleared += 'DW_OP_constu: 4;\n'
        k+=1
    elif a[k].startswith('DW_OP_lit5;'):
        cleared += 'DW_OP_constu: 5;\n'
        k+=1
    elif a[k].startswith('DW_OP_lit6;'):
        cleared += 'DW_OP_constu: 6;\n'
        k+=1
    elif a[k].startswith('DW_OP_constu') and a[k+1].startswith('DW_OP_constu') and a[k+2].startswith('DW_OP_rot') and a[k+3].startswith('DW_OP_drop') and a[k+4].startswith('DW_OP_drop'):
        k+= 5
    elif a[k].startswith('DW_OP_constu') and a[k+1].startswith('DW_OP_constu'):
        if a[k+2].startswith('DW_OP_swap'):
            cleared += a[k+1] +"\n" + a[k]+"\n"
            k += 3
        elif a[k+2].startswith('DW_OP_xor'):
            zz = len('DW_OP_constu: ')
            cleared += 'DW_OP_constu: ' + str(0xffffffffffffffff & (int(a[k][::-1][1:][::-1][zz:]) ^ int(a[k+1][::-1][1:][::-1][zz:])))+ ";\n"
            k += 3
        elif a[k+2].startswith('DW_OP_or'):
            zz = len('DW_OP_constu: ')
            cleared += 'DW_OP_constu: ' + str(0xffffffffffffffff & (int(a[k][::-1][1:][::-1][zz:]) | int(a[k+1][::-1][1:][::-1][zz:])))+ ";\n"
            k += 3
        elif a[k+2].startswith('DW_OP_and'):
            zz = len('DW_OP_constu: ')
            cleared += 'DW_OP_constu: ' + str(0xffffffffffffffff &(int(a[k][::-1][1:][::-1][zz:]) & int(a[k+1][::-1][1:][::-1][zz:])))+ ";\n"
            k += 3
        elif a[k+2].startswith('DW_OP_plus'):
            zz = len('DW_OP_constu: ')
            cleared += 'DW_OP_constu: ' + str(0xffffffffffffffff &(int(a[k][::-1][1:][::-1][zz:]) + int(a[k+1][::-1][1:][::-1][zz:])))+ ";\n"
            k += 3
        elif a[k+2].startswith('DW_OP_minus'):
            zz = len('DW_OP_constu: ')
            cleared += 'DW_OP_constu: ' + str(0xffffffffffffffff &(int(a[k][::-1][1:][::-1][zz:]) - int(a[k+1][::-1][1:][::-1][zz:])))+ ";\n"
            k += 3
        else:
            cleared += a[k] + '\n'
    elif a[k].startswith('DW_OP_constu') and a[k+1].startswith('DW_OP_not'):
        zz = len('DW_OP_constu: ')
        cleared += 'DW_OP_constu: ' + str(0xffffffffffffffff & (~int(a[k][::-1][1:][::-1][zz:]))) + ";\n"
        k += 2
    elif a[k].startswith('DW_OP_constu') and a[k+1].startswith('DW_OP_drop;'):
        k += 2
    elif a[k].startswith('DW_OP_constu') and a[k+1].startswith('DW_OP_swap;') and a[k+2].startswith('DW_OP_drop'):
        cleared += a[k+2] + '\n' + a[k] + '\n'
        k += 3
    elif a[k].startswith('DW_OP_constu') and a[k+1].startswith('DW_OP_dup'):
        zz = len('DW_OP_constu: ')
        cleared += a[k] + '\n' + a[k]  + '\n'
        k += 2
    elif a[k].startswith('DW_OP_dup') and a[k+1].startswith('DW_OP_drop'):
        k += 2
    elif a[k].startswith('DW_OP_rot;') and a[k+1].startswith('DW_OP_drop;') and a[k+2].startswith('DW_OP_drop;'):
        k += 3
    else:
        cleared += a[k] + '\n'
    k+=1

cleared = cleared[::-1][1:][::-1]

after = len(cleared.split('\n'))
print("cleared:", before - after)
cleared.strip() 
# 打开文件进行写入，如果文件不存在将会被创建
with open('clear1.txt', 'w') as file:
    file.write(cleared)

但是如此清理是有问题的，因为bra指令会改程序流程（往前/后跳转的字节数），所以不能这么去，只能通过调试解决：
输入通过硬件断点下断，运行能找到调用的地方，然后跟输入的值，再下硬件断点，然后运行，会跑到vm虚拟机的地方，然后删掉之前的硬件断点就可以开始调试了

通过看字节码的key和deatle猜出是tea加密，在众多垃圾字节里面找到了少量shr和shl，可以通过这个定位加密开始的位置。偶然发现neg只有两个指令，在程序下断点验证发现这里是check。
调试VM的时候，由于vm对xor和add有非常多的垃圾指令，就很难让人定位到中间的那一部分(v0 + sum)，所以指南观察旁边两部分，但是通过多次的动态调试，发现数据在最后2轮的时候有些许不同，在0x1e轮时，数据变了1，刚开始是一位整个加减1，但是发现v0--后，v1变化很大，而给中间括号的里面东西+1后，发现完美符合了结果，然后在最后一轮循环的时候（0x1f）轮，发现数据变化更大，猜测里面可能+2了，加上后，结果完美符合，然后最后在虚拟机指令neg的地方下断点，然后再在add的地方下断点（这样可以防止中间的一堆垃圾指令，感觉就是出题人防止你发现中间的sum旁边不小心加了1），然后就可以看到两个结果加起来，右边是我们魔改tea加密后的值，而左边的值x不知道是干啥的，但是把结果设置为0（总共进行了四次），然后发现就是对的（虚拟机退出后值是0就是答案正确），所以x很显然就是结果的负数，两个加起来为0就是正确，所以就有以下的EXP：

#include <iostream>
#include <stdint.h>

void encrypt(uint64_t* v, uint32_t* k) {
    uint64_t sum = 0;
    uint64_t v0 = v[0], v1 = v[1];
    uint32_t delta = 0x9e3779b9;
    uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];

    for (int i = 0; i < 32; i++) {
        sum += delta;
        if (i == 0x1e)
        {
            v0 += ((v1 << 4) + k0) ^ (v1 + sum + 1) ^ ((v1 >> 5) + k1);
            v1 += ((v0 << 4) + k2) ^ (v0 + sum + 1) ^ ((v0 >> 5) + k3);
        }
        else if (i == 0x1f)
        {
            v0 += ((v1 << 4) + k0) ^ (v1 + sum + 2) ^ ((v1 >> 5) + k1);
            v1 += ((v0 << 4) + k2) ^ (v0 + sum + 2) ^ ((v0 >> 5) + k3);
        }
        else
        {
            v0 += ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
            v1 += ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
        }
    }
    v[0] = v0;
    v[1] = v1;
}

void decrypt(uint64_t* v, uint32_t* k) {
    uint64_t sum = 0;
    uint64_t v0 = v[0], v1 = v[1];
    uint32_t delta = 0x9e3779b9;
    uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];
    for (int i = 0; i < 32; i++) {
        sum += delta;
    }

    for (int i = 31; i >= 0; i--) {
        if (i == 0x1e)
        {
            v1 -= ((v0 << 4) + k2) ^ (v0 + sum + 1) ^ ((v0 >> 5) + k3);
            v0 -= ((v1 << 4) + k0) ^ (v1 + sum + 1) ^ ((v1 >> 5) + k1);
        }
        else if (i == 0x1f)
        {
            v1 -= ((v0 << 4) + k2) ^ (v0 + sum + 2) ^ ((v0 >> 5) + k3);
            v0 -= ((v1 << 4) + k0) ^ (v1 + sum + 2) ^ ((v1 >> 5) + k1);
        }
        else
        {
            v1 -= ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
            v0 -= ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
        }
        sum -= delta;
    }
    v[0] = v0;
    v[1] = v1;
}


int main()
{
    // v的值是从add那边扣出来的，后面加个0是为了方便输出字符串
    uint64_t v[3] = { -(int64_t)0xAD48DD59067C4282 , -(int64_t)0x323F2D5A909AF1A6, 0 };
    // key的值是通过调试，发现在右移/左移后，加上了它们，就是tea的逻辑
    uint32_t k[4] = { 11, 22, 33 ,44 };
    //encrypt(v, k);
    decrypt(v, k);
    std::cout << (unsigned char*)v;
    // We1c0me_7o_RCtF!
    return 0;
}

2048

逆向以及调试可得每次得分最大不能超过当前分数, 并且出一个 2048 就 win 一次, 选择直接当 2048 高手随便玩个几轮, 从 1w 分玩个几轮即可直接干到一伯 w , 得分够了退出即可得 flag .

Noval cython

python3.10 import check_secret help(check_secret)能看到基本函数和数据

Help on module check_secret:

NAME
    check_secret

FUNCTIONS
    POINTER(...)

    addressof(...)
        addressof(C instance) -> integer
        Return the address of the C instance internal buffer

    algorithm1(...)

    algorithm2(...)

    algorithm3(...)

    algorithm4(...)

    algorithm5(...)

    algorithm6(...)

    algorithm7(...)

    algorithm8(...)

    alignment(...)
        alignment(C type) -> integer
        alignment(C instance) -> integer
        Return the alignment requirements of a C instance

    byref(...)
        byref(C instance[, offset=0]) -> byref-object
        Return a pointer lookalike to a C instance, only usable
        as function argument

    check(...)

    encrypt(...)

    get_errno(...)

    pointer(...)

    resize(...)
        Resize the memory buffer of a ctypes instance

    set_errno(...)

    sizeof(...)
        sizeof(C type) -> integer
        sizeof(C instance) -> integer
        Return the size in bytes of a C instance

DATA
    DEFAULT_MODE = 0
    RTLD_GLOBAL = 256
    RTLD_LOCAL = 0
    __test__ = {}
    cdll = <ctypes.LibraryLoader object>
    enc = [1386864498, 2877138732, 1628978326, 881564191, 1437614165, 4227...
    haha = [1272471749, 2262110437, 697301573, 1088211398]
    i = 3
    map = {'add': <built-in function algorithm1>, 'div': <built-in functio...
    memmove = <CFunctionType object>
    memset = <CFunctionType object>
    pydll = <ctypes.LibraryLoader object>
    pythonapi = <PyDLL 'None', handle 7f806481d2e0>
    sbox = [12, 17, 10, 6, 5, 27, 31, 15, 11, 8, 13, 21, 24, 1, 26, 22, 9,...
    xixi = [3540658286, 3391361277, 1321275334, 3918321625]

FILE
    /home/*******/check_secret.cpython-310-x86_64-linux-gnu.so

覆盖encrypt函数，打印参数观察，发现共有8次encrypt,每两次中间会使用sbox打乱顺序
覆盖掉map函数，由于encrypt函数不可直接看，但是map里面的东西是encrypt会进行调用的，所以可以分析出它的算法。通过分析：encrypt函数里会调用algorithm1-8,实际类似一个vm，打log看发现是TEA, Delta是0x12345678

import check_secret
from z3 import *

x = [BitVec(f"x{i}", 8) for i in range(4)]

def myAdd(a, b):
    print(f"{hex(a+b)}={hex(a)}+{hex(b)}")
    return (a+b)
def mySub(a, b):
    print(f"{hex(a-b)}={hex(a)}-{hex(b)}")
    return (a-b)
def myDiv(a, b):
    print(f"{hex(a//b)}={hex(a)}//{hex(b)}")
    return (a//b)
def myXor(a, b):
    print(f"{hex(a^b)}={hex(a)}^{hex(b)}")
    return (a^b)
def myMul(a, b):
    print(f"{hex(a*b)}={hex(a)}*{hex(b)}")
    return (a^b)
def myRsl(a, b):
    print(f"{hex((a<<b) & 0xffffffff)}={hex(a)}<<{hex(b)}")
    return ((a<<b) & 0xffffffff)
def myRsr(a, b):
    print(f"{hex(a>>b & 0xffffffff)}={hex(a)}>>{hex(b)}")
    return ((a>>b) & 0xffffffff)
def myMod(a, b):
    print(f"{hex(a%b)}={hex(a)}%{hex(b)}")
    return (a%b)

check_secret.map['add'] = myAdd
check_secret.map['sub'] = mySub
check_secret.map['div'] = myDiv
check_secret.map['xor'] = myXor
check_secret.map['mul'] = myMul
check_secret.map['rsl'] = myRsl
check_secret.map['rsr'] = myRsr
check_secret.map['mod'] = myMod

check_secret.encrypt([0xaaaaaaaa,0xbbbbbbbb,0xcccccccc,0xdddddddd], check_secret.xixi)
# print(check_secret.check('11111111111111111111111111111111'))

