文章目录

  • numgame
    • 拖进ida
    • `set_sudu((Sudu *)v8, (const std::string *)v9) != 1`
      • int __userpurge Sudu::set_number@(int a1@, Sudu *this, int a3, int a4, int a5)
    • (unsigned __int8)Sudu::check((Sudu *)v8)
      • (unsigned __int8)Sudu::check_block((int)a1)
      • (unsigned __int8)Sudu::check_col((int)a1)
      • (unsigned __int8)Sudu::check_row((int)a1)
    • 总结：
      • 满足条件：
    • 代码
    • 注意
  • apk crack
    • 查壳
    • so层分析
    • jeb分析
      • main函数
      • check函数
    • jeb动调apk
  • 溯源
    • 拖进ida
    • 正向解析
    • 逆向脚本

numgame

拖进ida

char v8[324];

这个也就是81个int数据的数组，_data_start__这个是