0xbbbbbbb0=0xbbbbbbbb<<0x4
0x18ec5e41e=0xbbbbbbb0+0xd30a286e
0xbbbbbbbb=0xbbbbbbbb+0x0
0x1357e5fa5=0x18ec5e41e^0xbbbbbbbb
0x5dddddd=0xbbbbbbbb>>0x5
0xd001eeda=0x5dddddd+0xca2410fd
0x1e57fb17f=0x1357e5fa5^0xd001eeda
0x2902a5c29=0xaaaaaaaa+0x1e57fb17f
0x12345678=0x0+0x12345678
0x2a5c290=0x902a5c29<<0x4
0x5166d256=0x2a5c290+0x4ec10fc6
0xa25eb2a1=0x902a5c29+0x12345678
0xf33860f7=0x5166d256^0xa25eb2a1
....
0x10411dd45=0x1e96dd8b3^0xed7c05f6
0x1d6f673f6=0xd2e496b1+0x10411dd45

对此我写了一个脚本来简化逻辑

s = open('./vmtrace.log').read()

cleared = s.split('\n')
clear = []
for i in range(len(cleared)):
    a, b = cleared[i].split('=')
    clear += [(a, b)]

finalList = []
for i, v in enumerate(clear):
    targ, expr = v
    replaced = False
    for j in range(i+1, len(clear)):
        a, b = clear[j]
        if b.find(targ) != -1:
            replaced = True
            b = b.replace(targ, "(" + expr + ")")
            clear[j] = a, b
    if not replaced:
        finalList.append((targ, expr))

for i in finalList:
    print(i)

得到简化的逻辑

('0x2902a5c29', '0xaaaaaaaa+(((((0xbbbbbbbb+0x0)<<0x4)+0xd30a286e)^(0xbbbbbbbb+0x0))^(((0xbbbbbbbb+0x0)>>0x5)+0xca2410fd))')
('0x1ea11d16c', '0x902a5c29+((((((0xbbbbbbbb+0x0)+((((0x902a5c29<<0x4)+0x4ec10fc6)^(0x902a5c29+(0x0+0x12345678)))^((0x902a5c29>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^(((0xbbbbbbbb+0x0)+((((0x902a5c29<<0x4)+0x4ec10fc6)^(0x902a5c29+(0x0+0x12345678)))^((0x902a5c29>>0x5)+0xe98cd7d9)))+(0x0+0x12345678)))^((((0xbbbbbbbb+0x0)+((((0x902a5c29<<0x4)+0x4ec10fc6)^(0x902a5c29+(0x0+0x12345678)))^((0x902a5c29>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd))')
('0x1ea6b44c6', '((0xbbbbbbbb+0x0)+((((0x902a5c29<<0x4)+0x4ec10fc6)^(0x902a5c29+(0x0+0x12345678)))^((0x902a5c29>>0x5)+0xe98cd7d9)))+((((0xea11d16c<<0x4)+0x4ec10fc6)^(0xea11d16c+((0x0+0x12345678)+(0x0+0x12345678))))^((0xea11d16c>>0x5)+0xe98cd7d9))')
('0x1902cbfc7', '0xea11d16c+((((0xea6b44c6<<0x4)+0xd30a286e)^(0xea6b44c6+((0x0+0x12345678)+(0x0+0x12345678))))^((0xea6b44c6>>0x5)+0xca2410fd))')
('0x163b63794', '0xea6b44c6+((((0x902cbfc7<<0x4)+0x4ec10fc6)^(0x902cbfc7+(((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))))^((0x902cbfc7>>0x5)+0xe98cd7d9))')
('0x1e9ac19b2', '0x902cbfc7+((((0x63b63794<<0x4)+0xd30a286e)^(0x63b63794+(((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))))^((0x63b63794>>0x5)+0xca2410fd))')
('0x18edc1966', '0x63b63794+((((0xe9ac19b2<<0x4)+0x4ec10fc6)^(0xe9ac19b2+((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xe9ac19b2>>0x5)+0xe98cd7d9))')
('0x2c3a855f2', '0xe9ac19b2+((((0x8edc1966<<0x4)+0xd30a286e)^(0x8edc1966+((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x8edc1966>>0x5)+0xca2410fd))')
('0x2071e8b8a', '0x8edc1966+((((0xc3a855f2<<0x4)+0x4ec10fc6)^(0xc3a855f2+(((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xc3a855f2>>0x5)+0xe98cd7d9))')
('0x2b03435a7', '0xc3a855f2+((((0x71e8b8a<<0x4)+0xd30a286e)^(0x71e8b8a+(((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x71e8b8a>>0x5)+0xca2410fd))')
('0x1a782bb51', '0x71e8b8a+((((0xb03435a7<<0x4)+0x4ec10fc6)^(0xb03435a7+((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xb03435a7>>0x5)+0xe98cd7d9))')
('0x1411d6f2f', '0xb03435a7+((((0xa782bb51<<0x4)+0xd30a286e)^(0xa782bb51+((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xa782bb51>>0x5)+0xca2410fd))')
('0x2d8f9ed17', '(0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))+(((((0x411d6f2f+(((((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^((0x411d6f2f+(((((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))+((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x411d6f2f+(((((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9))')
('0x1ba5af061', '(0x411d6f2f+(((((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0xa782bb51+((((0x411d6f2f<<0x4)+0x4ec10fc6)^(0x411d6f2f+(((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x411d6f2f>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))+((((0xd8f9ed17<<0x4)+0xd30a286e)^(0xd8f9ed17+((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xd8f9ed17>>0x5)+0xca2410fd))')
('0x21e182d2a', '0xd8f9ed17+((((0xba5af061<<0x4)+0x4ec10fc6)^(0xba5af061+(((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xba5af061>>0x5)+0xe98cd7d9))')
('0x278d20e6b', '0xba5af061+((((0x1e182d2a<<0x4)+0xd30a286e)^(0x1e182d2a+(((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x1e182d2a>>0x5)+0xca2410fd))')
('0x136881e4b', '0x1e182d2a+((((0x78d20e6b<<0x4)+0x4ec10fc6)^(0x78d20e6b+((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x78d20e6b>>0x5)+0xe98cd7d9))')
('0x195993075', '0x78d20e6b+((((0x36881e4b<<0x4)+0xd30a286e)^(0x36881e4b+((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x36881e4b>>0x5)+0xca2410fd))')
('0x1523d7022', '0x36881e4b+((((0x95993075<<0x4)+0x4ec10fc6)^(0x95993075+(((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x95993075>>0x5)+0xe98cd7d9))')
('0x1b5c3222f', '0x95993075+((((0x523d7022<<0x4)+0xd30a286e)^(0x523d7022+(((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x523d7022>>0x5)+0xca2410fd))')
('0x2283c5db5', '0x523d7022+((((0xb5c3222f<<0x4)+0x4ec10fc6)^(0xb5c3222f+((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xb5c3222f>>0x5)+0xe98cd7d9))')
('0x154c8bd30', '0xb5c3222f+((((0x283c5db5<<0x4)+0xd30a286e)^(0x283c5db5+((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x283c5db5>>0x5)+0xca2410fd))')
('0x15e4b3c01', '0x283c5db5+((((0x54c8bd30<<0x4)+0x4ec10fc6)^(0x54c8bd30+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x54c8bd30>>0x5)+0xe98cd7d9))')
('0x22cd286c5', '0x5e4b3c01+(((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9))')
('0x111111108', '((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678)')
('0x2175de85a', '((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+(((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+0x11111108))^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd))')
('0x17f922c05', '((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))+(((((0x175de85a+((((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))+(0x11111108+(0x0+0x12345678))))^((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^((0x175de85a+((((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))+(0x11111108+(0x0+0x12345678))))^((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))+((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x175de85a+((((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))+(0x11111108+(0x0+0x12345678))))^((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9))')
('0x24128629a', '(0x175de85a+((((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))+(0x11111108+(0x0+0x12345678))))^((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+0xd30a286e)^(0x5e4b3c01+(((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x5e4b3c01>>0x5)+0xca2410fd)))+((((0x2cd286c5<<0x4)+0xd30a286e)^(0x2cd286c5+((((((((((((((0x0+0x12345678)+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cd286c5>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9)))+((((0x175de85a<<0x4)+0x4ec10fc6)^(0x175de85a+(0x11111108+(0x0+0x12345678))))^((0x175de85a>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))+((((0x7f922c05<<0x4)+0xd30a286e)^(0x7f922c05+((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))))^((0x7f922c05>>0x5)+0xca2410fd))')
('0x12cfddbd3', '0x4128629a+(((((0x7f922c05+((((0x4128629a<<0x4)+0x4ec10fc6)^(0x4128629a+(((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x4128629a>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x7f922c05+((((0x4128629a<<0x4)+0x4ec10fc6)^(0x4128629a+(((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x4128629a>>0x5)+0xe98cd7d9)))+(((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x7f922c05+((((0x4128629a<<0x4)+0x4ec10fc6)^(0x4128629a+(((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x4128629a>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd))')
('0x1f423cd80', '(0x7f922c05+((((0x4128629a<<0x4)+0x4ec10fc6)^(0x4128629a+(((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x4128629a>>0x5)+0xe98cd7d9)))+((((0x2cfddbd3<<0x4)+0x4ec10fc6)^(0x2cfddbd3+((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2cfddbd3>>0x5)+0xe98cd7d9))')
('0x1fe53ddb7', '0xf423cd80+(((((0x2cfddbd3+((((0xf423cd80<<0x4)+0xd30a286e)^(0xf423cd80+((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xf423cd80>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^((0x2cfddbd3+((((0xf423cd80<<0x4)+0xd30a286e)^(0xf423cd80+((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xf423cd80>>0x5)+0xca2410fd)))+(((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x2cfddbd3+((((0xf423cd80<<0x4)+0xd30a286e)^(0xf423cd80+((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xf423cd80>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9))')
('0x211bc9ede', '0xfe53ddb7+((((((0x2cfddbd3+((((0xf423cd80<<0x4)+0xd30a286e)^(0xf423cd80+((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xf423cd80>>0x5)+0xca2410fd)))+((((0xfe53ddb7<<0x4)+0xd30a286e)^(0xfe53ddb7+(((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xfe53ddb7>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^(((0x2cfddbd3+((((0xf423cd80<<0x4)+0xd30a286e)^(0xf423cd80+((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xf423cd80>>0x5)+0xca2410fd)))+((((0xfe53ddb7<<0x4)+0xd30a286e)^(0xfe53ddb7+(((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xfe53ddb7>>0x5)+0xca2410fd)))+((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((((0x2cfddbd3+((((0xf423cd80<<0x4)+0xd30a286e)^(0xf423cd80+((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xf423cd80>>0x5)+0xca2410fd)))+((((0xfe53ddb7<<0x4)+0xd30a286e)^(0xfe53ddb7+(((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xfe53ddb7>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9))')
('0x16c187b70', '((0x2cfddbd3+((((0xf423cd80<<0x4)+0xd30a286e)^(0xf423cd80+((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xf423cd80>>0x5)+0xca2410fd)))+((((0xfe53ddb7<<0x4)+0xd30a286e)^(0xfe53ddb7+(((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xfe53ddb7>>0x5)+0xca2410fd)))+((((0x11bc9ede<<0x4)+0xd30a286e)^(0x11bc9ede+((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x11bc9ede>>0x5)+0xca2410fd))')
('0x111ef5390', '0x11bc9ede+((((0x6c187b70<<0x4)+0x4ec10fc6)^(0x6c187b70+(((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x6c187b70>>0x5)+0xe98cd7d9))')
('0x1053aa687', '0x6c187b70+((((0x11ef5390<<0x4)+0xd30a286e)^(0x11ef5390+(((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x11ef5390>>0x5)+0xca2410fd))')
('0x14a3f0e60', '(0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))+(((((0x53aa687+(((((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^((0x53aa687+(((((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))+(((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x53aa687+(((((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9))')
('0x212dd8d34', '(0x53aa687+(((((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x11ef5390+((((0x53aa687<<0x4)+0x4ec10fc6)^(0x53aa687+((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x53aa687>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))+((((0x4a3f0e60<<0x4)+0xd30a286e)^(0x4a3f0e60+(((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x4a3f0e60>>0x5)+0xca2410fd))')
('0x22d62c152', '(0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))+(((((0x12dd8d34+(((((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^((0x12dd8d34+(((((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))+(((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x12dd8d34+(((((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9))')
('0x13c3ff952', '(0x12dd8d34+(((((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x4a3f0e60+((((0x12dd8d34<<0x4)+0x4ec10fc6)^(0x12dd8d34+((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x12dd8d34>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd)))+((((0x2d62c152<<0x4)+0xd30a286e)^(0x2d62c152+(((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x2d62c152>>0x5)+0xca2410fd))')  
('0x10bce2611', '0x2d62c152+((((0x3c3ff952<<0x4)+0x4ec10fc6)^(0x3c3ff952+((((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x3c3ff952>>0x5)+0xe98cd7d9))')
('0x1ee7d493c', '0x3c3ff952+((((0xbce2611<<0x4)+0xd30a286e)^(0xbce2611+((((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xbce2611>>0x5)+0xca2410fd))')
('0x1a35b9c36', '0xee7d493c+(((((0xbce2611+((((0xee7d493c<<0x4)+0x4ec10fc6)^(0xee7d493c+(((((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xee7d493c>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0xbce2611+((((0xee7d493c<<0x4)+0x4ec10fc6)^(0xee7d493c+(((((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xee7d493c>>0x5)+0xe98cd7d9)))+(((((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^(((0xbce2611+((((0xee7d493c<<0x4)+0x4ec10fc6)^(0xee7d493c+(((((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xee7d493c>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd))')
('0x10fedcb98', '(((((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678)')
('0x11106065b', '(0xbce2611+((((0xee7d493c<<0x4)+0x4ec10fc6)^(0xee7d493c+(((((((((((((0x11111108+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0xee7d493c>>0x5)+0xe98cd7d9)))+((((0xa35b9c36<<0x4)+0x4ec10fc6)^(0xa35b9c36+0xfedcb98))^((0xa35b9c36>>0x5)+0xe98cd7d9))')
('0x148954659', '0x1106065b+(((((0xa35b9c36+((((0x1106065b<<0x4)+0xd30a286e)^(0x1106065b+0xfedcb98))^((0x1106065b>>0x5)+0xca2410fd)))<<0x4)+0x4ec10fc6)^((0xa35b9c36+((((0x1106065b<<0x4)+0xd30a286e)^(0x1106065b+0xfedcb98))^((0x1106065b>>0x5)+0xca2410fd)))+(0xfedcb98+(0x0+0x12345678))))^(((0xa35b9c36+((((0x1106065b<<0x4)+0xd30a286e)^(0x1106065b+0xfedcb98))^((0x1106065b>>0x5)+0xca2410fd)))>>0x5)+0xe98cd7d9))')
('0x2a71219b0', '(0xa35b9c36+((((0x1106065b<<0x4)+0xd30a286e)^(0x1106065b+0xfedcb98))^((0x1106065b>>0x5)+0xca2410fd)))+((((0x48954659<<0x4)+0xd30a286e)^(0x48954659+(0xfedcb98+(0x0+0x12345678))))^((0x48954659>>0x5)+0xca2410fd))')
('0x17de5c3a5', '0xa71219b0+(((((0x48954659+((((0xa71219b0<<0x4)+0x4ec10fc6)^(0xa71219b0+((0xfedcb98+(0x0+0x12345678))+(0x0+0x12345678))))^((0xa71219b0>>0x5)+0xe98cd7d9)))<<0x4)+0xd30a286e)^((0x48954659+((((0xa71219b0<<0x4)+0x4ec10fc6)^(0xa71219b0+((0xfedcb98+(0x0+0x12345678))+(0x0+0x12345678))))^((0xa71219b0>>0x5)+0xe98cd7d9)))+((0xfedcb98+(0x0+0x12345678))+(0x0+0x12345678))))^(((0x48954659+((((0xa71219b0<<0x4)+0x4ec10fc6)^(0xa71219b0+((0xfedcb98+(0x0+0x12345678))+(0x0+0x12345678))))^((0xa71219b0>>0x5)+0xe98cd7d9)))>>0x5)+0xca2410fd))')
('0x1d6f673f6', '(0x48954659+((((0xa71219b0<<0x4)+0x4ec10fc6)^(0xa71219b0+((0xfedcb98+(0x0+0x12345678))+(0x0+0x12345678))))^((0xa71219b0>>0x5)+0xe98cd7d9)))+((((0x7de5c3a5<<0x4)+0x4ec10fc6)^(0x7de5c3a5+(((0xfedcb98+(0x0+0x12345678))+(0x0+0x12345678))+(0x0+0x12345678))))^((0x7de5c3a5>>0x5)+0xe98cd7d9))')

再手动处理一下得到

('0x2902a5c29', 'v1+(((((b2+0x0)<<0x4)+k1)^(b2+0x0))^(((b2+0x0)>>0x5)+k2))')
('0x1ea11d16c', '0x902a5c29+((((((b2+0x0)+((((0x902a5c29<<0x4)+k3)^(0x902a5c29+delta))^((0x902a5c29>>0x5)+k4)))<<0x4)+k1)^(((b2+0x0)+((((0x902a5c29<<0x4)+k3)^(0x902a5c29+delta))^((0x902a5c29>>0x5)+k4)))+delta))^((((b2+0x0)+((((0x902a5c29<<0x4)+k3)^(0x902a5c29+delta))^((0x902a5c29>>0x5)+k4)))>>0x5)+k2))')
('0x1ea6b44c6', '((b2+0x0)+((((0x902a5c29<<0x4)+k3)^(0x902a5c29+delta))^((0x902a5c29>>0x5)+k4)))+((((0xea11d16c<<0x4)+k3)^(0xea11d16c+(delta+delta)))^((0xea11d16c>>0x5)+k4))')
('0x1902cbfc7', '0xea11d16c+((((0xea6b44c6<<0x4)+k1)^(0xea6b44c6+(delta+delta)))^((0xea6b44c6>>0x5)+k2))')
('0x163b63794', '0xea6b44c6+((((0x902cbfc7<<0x4)+k3)^(0x902cbfc7+((delta+delta)+delta)))^((0x902cbfc7>>0x5)+k4))')
('0x1e9ac19b2', '0x902cbfc7+((((0x63b63794<<0x4)+k1)^(0x63b63794+((delta+delta)+delta)))^((0x63b63794>>0x5)+k2))')
('0x18edc1966', '0x63b63794+((((0xe9ac19b2<<0x4)+k3)^(0xe9ac19b2+(((delta+delta)+delta)+delta)))^((0xe9ac19b2>>0x5)+k4))')
('0x2c3a855f2', '0xe9ac19b2+((((0x8edc1966<<0x4)+k1)^(0x8edc1966+(((delta+delta)+delta)+delta)))^((0x8edc1966>>0x5)+k2))')
('0x2071e8b8a', '0x8edc1966+((((0xc3a855f2<<0x4)+k3)^(0xc3a855f2+((((delta+delta)+delta)+delta)+delta)))^((0xc3a855f2>>0x5)+k4))')
('0x2b03435a7', '0xc3a855f2+((((0x71e8b8a<<0x4)+k1)^(0x71e8b8a+((((delta+delta)+delta)+delta)+delta)))^((0x71e8b8a>>0x5)+k2))')
('0x1a782bb51', '0x71e8b8a+((((0xb03435a7<<0x4)+k3)^(0xb03435a7+(((((delta+delta)+delta)+delta)+delta)+delta)))^((0xb03435a7>>0x5)+k4))')
('0x1411d6f2f', '0xb03435a7+((((0xa782bb51<<0x4)+k1)^(0xa782bb51+(((((delta+delta)+delta)+delta)+delta)+delta)))^((0xa782bb51>>0x5)+k2))')
('0x2d8f9ed17', '(0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))+(((((0x411d6f2f+(((((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))<<0x4)+k1)^((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^(((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))>>0x5)+k2)))<<0x4)+k3)^((0x411d6f2f+(((((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))<<0x4)+k1)^((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^(((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))>>0x5)+k2)))+(((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x411d6f2f+(((((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))<<0x4)+k1)^((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^(((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))>>0x5)+k2)))>>0x5)+k4))')
('0x1ba5af061', '(0x411d6f2f+(((((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))<<0x4)+k1)^((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^(((0xa782bb51+((((0x411d6f2f<<0x4)+k3)^(0x411d6f2f+((((((delta+delta)+delta)+delta)+delta)+delta)+delta)))^((0x411d6f2f>>0x5)+k4)))>>0x5)+k2)))+((((0xd8f9ed17<<0x4)+k1)^(0xd8f9ed17+(((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0xd8f9ed17>>0x5)+k2))')
('0x21e182d2a', '0xd8f9ed17+((((0xba5af061<<0x4)+k3)^(0xba5af061+((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0xba5af061>>0x5)+k4))')
('0x278d20e6b', '0xba5af061+((((0x1e182d2a<<0x4)+k1)^(0x1e182d2a+((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x1e182d2a>>0x5)+k2))')
('0x136881e4b', '0x1e182d2a+((((0x78d20e6b<<0x4)+k3)^(0x78d20e6b+(((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x78d20e6b>>0x5)+k4))')
('0x195993075', '0x78d20e6b+((((0x36881e4b<<0x4)+k1)^(0x36881e4b+(((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x36881e4b>>0x5)+k2))')
('0x1523d7022', '0x36881e4b+((((0x95993075<<0x4)+k3)^(0x95993075+((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x95993075>>0x5)+k4))')
('0x1b5c3222f', '0x95993075+((((0x523d7022<<0x4)+k1)^(0x523d7022+((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x523d7022>>0x5)+k2))')
('0x2283c5db5', '0x523d7022+((((0xb5c3222f<<0x4)+k3)^(0xb5c3222f+(((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0xb5c3222f>>0x5)+k4))')
('0x154c8bd30', '0xb5c3222f+((((0x283c5db5<<0x4)+k1)^(0x283c5db5+(((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x283c5db5>>0x5)+k2))')
('0x15e4b3c01', '0x283c5db5+((((0x54c8bd30<<0x4)+k3)^(0x54c8bd30+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x54c8bd30>>0x5)+k4))')
('0x22cd286c5', '0x5e4b3c01+(((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))<<0x4)+k3)^((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))>>0x5)+k4))')
('0x111111108', '(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta')
('0x2175de85a', '((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+(((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))<<0x4)+k1)^((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+0x11111108))^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))>>0x5)+k2))')
('0x17f922c05', '((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))+(((((0x175de85a+((((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))<<0x4)+k1)^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))+(0x11111108+delta)))^((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))>>0x5)+k2)))<<0x4)+k3)^((0x175de85a+((((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))<<0x4)+k1)^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))+(0x11111108+delta)))^((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))>>0x5)+k2)))+((0x11111108+delta)+delta)))^(((0x175de85a+((((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))<<0x4)+k1)^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))+(0x11111108+delta)))^((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))>>0x5)+k2)))>>0x5)+k4))')
('0x24128629a', '(0x175de85a+((((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))<<0x4)+k1)^(((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))+(0x11111108+delta)))^((((0x2cd286c5+((((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))<<0x4)+k3)^(((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))+0x11111108))^((((0x54c8bd30+((((0x5e4b3c01<<0x4)+k1)^(0x5e4b3c01+((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x5e4b3c01>>0x5)+k2)))+((((0x2cd286c5<<0x4)+k1)^(0x2cd286c5+(((((((((((((delta+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2cd286c5>>0x5)+k2)))>>0x5)+k4)))+((((0x175de85a<<0x4)+k3)^(0x175de85a+(0x11111108+delta)))^((0x175de85a>>0x5)+k4)))>>0x5)+k2)))+((((0x7f922c05<<0x4)+k1)^(0x7f922c05+((0x11111108+delta)+delta)))^((0x7f922c05>>0x5)+k2))')
('0x12cfddbd3', '0x4128629a+(((((0x7f922c05+((((0x4128629a<<0x4)+k3)^(0x4128629a+(((0x11111108+delta)+delta)+delta)))^((0x4128629a>>0x5)+k4)))<<0x4)+k1)^((0x7f922c05+((((0x4128629a<<0x4)+k3)^(0x4128629a+(((0x11111108+delta)+delta)+delta)))^((0x4128629a>>0x5)+k4)))+(((0x11111108+delta)+delta)+delta)))^(((0x7f922c05+((((0x4128629a<<0x4)+k3)^(0x4128629a+(((0x11111108+delta)+delta)+delta)))^((0x4128629a>>0x5)+k4)))>>0x5)+k2))')
('0x1f423cd80', '(0x7f922c05+((((0x4128629a<<0x4)+k3)^(0x4128629a+(((0x11111108+delta)+delta)+delta)))^((0x4128629a>>0x5)+k4)))+((((0x2cfddbd3<<0x4)+k3)^(0x2cfddbd3+((((0x11111108+delta)+delta)+delta)+delta)))^((0x2cfddbd3>>0x5)+k4))')
('0x1fe53ddb7', '0xf423cd80+(((((0x2cfddbd3+((((0xf423cd80<<0x4)+k1)^(0xf423cd80+((((0x11111108+delta)+delta)+delta)+delta)))^((0xf423cd80>>0x5)+k2)))<<0x4)+k3)^((0x2cfddbd3+((((0xf423cd80<<0x4)+k1)^(0xf423cd80+((((0x11111108+delta)+delta)+delta)+delta)))^((0xf423cd80>>0x5)+k2)))+(((((0x11111108+delta)+delta)+delta)+delta)+delta)))^(((0x2cfddbd3+((((0xf423cd80<<0x4)+k1)^(0xf423cd80+((((0x11111108+delta)+delta)+delta)+delta)))^((0xf423cd80>>0x5)+k2)))>>0x5)+k4))')
('0x211bc9ede', '0xfe53ddb7+((((((0x2cfddbd3+((((0xf423cd80<<0x4)+k1)^(0xf423cd80+((((0x11111108+delta)+delta)+delta)+delta)))^((0xf423cd80>>0x5)+k2)))+((((0xfe53ddb7<<0x4)+k1)^(0xfe53ddb7+(((((0x11111108+delta)+delta)+delta)+delta)+delta)))^((0xfe53ddb7>>0x5)+k2)))<<0x4)+k3)^(((0x2cfddbd3+((((0xf423cd80<<0x4)+k1)^(0xf423cd80+((((0x11111108+delta)+delta)+delta)+delta)))^((0xf423cd80>>0x5)+k2)))+((((0xfe53ddb7<<0x4)+k1)^(0xfe53ddb7+(((((0x11111108+delta)+delta)+delta)+delta)+delta)))^((0xfe53ddb7>>0x5)+k2)))+((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)))^((((0x2cfddbd3+((((0xf423cd80<<0x4)+k1)^(0xf423cd80+((((0x11111108+delta)+delta)+delta)+delta)))^((0xf423cd80>>0x5)+k2)))+((((0xfe53ddb7<<0x4)+k1)^(0xfe53ddb7+(((((0x11111108+delta)+delta)+delta)+delta)+delta)))^((0xfe53ddb7>>0x5)+k2)))>>0x5)+k4))')
('0x16c187b70', '((0x2cfddbd3+((((0xf423cd80<<0x4)+k1)^(0xf423cd80+((((0x11111108+delta)+delta)+delta)+delta)))^((0xf423cd80>>0x5)+k2)))+((((0xfe53ddb7<<0x4)+k1)^(0xfe53ddb7+(((((0x11111108+delta)+delta)+delta)+delta)+delta)))^((0xfe53ddb7>>0x5)+k2)))+((((0x11bc9ede<<0x4)+k1)^(0x11bc9ede+((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)))^((0x11bc9ede>>0x5)+k2))')
('0x111ef5390', '0x11bc9ede+((((0x6c187b70<<0x4)+k3)^(0x6c187b70+(((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x6c187b70>>0x5)+k4))')
('0x1053aa687', '0x6c187b70+((((0x11ef5390<<0x4)+k1)^(0x11ef5390+(((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x11ef5390>>0x5)+k2))')
('0x14a3f0e60', '(0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))+(((((0x53aa687+(((((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))<<0x4)+k1)^((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))>>0x5)+k2)))<<0x4)+k3)^((0x53aa687+(((((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))<<0x4)+k1)^((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))>>0x5)+k2)))+(((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x53aa687+(((((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))<<0x4)+k1)^((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))>>0x5)+k2)))>>0x5)+k4))')
('0x212dd8d34', '(0x53aa687+(((((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))<<0x4)+k1)^((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x11ef5390+((((0x53aa687<<0x4)+k3)^(0x53aa687+((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x53aa687>>0x5)+k4)))>>0x5)+k2)))+((((0x4a3f0e60<<0x4)+k1)^(0x4a3f0e60+(((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x4a3f0e60>>0x5)+k2))')
('0x22d62c152', '(0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))+(((((0x12dd8d34+(((((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))<<0x4)+k1)^((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))>>0x5)+k2)))<<0x4)+k3)^((0x12dd8d34+(((((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))<<0x4)+k1)^((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))>>0x5)+k2)))+(((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x12dd8d34+(((((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))<<0x4)+k1)^((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))>>0x5)+k2)))>>0x5)+k4))')
('0x13c3ff952', '(0x12dd8d34+(((((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))<<0x4)+k1)^((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0x4a3f0e60+((((0x12dd8d34<<0x4)+k3)^(0x12dd8d34+((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x12dd8d34>>0x5)+k4)))>>0x5)+k2)))+((((0x2d62c152<<0x4)+k1)^(0x2d62c152+(((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x2d62c152>>0x5)+k2))')  
('0x10bce2611', '0x2d62c152+((((0x3c3ff952<<0x4)+k3)^(0x3c3ff952+((((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0x3c3ff952>>0x5)+k4))')
('0x1ee7d493c', '0x3c3ff952+((((0xbce2611<<0x4)+k1)^(0xbce2611+((((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0xbce2611>>0x5)+k2))')
('0x1a35b9c36', '0xee7d493c+(((((0xbce2611+((((0xee7d493c<<0x4)+k3)^(0xee7d493c+(((((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0xee7d493c>>0x5)+k4)))<<0x4)+k1)^((0xbce2611+((((0xee7d493c<<0x4)+k3)^(0xee7d493c+(((((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0xee7d493c>>0x5)+k4)))+(((((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^(((0xbce2611+((((0xee7d493c<<0x4)+k3)^(0xee7d493c+(((((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0xee7d493c>>0x5)+k4)))>>0x5)+k2))')
('0x10fedcb98', '(((((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta')
('0x11106065b', '(0xbce2611+((((0xee7d493c<<0x4)+k3)^(0xee7d493c+(((((((((((((0x11111108+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)+delta)))^((0xee7d493c>>0x5)+k4)))+((((0xa35b9c36<<0x4)+k3)^(0xa35b9c36+0xfedcb98))^((0xa35b9c36>>0x5)+k4))')
('0x148954659', '0x1106065b+(((((0xa35b9c36+((((0x1106065b<<0x4)+k1)^(0x1106065b+0xfedcb98))^((0x1106065b>>0x5)+k2)))<<0x4)+k3)^((0xa35b9c36+((((0x1106065b<<0x4)+k1)^(0x1106065b+0xfedcb98))^((0x1106065b>>0x5)+k2)))+(0xfedcb98+delta)))^(((0xa35b9c36+((((0x1106065b<<0x4)+k1)^(0x1106065b+0xfedcb98))^((0x1106065b>>0x5)+k2)))>>0x5)+k4))')
('0x2a71219b0', '(0xa35b9c36+((((0x1106065b<<0x4)+k1)^(0x1106065b+0xfedcb98))^((0x1106065b>>0x5)+k2)))+((((0x48954659<<0x4)+k1)^(0x48954659+(0xfedcb98+delta)))^((0x48954659>>0x5)+k2))')
('0x17de5c3a5', '0xa71219b0+(((((0x48954659+((((0xa71219b0<<0x4)+k3)^(0xa71219b0+((0xfedcb98+delta)+delta)))^((0xa71219b0>>0x5)+k4)))<<0x4)+k1)^((0x48954659+((((0xa71219b0<<0x4)+k3)^(0xa71219b0+((0xfedcb98+delta)+delta)))^((0xa71219b0>>0x5)+k4)))+((0xfedcb98+delta)+delta)))^(((0x48954659+((((0xa71219b0<<0x4)+k3)^(0xa71219b0+((0xfedcb98+delta)+delta)))^((0xa71219b0>>0x5)+k4)))>>0x5)+k2))')
('0x1d6f673f6', '(0x48954659+((((0xa71219b0<<0x4)+k3)^(0xa71219b0+((0xfedcb98+delta)+delta)))^((0xa71219b0>>0x5)+k4)))+((((0x7de5c3a5<<0x4)+k3)^(0x7de5c3a5+(((0xfedcb98+delta)+delta)+delta)))^((0x7de5c3a5>>0x5)+k4))')

中间断掉的过程，很可能是程序内部自己进行的加法运算，不过已经问题不大了。

有很明显的TEA的逻辑，我们可以得到

delta = 0x12345678
k = ['0xd30a286e', '0xca2410fd', '0x4ec10fc6', '0xe98cd7d9']
这里的k是xixi，当然它加密后还会走一波，以haha作为key

解TEA：

#include <stdint.h>
#include <stdio.h>

void decrypt (uint32_t* v, uint32_t* k) {
    uint32_t v0=v[0], v1=v[1], sum=0x12345678*(32), i;  /* set up */
    uint32_t delta=0x12345678;                     /* a key schedule constant */
    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
    for (i=0; i<32; i++) {                         /* basic cycle start */
        v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
        v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
        sum -= delta;
    }                                              /* end cycle */
    v[0]=v0; v[1]=v1;
}

int main() {
    uint32_t v[] = {1386864498, 2877138732, 1628978326, 881564191, 1437614165, 4227562200, 1606883458, 3679355295};
    uint32_t k1[] = {3540658286, 3391361277, 1321275334, 3918321625}; // xixi 
    uint32_t k2[] = {1272471749, 2262110437, 697301573, 1088211398}; // haha
    for (int i = 0; i < 8; i += 2) {
        decrypt((uint16_t *)v+i, k2);
    } 
    for (int i = 0; i < 8; i += 2) {
        decrypt((uint16_t *)v+i, k1);
    }
    puts(v);
}
// 3t00n3}Cv_l_@l1Cnyh1g0fgt_3{hann

恢复顺序

sbox = [12, 17, 10, 6, 5, 27, 31, 15, 11, 8, 13, 21, 24, 1, 26, 22, 9, 16, 18, 25, 29, 19, 0, 3, 7, 14, 30, 4, 23, 2, 28, 20]
MA = [sbox.index(i) for i in range(32)]
s = "3t00n3}Cv_l_@l1Cnyh1g0fgt_3{hann"
flag = ""
for i in MA:
    flag+=s[i]
print(flag)
# flag{n0t_n0v3l_Cyth0n_Ch@113ng3}

whereThel1b

在kali下运行程序，发现可以运行，然后测试输入，发现长度和base64很像（加新的东西后，长度不一定变长，但是总体稳定增长，且只影响前面后面的结果），构造一个字符串，使得加密后长度和encry数组长度一致，测出来flag长度，测试得到flag{uuid}，然后得到xor表（换输入后发现在长度一致的时候xor表一致），然后解密encry，得到flag，不过并没有对so文件进行研究，或者是对trytry上面一个函数研究，就猜出来结果了。

flag{7f9a2d3c-07de-11ef-be5e-cf1e88674c0b}

gdb_debug

#include <iostream>
#include <cstring>
#include <vector>

void bur(int seed)
{
        srand(seed << (32 - 4));
        char result[] = "congratulationstoyoucongratulationstoy";
        unsigned char byte_62333B8010A0[40] = {
        0xBF, 0xD7, 0x2E, 0xDA, 0xEE, 0xA8, 0x1A, 0x10, 0x83, 0x73, 0xAC, 0xF1, 0x06, 0xBE, 0xAD, 0x88,
        0x04, 0xD7, 0x12, 0xFE, 0xB5, 0xE2, 0x61, 0xB7, 0x3D, 0x07, 0x4A, 0xE8, 0x96, 0xA2, 0x9D, 0x4D,
        0xBC, 0x81, 0x8C, 0xE9, 0x88, 0x78, 0x00, 0x00
        };
        char input[] = "flag{2b838a97ade9f743bb07ce476e02804c}";

        size_t len = strlen(input);
        char* pull1 = (char*)malloc(len);
        char* box = (char*)malloc(len);
        char* pull3 = (char*)malloc(len);

        char r1[38] = {0};
        char r2[38] = {0};
        char r3[38] = {0};
        for (int i = 0; i < len; i++)
        {
                r1[i] = rand();
                // std::cout << "test:r1[i] = " << seed << ' ' << std::hex << (int)r1[i] << std::endl;
        }

        for (size_t k = len - 1; k; --k)
        {
                r2[k] = rand() % (k + 1);
        }


        for (int i = 0; i < len; i++)
        {
                r3[i] = rand();
        }

        // Generate
        for (size_t i = 0; i < len; i++)
                box[i] = i;

        // Generate
        for (size_t i = 0; i < len; i++)
                pull1[i] = input[i] ^ r1[i];


        // Exchange
        for (size_t k = len - 1; k; --k)
        {
                //char s = rand() % (k + 1);
                char c = box[k];
                box[k] = box[r2[k]];
                box[r2[k]] = c;
        }

        for (int i = 0; i < len; i++)
        {
                pull3[i] = pull1[box[i]] ^ r3[i] ^ byte_62333B8010A0[i];
        }




        // Decrypt

        for (int i = 0; i < len; i++)
        {
                pull1[box[i]] = result[i] ^ byte_62333B8010A0[i] ^ r3[i];
        }

        for (size_t i = 0; i < len; i++)
        {
                pull1[i] ^= r1[i];
                putchar(pull1[i]);
        }
        /*

        for (size_t m = 0; ; ++m)
        {
                if (m >= len)
                        break;
                pull3[m] = pull1[box[m]];
        }
        // ^ rand() ^ pull1[m]

        for (size_t m = 0; ; ++m)
        {
                if (m >= len)
                        break;
                pull3[m] = pull1[box[m]] ^ r3[m] ^ byte_62333B8010A0[m];
        }
*/


        // pull3 == congratulationstoyoucongratulationstoy
}


int main()
{
        for (int i = 0; i < 15; i++)
        {
                bur(i);
                std::cout << std::endl;
        }

        return 0;
}

结果是，9，然后flag：

[9�4�_�G�9���v ��,��V�[<�ZQӂ�s�
j���}�p@�o���i�V}{(��5���h�]��+o���Ʉ
5��X:�
&���
    �� �0V�O����l<�7��
�7��d�0���q>�;�a��s�EF�6�
���wX�dmL�֜�h|y7�m>4
Xꙟ�����^8�
�(�Uv�K����(J����=/����g��w�_��2��
flag{78bace5989660ee38f1fd980a4b4fbcd}
��:�ó��<���(��7hy�����i�y_f��
oQ�rh^0wLU���>\k��m���7��y�X7��/ƙ@
Ǧ�
  p߿9�p�H(���"b��$D�����Z��<GF�
��σ?6���oV^�^w���n����:K@܃�
��C&.�D2_�6�5��~%�X�+�t�+l@ѩ`1�3Ƕ
`��i)��)�b�%��`�g�ݓ�yq�^���B��y�
��mU�r�#�F�.5-}����O"�n�
                        B��+#d��y��
qFUgrh����;�C��?���1ʐ��}�� #��KF

GoReverse

拿到结果后先base64解密放成hex，
AES Decrypt(key=dPGWgcLpqmxw3uOXhKpKV009Cql@@XE6, iv=dPGWgcLpqmxw3uOXhKpKV009Cql@@XE6)
Mode = CBC
然后SM4 Decrypt (key=pg5g#k6Qo3L&1EzT, iv=上个结果的前32字符) MODE= CTR
最后是XXTEA(非标准)，被更改了delta和mx，逆了3个小时才发现mx被改了。。。

#define MX (z ^ (key[(p&3)^e])) + (sum ^ y ^ (((16 * z) ^ (y >> 3)) + ((z >> 5) ^ (4 * y))))

这是标准的MX

#define MX (((z>>5^y<<2) + (y>>3^z<<4)) ^ ((sum^y) + (key[(p&3)^e] ^ z)))

上面解密的数据
0x6f8c082d,0x91d710f1,0x13cae9c4,0x28640b11,0x61831577,0x07f8bf0a,0xeb9905f0,0x6397b535,0x42237994,0x0d8269de,0x1fb90102
提取出来的key
0x385E7342, 0x345A772A, 0x6F38756C, 0x6B402652
DELTA 0x7fab4cad
网上搜脚本

btea(v, -n, k);

void btea(uint32_t* v, int n, uint32_t const key[4])
{
    uint32_t y, z, sum;
    unsigned p, rounds, e;
    if (n > 1)            /* Coding Part */
    {
        rounds = 6 + 52 / n;
        sum = 0;
        z = v[n - 1];
        do
        {
            sum += DELTA;
            e = (sum >> 2) & 3;
            for (p = 0; p < n - 1; p++)
            {
                y = v[p + 1];
                z = v[p] += MX;
            }
            y = v[0];
            z = v[n - 1] += MX;
        } while (--rounds);
    }
    else if (n < -1)      /* Decoding Part */
    {
        n = -n;
        rounds = 6 + 52 / n;
        sum = rounds * DELTA;
        y = v[0];
        do
        {
            e = (sum >> 2) & 3;
            for (p = n - 1; p > 0; p--)
            {
                z = v[p - 1];
                y = v[p] -= MX;
            }
            z = v[n - 1];
            y = v[0] -= MX;
            sum -= DELTA;
        } while (--rounds);
    }
}

asm_re

打开后发现是ARM汇编，并且给了一个IDA反汇编的结果

找到关键点

EOR就是XOR，分析得到以下算法

W8 = (W8 * 0x50) + 0x14;
W8 ^= 0x4D;x
W8 += 0x1E;

再继续分析

__text:0000000100003D88                               loc_100003D88                           ; CODE XREF: _main+1C8↑j
__text:0000000100003D88 A8 03 50 F8                   LDUR            X8, [X29,#var_100]
__text:0000000100003D8C A9 83 90 B8                   LDURSW          X9, [X29,#var_F8]        
__text:0000000100003D90 08 79 69 B8                   LDR             W8, [X8,X9,LSL#2]        W8 = [X8 + [X29 + var_F8] * 4]    
__text:0000000100003D94 AA 83 90 B8                   LDURSW          X10, [X29,#var_F8]       
__text:0000000100003D98 A9 C3 02 D1                   SUB             X9, X29, #-__dst         X9 = X29 + dst
__text:0000000100003D9C 29 79 6A B8                   LDR             W9, [X9,X10,LSL#2]       W9 = [X9 + [X29 + var_F8] * 4]
__text:0000000100003DA0 08 01 09 6B                   SUBS            W8, W8, W9               W8 == W9
__text:0000000100003DA4 E8 17 9F 1A                   CSET            W8, EQ
__text:0000000100003DA8 88 00 00 37                   TBNZ            W8, #0, loc_100003DB8
__text:0000000100003DA8
__text:0000000100003DAC 01 00 00 14                   B               loc_100003DB0
__text:0000000100003DAC

注意到，W8和W9相等时候正确
再找到开始的时候的memcpy

__text:0000000100003BEC A0 C3 02 D1                   SUB             X0, X29, #-__dst        ; __dst
__text:0000000100003BF0 01 00 00 90 21 40 3C 91       ADRL            X1, unk_100003F10       ; __src
__text:0000000100003BF8 02 13 80 D2                   MOV             X2, #0x98               ; __n
__text:0000000100003BFC 99 00 00 94                   BL              _memcpy

得到加密后数据（exp里面的a）
然后反向计算输出，得到exp:

a=[0x1FD7,0x21B7,0x1E47,0x2027,0x26E7,0x10D7,0x1127,0x2007,0x11C7,0x1E47,0x1017,0x1017,0x11F7,0x2007,0x1037,0x1107,0x1F17,0x10D7,0x1017,0x1017,0x1F67,0x1017,0x11C7,0x11C7,0x1017,0x1FD7,0x1F17,0x1107,0x0F47,0x1127,0x1037,0x1E47,0x1037,0x1FD7,0x1107,0x1FD7,0x1107,0x2787]

for i in a:
        print(chr((((i-0x1e)^0x4d)-0x14) // 0x50),end='')

flag{67e9a228e45b622c2992fb5174a4f5f5}

androidso_re

getkey:先用rc4解出enc,再异或key
Key: A8UdWaeq
https://gchq.github.io/CyberChef/#recipe=RC4(%7B'option':'UTF8','string':'YourRC4Key'%7D,'UTF8','Latin1')XOR(%7B'option':'Hex','string':'038933b8540c206a'%7D,'Standard',false)&input=VEZTZWNyZXRfS2V5&oeol=FF
Getiv:

a="F2IjBOh1mRW="
for i in range(len(a)):
  if (ord(a[i])>65 and ord(a[i])<90) or (ord(a[i])>97 and ord(a[i])<127):
    if ord(a[i])-65<=0x1a:
        v9=65
        v10=-49
    elif  ord(a[i])-97<0x19:
        v9=97
        v10=-81
    print(chr(v9+(v10+ord(a[i]))%26),end="")
  else:
     print(a[i],end="")
     #V2YzREx1cHM=   IV: Wf3DLups

descbc解密即可
https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)DES_Decrypt(%7B'option':'UTF8','string':'A8UdWaeq'%7D,%7B'option':'UTF8','string':'Wf3DLups'%7D,'CBC','Raw','Raw')&input=SnFzbEhyZHZ0Z0pyUnMyUUFwK0ZFVmR3UlBOTHN3cm55a0Qvc1pNaXZtakdSS1VNVklDL3J3PT0

flag{188cba3a5c0fbb2250b5a2e590c391ce}

rust_baby

exp

#include <iostream>
#include <vector>
#include <Windows.h>

int main()
{
        char* flag = (char*)"flag{abjhgkjagshjfhasjjfhasjkfasffjfhasjkfasfffhasjkfasffgdffgf}EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE";
        char* res = (char*)malloc(0x114);

        unsigned char a[] = {
                0x50,0x81,0x92,0x93,0xB4,0x75,0x16,0xE7, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x18,0x41,0xA2,0x7B,0x4C,0x5D,0xC6,0x37, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x20,0x69,0xB2,0xC3,0x84,0x05,0x6E,0x2F, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x78,0x19,0x32,0xF3,0xEC,0x25,0x46,0xC7, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x40,0x49,0x72,0xFB,0xF4,0x15,0xFE,0x9F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0xB0,0xE1,0xF2,0x53,0x14,0x9D,0xC6,0x27, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x50,0x81,0x92,0x93,0xB4,0x75,0x16,0xE7, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x18,0x41,0xA2,0x7B,0x4C,0x5D,0xC6,0x37, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x20,0x69,0xB2,0xC3,    0x84,0x05,0x6E,0x2F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x78,0x19,0x32,0xF3,0xEC,0x25,0x46,0xC7, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x40,0x49,0x72,0xFB,0xF4,0x15,0xFE,0x9F, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0xB0,0xE1,0xF2,0x53,0x14,0x9D,0xC6,0x27, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x50,0x81,0x92,0x93,0xB4,0x75,0x16,0xE7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        };

        unsigned char b[] = {0xDC, 0x5F, 0x20, 0x22, 0xC2, 0x79, 0x19, 0x56, 0x35, 0xDA, 0x8B, 0x47, 0xD3, 0x19, 0xFC, 0x55,0x14, 0xCD, 0xD2, 0x7B, 0x58, 0x59, 0x09, 0x42, 0xDE, 0x2C, 0xB4, 0x48, 0xD9, 0xF2, 0x1B, 0xA9,0x40, 0xE1, 0xA6, 0xFB, 0xFF, 0x38, 0xC1, 0xD5, 0xE2, 0xE8, 0x77, 0x78, 0x6F, 0x22, 0x04, 0xE6,0x16, 0x3E, 0x0C, 0x35, 0x52, 0x5C, 0xFD, 0xC1, 0xE5, 0x59, 0x1C, 0xD0, 0xAE, 0x5A, 0xB2, 0xDD,0x19, 0xF8, 0x42, 0xE6, 0x2C, 0x89, 0x59, 0xE5, 0x11, 0x9C, 0xC8, 0x7B, 0x81, 0x70, 0x7F, 0x6F,0xBC, 0x6F, 0x02, 0x8F, 0xF7, 0xF4, 0xC8, 0x70, 0xAE, 0x02, 0xF8, 0x5B, 0xE2, 0x72, 0x08, 0x09,0x6F, 0xBF, 0x4B, 0x39, 0xB5, 0xD0, 0x1E, 0xA3, 0x23, 0xAB, 0x9B, 0x43, 0xB1, 0x15, 0xD7, 0xBE};


/*
        int id = 0;
        for (int k = 0; k < 13*8; k += 8)
        {
                for (int index = 0; index < 4; index++) {
                        DWORD p1 = a[9 + index * 2 + 16 * (k / 8)] ^ a[1 + index * 2 + 16 * (k / 8)];
                        DWORD p2 = a[8 + index * 2 + 16 * (k / 8)] ^ a[0 + index * 2 + 16 * (k / 8)];

                        DWORD col = (p1 | p2) & 0x1;
                        //res[id++] = (char)(flag[0 + index * 2 + 8 * (k / 8)] - col + index) ^ 0x33;
                        //res[id++] = (char)(flag[1 + index * 2 + 8 * (k / 8)] - col + index) ^ 0x33;
                }
        }
        for (int i = 0; i < 0x70; i++)
        {
                res[i] ^= b[i];
        }


*/

        unsigned char c[] = { 0x8a,0x07,0x72,0x76,0x8d,0x7d,0x4d,0x51,0x35,0xde,0x88,0x16,0xd4,0x04,0xf9,0x0e,0x08,0xcf,0xcc,0x7c,0x0f,0x0d,0x09,0x5e,0xd5,0x7e,0xe4,0x4b,0xc4,0xf3,0x1c,0xaf,0x12,0xe4,0xa0,0xae,0xf6,0x69,0xc9,0xd2,0xe0,0xa7,0x01,0x0e,0x1a,0x57,0x70,0x92,0x61,0x49,0x7a,0x43,0x27,0x29,0x89,0xb5,0x92,0x2e,0x6a,0xa6,0xdb,0x2f,0xc6,0xa9,0x6e,0x8f,0x34,0x90,0x59,0xfc,0x2d,0x91,0x66,0xeb,0xbe,0x0d,0xf4,0x05,0x0b,0x1b,0xcb,0x18,0x74,0xf9,0x82,0x81,0xbc,0x04,0xd9,0x75,0x8e,0x2d,0x97,0x07,0x7c,0x7d,0x18,0xc8,0x3d,0x4f,0xc0,0xa5,0x6a,0xd7 };
        for (int i = 0; i < 0x70; i++)
        {
                c[i] ^= b[i];
        }


        int id = 0;
        for (int k = 0; k < 13 * 8; k += 8)
        {
                for (int index = 0; index < 4; index++) {
                        DWORD p1 = a[9 + index * 2 + 16 * (k / 8)] ^ a[1 + index * 2 + 16 * (k / 8)];
                        DWORD p2 = a[8 + index * 2 + 16 * (k / 8)] ^ a[0 + index * 2 + 16 * (k / 8)];

                        DWORD col = (p1 | p2) & 0x1;
                        for (int jj = 0x20; jj <= 0x7f; jj++)
                        {
                                char pp = (char)(jj - col + index) ^ 0x33;
                                if (pp == c[0 + index * 2 + 8 * (k / 8)])
                                {
                                        res[id++] = jj;
                                        break;
                                }
                        }
                        
                        for (int jj = 0x20; jj <= 0x7f; jj++)
                        {
                                char pp = (char)(jj - col + index) ^ 0x33;
                                if (pp == c[1 + index * 2 + 8 * (k / 8)])
                                {
                                        res[id++] = jj;
                                        break;
                                }
                        }


                }
        }

        std::cout << res;

        return 0;
}

flag{6e2480b3-4f02-4cf1-9bc0-123b75f9a922}

longlongcall

首先挂在linux下，IDA远程调试运行，发现Hack，退出了，搜字符串，找到后找x-ref

发现有两处，如下两张图，分别把这两处的上一层函数跳转改成强制的（不走hacker，过反调试）

然后重新打开运行发现就正常了，然后跟着走，来到了scanf（"%44s", xx），意味着flag长度是44，接着走，发现他两个两个读取你输入的flag，然后加起来的值再分别和他俩进行异或以加密flag，最后再对flag进行对比，拿到里面加密后的flag后，可以通过暴力枚举来写出exp

ans = bytes.fromhex("BBBFB9BEC3CCCEDC9E8F9D9BA78CD795B0ADBDB488AF92D0CFA1A392B7B4C99E94A7AEF0A199C0E3B4B4BFE3")

def decrypt(a, b):
    for i in range(0, 256):
        for j in range(0, 256):
            if a == (i+j)^i and b == (i+j)^j:
                return (i, j)

for i in range(0, len(ans), 2):
    b1, b2 = decrypt(ans[i],ans[i+1])
    print(chr(b1)+chr(b2),end='')
# miniLCTF{just_s1mple_x0r_1n_lon9_l0ng_c@ll!}

补一个之后用z3写的wp

from z3 import *
ans = bytes.fromhex("BBBFB9BEC3CCCEDC9E8F9D9BA78CD795B0ADBDB488AF92D0CFA1A392B7B4C99E94A7AEF0A199C0E3B4B4BFE3")

sol = Solver()

v = [BitVec(f"v{i}", 8) for i in range(44)]
for i in range(0, 44, 2):
    p = (v[i] + v[i+1])
    v[i] = v[i] ^ p
    v[i+1] = v[i+1] ^ p

for i in range(44):
    sol.add(v[i] == ans[i])

print(sol.check())

m = sol.model()
result = [0] * 44

for p in m.decls():
    # print(chr(m[v[i]].as_long()),end='')
    result[int((p.name()[1:]))] = m[p].as_long()

print(list(map(chr, result)))
print("".join(map(chr, result)))

Bigbanana

从switch表中找到，F2 00 00 00这个后面跟着的，

稍微整理一下

再稍微分析一下

F4, 01 立即数加法
F3 两个异或
F2 checkAnswer 后面跟着应该的结果
FE 看是否播放banana
F0 好像是把上一次结果保存
10 getchar并推上栈

F8 push 栈[0]字符
F7 push 栈[1]字符


10 00 00 00 10 00 00 00 F8 00 00 00 F7 00 00 00
F4 00 00 00 4D 69 4E 69  栈[1]字符 ('m')
01 00 00 00 4C 2D 63 74  栈[0]字符 ('i')
F4 00 00 00 00 00 00 00
F3 00 00 00 栈上xor   000000001D2D440F

F2 00 00 00 0F 44 2D 1D  check Answer
FE 00 00 00 66 00 00 00 banana

F0 00 00 00   ' 拿 栈[0]字符 ('i') + 结果 74632DB5

这里f8是74632DB5
10 00 00 00 F8 00 00 00 F4 00 00 00 16 00 00 00
01 00 00 00 21 00 00 00  ' 结果 000000000000008F


F4 00 00 00 14 45 11 00

F3 00 00 00
F2 00 00 00 50 72 74 74 FE 00 00 00
...

exp

flag = "mi"

f4List = [0x16,0x00114514,   
0x21,0x00228A28,   
0x2C,0x0033CF3C,   
0x0B,0x00451450,   
0x16,0x00565964,   
0x21,0x00679E78,   
0x2C,0x0078E38C,   
0x0B,0x008A28A0,   
0x16,0x009B6DB4,   
0x21,0x00ACB2C8,   
0x2C,0x00BDF7DC,   
0x0B,0x00CF3CF0,   
0x16,0x00E08204,   
0x21,0x00F1C718,   
0x2C,0x01030C2C,   
0x0B,0x01145140,   
0x16,0x01259654,   
0x21,0x0136DB68,   
0x2C,0x0148207C,   
0x0B,0x01596590,   
0x16,0x016AAAA4,   
0x21,0x017BEFB8,   
0x2C,0x018D34CC,   
0x0B,0x019E79E0,   
0x16,0x01AFBEF4,   
0x21,0x01C10408,   
0x2C,0x01D2491C,   
0x0B,0x01E38E30,   
0x16,0x01F4D344,   
0x21,0x02061858,   
0x2C,0x02175D6C,   
0x0B,0x0228A280,   
0x16,0x0239E794,   
0x21,0x024B2CA8,   
0x2C,0x025C71BC,   
0x0B,0x026DB6D0,   
0x16,0x027EFBE4,   
0x21,0x029040F8,   
0x2C,0x02A1860C,   
0x0B,0x02B2CB20,   
0x16,0x02C41034,   
0x21,0x02D55548,   
0x2C,0x02E69A5C]

f01List = [0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B]

ans = [0x74747250,0x00228A4D,0x0033CFAA,0x004514CB,0x00565966,0x00679FBC,0x0078E4CC,0x008A2949,0x009B6EC8,0x00ACB3E0,0x00BDF8F6,0x00CF3D22,0x00E082EB,0x00F1C745,0x01030C9C,0x0114518E,0x01259634,0x0136DC9C,0x0148217D,0x015965AE,0x016AABB8,0x017BF02F,0x018D352A,0x019E7AE7,0x01AFBF19,0x01C1043C,0x01D249A4,0x01E38E3E,0x01F4D3B0,0x02061853,0x02175E76,0x0228A241,0x0239E866,0x024B2D81,0x025C72F0,0x026DB738,0x027EFCFC,0x029041F1,0x02A186E7,0x02B2CBE3,0x02C4105D,0x02D55595,0x02E69A7B]

# 第一轮（因为读取了两个字符所以不好处理，直接拿第一轮结果）
ll = 0x74632DB5
for i in range(43):
        succeed = False
        for c in range(0,256):
                aa = c
                temp_ll = ll + f4List[i*2] + f4List[i*2+1]
                aa += f01List[i]
                if aa ^ temp_ll == ans[i]:
                        ll = aa
                        flag += chr(c)
                        print(i,flag)
                        succeed  = True
                        break
        if not succeed:
                print("err",i)
                
                
        
'''
0 min
1 mini
2 miniL
3 miniLc
4 miniLct
5 miniLctf
6 miniLctf{
7 miniLctf{b
8 miniLctf{bi
9 miniLctf{big
10 miniLctf{bigb
11 miniLctf{bigb4
12 miniLctf{bigb4n
13 miniLctf{bigb4na
14 miniLctf{bigb4nan
15 miniLctf{bigb4nan4
16 miniLctf{bigb4nan4_
17 miniLctf{bigb4nan4_i
18 miniLctf{bigb4nan4_i5
19 miniLctf{bigb4nan4_i5_
20 miniLctf{bigb4nan4_i5_v
21 miniLctf{bigb4nan4_i5_v3
22 miniLctf{bigb4nan4_i5_v3r
23 miniLctf{bigb4nan4_i5_v3ry
24 miniLctf{bigb4nan4_i5_v3ry_
25 miniLctf{bigb4nan4_i5_v3ry_i
26 miniLctf{bigb4nan4_i5_v3ry_in
27 miniLctf{bigb4nan4_i5_v3ry_int
28 miniLctf{bigb4nan4_i5_v3ry_int3
29 miniLctf{bigb4nan4_i5_v3ry_int3r
30 miniLctf{bigb4nan4_i5_v3ry_int3r5
31 miniLctf{bigb4nan4_i5_v3ry_int3r5t
32 miniLctf{bigb4nan4_i5_v3ry_int3r5t1
33 miniLctf{bigb4nan4_i5_v3ry_int3r5t1n
34 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng
35 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng_
36 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng_r
37 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng_r1
38 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng_r1g
39 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng_r1gh
40 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng_r1ght
41 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng_r1ght?
42 miniLctf{bigb4nan4_i5_v3ry_int3r5t1ng_r1ght?}

补一个之后用z3写的exp

from z3 import *
flag = "mi"


f4List = [0x16,0x00114514,   
0x21,0x00228A28,   
0x2C,0x0033CF3C,   
0x0B,0x00451450,   
0x16,0x00565964,   
0x21,0x00679E78,   
0x2C,0x0078E38C,   
0x0B,0x008A28A0,   
0x16,0x009B6DB4,   
0x21,0x00ACB2C8,   
0x2C,0x00BDF7DC,   
0x0B,0x00CF3CF0,   
0x16,0x00E08204,   
0x21,0x00F1C718,   
0x2C,0x01030C2C,   
0x0B,0x01145140,   
0x16,0x01259654,   
0x21,0x0136DB68,   
0x2C,0x0148207C,   
0x0B,0x01596590,   
0x16,0x016AAAA4,   
0x21,0x017BEFB8,   
0x2C,0x018D34CC,   
0x0B,0x019E79E0,   
0x16,0x01AFBEF4,   
0x21,0x01C10408,   
0x2C,0x01D2491C,   
0x0B,0x01E38E30,   
0x16,0x01F4D344,   
0x21,0x02061858,   
0x2C,0x02175D6C,   
0x0B,0x0228A280,   
0x16,0x0239E794,   
0x21,0x024B2CA8,   
0x2C,0x025C71BC,   
0x0B,0x026DB6D0,   
0x16,0x027EFBE4,   
0x21,0x029040F8,   
0x2C,0x02A1860C,   
0x0B,0x02B2CB20,   
0x16,0x02C41034,   
0x21,0x02D55548,   
0x2C,0x02E69A5C]

f01List = [0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B,0x16,0x21,0x2C,0x0B]

ans = [0x74747250,0x00228A4D,0x0033CFAA,0x004514CB,0x00565966,0x00679FBC,0x0078E4CC,0x008A2949,0x009B6EC8,0x00ACB3E0,0x00BDF8F6,0x00CF3D22,0x00E082EB,0x00F1C745,0x01030C9C,0x0114518E,0x01259634,0x0136DC9C,0x0148217D,0x015965AE,0x016AABB8,0x017BF02F,0x018D352A,0x019E7AE7,0x01AFBF19,0x01C1043C,0x01D249A4,0x01E38E3E,0x01F4D3B0,0x02061853,0x02175E76,0x0228A241,0x0239E866,0x024B2D81,0x025C72F0,0x026DB738,0x027EFCFC,0x029041F1,0x02A186E7,0x02B2CBE3,0x02C4105D,0x02D55595,0x02E69A7B]

# 第一轮（因为读取了两个字符所以不好处理，直接拿第一轮结果）


s = Solver()

x = [BitVec(f"x{i}", 8) for i in range(43)]
ll = 0x74632DB5
for i in range(43):
        succeed = False
        aa = x[i]
        temp_ll = ll + f4List[i*2] + f4List[i*2+1]
        aa += f01List[i]
        s.add(aa ^ temp_ll == ans[i])
        ll = aa
        s.add(x[i] < 0x7f)
        s.add(x[i] > 0x20)

print(s.check())
m = s.model()

result = [0] * 43
for p in m:    
    result[int(p.name()[1:])] = m[p].as_long()

print("".join(map(chr, result)))

RustedRobot

首先拿到app，把libmyrust.so分离出来，拖入IDA64进行分析（我还用了IDARust Demangler插件来辅助我进行分析）。
首先花了一下午给Xiaomi13刷了KernelSU，学了个Frida，如下是Hook的Frida脚本，有时候正常hook，有时候hook不上（目前不知道什么原因）

function main(){
    Java.perform(function() {
    var CryptoClass = Java.use("com.doctor3.androidrusttest.CryptoClass");
        console.log("Hooked CryptoClass\n");
    CryptoClass.encrypt.overload('[Ljava.lang.String;').implementation = function(strArr) {
        var str = strArr[0];
        var str2 = strArr[1];
        console.log("Encrypt method called with parameters: " + str + ", " + str2 + "\n");
        // 调用原始方法
        this.encrypt(strArr);
    };
});
}
setImmediate(main);

随后IDA里面分析so，发现它创建了一个数组（长度2）, 也就是对应Java代码里面的函数参数，然后在函数末尾进行了Java static method invoke。

    public static void encrypt(String[] strArr) {
        int i = 0;
        String str = strArr[0];
        String str2 = strArr[1];
        byte[] bArr = {49, -93, 51, -59, 24, -5, -59, 60, -45, -32, -55, -54, -89, 67, 42, -94, 47, 110, 72, 13, 31, 55, 55, 34, 127, 65, -120, 13, -109, -92, -71, -97};
        byte[] bytes = str.getBytes();
        byte[] bytes2 = str2.getBytes();
        SecretKeySpec secretKeySpec = new SecretKeySpec(bytes, AES);
        try {
            Cipher cipher = Cipher.getInstance(AES);
            cipher.init(1, secretKeySpec);
            byte[] doFinal = cipher.doFinal(bytes2);
            while (i < 32) {
                i = (bArr[i] == doFinal[i] && doFinal.length == 32) ? i + 1 : 0;
                Toast.makeText(context, "Wrong", 1).show();
                return;
            }
            Toast.makeText(context, "Right", 1).show();
        } catch (Exception e) {
            Toast.makeText(context, "Wrong", 1).show();
            e.printStackTrace();
        }
    }

然后，使用Frida进行Hook，我们得知，第一个元素恒为定值，而第二个元素随着输入而改变（我不断更改miniLCTF{xxx}中的值，发现当miniLCTF{3}的时候，第二个字符是2，而且继续更改也之影响第二个字符，我就猜想这个字符很可能被反转了）。随后在CyberChef，先解密掉bArr，获取被混淆后的真正flag，我们得到

Encrypt method called with parameters: btdfA2jeeljf.1bp, ~2|GUDMjojn

flag，但是混淆后
~u1c1s`E4UTVS|GUDMjojn

随后就进行字符串反转，而后减一得到flag
于是我们可以得到exp:
https://gchq.github.io/CyberChef/#recipe=AES_Decrypt(%7B'option':'UTF8','string':'btdfA2jeeljf.1bp'%7D,%7B'option':'Hex','string':''%7D,'ECB/NoPadding','Hex','Raw',%7B'option':'Hex','string':''%7D,%7B'option':'Hex','string':''%7D)Remove_whitespace(true,true,true,true,true,false)Reverse('Character')ADD(%7B'option':'Decimal','string':'-1'%7D)&input=MzEgYTMgMzMgYzUgMTggZmIgYzUgM2MgZDMgZTAgYzkgY2EgYTcgNDMgMmEgYTIgMmYgNmUgNDggMGQgMWYgMzcgMzcgMjIgN2YgNDEgODggMGQgOTMgYTQgYjkgOWY&oeol=NEL

OLLessVM

00007FF6C5E8A4 | 8D041F            | lea eax,qword ptr ds:[rdi+rbx]                                |
00007FF6C5E8A4 | 48:63D3           | movsxd rdx,ebx                                                |
00007FF6C5E8A4 | 48:63C8           | movsxd rcx,eax                                                |
00007FF6C5E8A4 | 8A440D F7         | mov al,byte ptr ss:[rbp+rcx-9]                                |
00007FF6C5E8A4 | 320432            | xor al,byte ptr ds:[rdx+rsi]                                  |
00007FF6C5E8A4 | 32C3              | xor al,bl                                                     |
00007FF6C5E8A4 | 42:880432         | mov byte ptr ds:[rdx+r14],al                                  |

x64dbg打开，找到，输入一个东西下硬件断点找到关键点，拿到xor表，main函数的ans表和bl(counter)即可写出wp：

xort = bytes.fromhex("9199417B79814BCBA9EC2E02CB94E526910BA60F2881A160D1525FC47AAD4FFFE299D57A286EC037F570E6460707A2F54B393A97328EB0E7BBE8C7D2B7087B628ED06FBF369F0000A0F4A55946024602")


ans = bytes.fromhex("FCF12D1131C7198ADABC147C98EADB65F729D04348FC8428F92923AC59CD51E0C2B8F7590C4BE610DD59CC6D2B2A8CDA7B0808A406BB86D083D1FDE98B35455D514CD172F6B8E69EE2B72D7525712B4B864587A1C947C55A165E1AD1179D186E3FD275E9E35156C206046D1A50657DFDA912")

for i in range(len(ans)):
    print(chr(i^xort[i]^ans[i]),end='')
# miniLCTF{Y0u_s0Lv3d_th3_0bfs?}

OLLessVM_RENVEGE

发现使用ReadConsoleW来读取控制台

BOOL WINAPI ReadConsole（__in HANDLE hConsoleInput,__out LPVOID lpBuffer,__in DWORD nNumberOfCharsToRead,__out LPDWORD lpNumberOfCharsRead,__in_opt LPVOID pInputControl）;

#include <iostream>
#include <vector>
#include <Windows.h>

uint8_t x0r[16] = { 0x1,0x2,0x4,0x8,0x10,0x20,0x40,0x80,0xff,0xfe,0xfc,0xf8,0xf0,0xe0,0xc0,0x80 };
int main()
{
        const char* f = "miniLCTF{1141414141414111111111}";
        char* flag = (char*)malloc(33);
        memcpy_s(flag, 33, f, strlen(f));
        if (!flag)
        {
                return -1;
        }

        for (size_t i = 0; i < 32; i++)
        {
                flag[i] ^= x0r[i % 16];
        }

        auto inn = (DWORD*)flag;
        auto xnn = (DWORD*)x0r;
        
        std::cout << std::hex;
        DWORD offset = 0xEEB7B2B6;
        DWORD keyOffset = 0xBADECADA;
        DWORD sum = 0x2EB7B2B6;
        uint32_t key = 0xBADECADA;
        for (int k = 0; k < 12; k++)
        {
                for (int i = 0; i < 8; i++)
                {
                        DWORD e1 = ((inn[(7 + i) % 8] >> 5) ^ (inn[(1 + i) % 8] << 2));
                        DWORD e2 = ((inn[(1+ i) % 8] >> 3) ^ (inn[(7 + i) % 8] << 4));
                        //cout << e1 << endl << e2 << endl;
                        /*
                        0x1fbe03fe
                        0xc7df907b
                        */
                        DWORD p = e1 - ~e2 - 1;
                        //std::cout << "sum=0x" << sum << std::endl;
                        DWORD e3 = xnn[(sum ^ i) & 3] ^ inn[(7 + i) % 8];
                        DWORD p2 = inn[(1 + i) % 8] ^ key;
                        //cout << p << endl << e3 << endl << p2 << endl;

                        DWORD p3 = p2 - ~e3 - 1;
                        DWORD e4 = p3 ^ p;
                        //cout << p3 << endl << e4 << endl;
                        DWORD p4 = inn[(i) % 8] - ~e4 - 1;
                        //std::cout << "i=" << i << "|" << p4 << std::endl; // p4 is ANS
                        inn[i] = p4;
                        //std::cout << "-------------\n";
                }
                //std::cout << "k=" << k << "----------------------------------------------------\n";

                key += keyOffset;
                sum = sum + offset + !(k % 2);
        }
        char* result = (char*)malloc(33);
        if (!result) return -1;
        for (size_t i = 0; i < 32; i++)
        {
                result[31 - i] = flag[i] ^ x0r[(31 - i) % 16] ^ 0x18;
        }
        if (*(DWORD*)result != 0xc293a546)
        {
                std::cout << "errrr";
        }
        char ans[] = {0x4b ,0xa0 ,0x0c ,0xff ,0xab ,0x0a ,0x13 ,0xb0,0x32 ,0x91 ,0x6d ,0x87 ,0x8b ,0xab ,0xf5 ,0xa5,0xdc ,0x77 ,0xd4 ,0x95 ,0xb9 ,0x02 ,0xa6 ,0xac,0xe4 ,0x74 ,0x2c ,0x6b ,0xeb ,0xe1 ,0x5e ,0x25};
        return 0;
}

注意到(sum ^ i) & 3，立马想到了TEA加密算法，再看一下这个结构，完全不像？？
不过e1, e2好像key中的l和r，所以想办法得搞成TEA，也方便写解密脚本

注意到程序中p2 - ~e3 - 1这种模式，加密过程中出现了三次，所以想办法看看能不能化简。
这种模式立即让我想到了VMProtect 3.5，虚拟化后的加法过程，随即我翻阅了去年组会中我写的blog：
https://组织内部神秘博客地址/d/955-redi-er-ci-zu-hui-idapythonji-chu-appcallshi-yong/9

可以注意到，化简后是

p2 - ~e3 - 1  <====>  p2 + e3

这样就可以化简整个加密函数

uint8_t lkey[16] = { 0x1,0x2,0x4,0x8,0x10,0x20,0x40,0x80,0xff,0xfe,0xfc,0xf8,0xf0,0xe0,0xc0,0x80 };
void encryption(DWORD* inn)
{
        DWORD offset_ = 0xBADECADA;
        DWORD key = 0x2EB7B2B6;
        uint32_t sum_ = 0xBADECADA;
        auto xnn = (DWORD*)lkey;
        for (int k = 0; k < 12; k++)
        {
                for (int i = 0; i < 8; i++)
                {
                        DWORD l = ((inn[(7 + i) % 8] >> 5) ^ (inn[(1 + i) % 8] << 2));
                        DWORD r = ((inn[(1 + i) % 8] >> 3) ^ (inn[(7 + i) % 8] << 4));
                        DWORD p4 = inn[(i) % 8] + (((inn[(1 + i) % 8] ^ sum_) + (xnn[(key ^ i) & 3] ^ inn[(7 + i) % 8])) ^ (l + r));
                        inn[i] = p4;
                }
                sum_ += offset_;
                key += 0xEEB7B2B6 + !(k % 2);
        }
}

xnn是lkey, lkey是xor(key)表，至此我们需要写解密函数，我的处理方法是把key和sum先算12次，得到最后结果，然后反着来用，按照TEA的方法来逆向。

void decryption(DWORD* inn)
{
        DWORD offset_ = 0xBADECADA;
        DWORD key = 0x2EB7B2B6;
        uint32_t sum_ = 0xBADECADA;
        auto xnn = (DWORD*)lkey;

        for (int k = 0; k < 12; k++)
        {
                sum_ += offset_;
                key += 0xEEB7B2B6 + !(k % 2);
        }

        for (int k = 11; k >= 0; k--)
        {
                sum_ -= offset_;
                key -= 0xEEB7B2B6 + !(k % 2);
                for (int i = 7; i >= 0; i--)
                {
                        DWORD l = ((inn[(7 + i) % 8] >> 5) ^ (inn[(1 + i) % 8] << 2));
                        DWORD r = ((inn[(1 + i) % 8] >> 3) ^ (inn[(7 + i) % 8] << 4));
                        inn[i] -= (((inn[(1 + i) % 8] ^ sum_) + (xnn[(key ^ i) & 3] ^ inn[(7 + i) % 8])) ^ (l + r));
                }
        }
}

至此，给出完整exp：

#include <iostream>
#include <vector>
#include <Windows.h>

uint8_t lkey[16] = { 0x1,0x2,0x4,0x8,0x10,0x20,0x40,0x80,0xff,0xfe,0xfc,0xf8,0xf0,0xe0,0xc0,0x80 };

void encryption(DWORD* inn)
{
        DWORD offset_ = 0xBADECADA;
        DWORD key = 0x2EB7B2B6;
        uint32_t sum_ = 0xBADECADA;
        auto xnn = (DWORD*)lkey;


        for (int k = 0; k < 12; k++)
        {
                for (int i = 0; i < 8; i++)
                {
                        DWORD l = ((inn[(7 + i) % 8] >> 5) ^ (inn[(1 + i) % 8] << 2));
                        DWORD r = ((inn[(1 + i) % 8] >> 3) ^ (inn[(7 + i) % 8] << 4));
                        DWORD p4 = inn[(i) % 8] + (((inn[(1 + i) % 8] ^ sum_) + (xnn[(key ^ i) & 3] ^ inn[(7 + i) % 8])) ^ (l + r));
                        inn[i] = p4;
                }
                sum_ += offset_;
                key += 0xEEB7B2B6 + !(k % 2);
        }
}

void decryption(DWORD* inn)
{
        DWORD offset_ = 0xBADECADA;
        DWORD key = 0x2EB7B2B6;
        uint32_t sum_ = 0xBADECADA;
        auto xnn = (DWORD*)lkey;

        for (int k = 0; k < 12; k++)
        {
                sum_ += offset_;
                key += 0xEEB7B2B6 + !(k % 2);
        }

        for (int k = 11; k >= 0; k--)
        {
                sum_ -= offset_;
                key -= 0xEEB7B2B6 + !(k % 2);
                for (int i = 7; i >= 0; i--)
                {
                        DWORD l = ((inn[(7 + i) % 8] >> 5) ^ (inn[(1 + i) % 8] << 2));
                        DWORD r = ((inn[(1 + i) % 8] >> 3) ^ (inn[(7 + i) % 8] << 4));
                        inn[i] -= (((inn[(1 + i) % 8] ^ sum_) + (xnn[(key ^ i) & 3] ^ inn[(7 + i) % 8])) ^ (l + r));
                }
        }
}

int main()
{
        char ans[] = { 0x4b ,0xa0 ,0x0c ,0xff ,0xab ,0x0a ,0x13 ,0xb0,0x32 ,0x91 ,0x6d ,0x87 ,0x8b ,0xab ,0xf5 ,0xa5,0xdc ,0x77 ,0xd4 ,0x95 ,0xb9 ,0x02 ,0xa6 ,0xac,0xe4 ,0x74 ,0x2c ,0x6b ,0xeb ,0xe1 ,0x5e ,0x25 };
        char* result = (char*)malloc(33);
        if (!result) return -1;
        result[32] = 0;
        for (size_t i = 0; i < 32; i++)
        {
                result[i] = ans[31 - i] ^ lkey[(31 - i) % 16] ^ 0x18;
        }
        decryption((DWORD*)result);
        for (size_t i = 0; i < 32; i++)
        {
                result[i] ^= lkey[i % 16];
        }
        std::cout << result;

        return 0;
}

MiniLCTF 2024

真正意义的打了5天的CTF，时间长，事件多，题目有趣。


最后也是真不容易地拿到了总分第一，认识了许多大佬，队友也都很猛，废寝忘食地capture flag，最后一天也是Web手连着K掉了两个难题，挽救了低分(Web差一道就AK了)。
第一次AK所有逆向题目（可能只是因为比赛时间较长吧，我们没有专门的Misc手，我也打了打Misc）
第一次AK所有Misc题目（队友是神，0基础CTF就能AK）

还是得吐槽一下区块链方向，最后一天上了个题让我们人心惶惶，因为大家都没做出来，但是最后也没人解出来，好像是容器有一些问题，或者只是题目比较难吧（

以后的打算：主攻Reverse，学一学Pwn，顺便当个小小运维，其他题和队友齐力解决。

我们队伍(0x)的Writeups（2024/5/9开放围观！）:
飞书WP链接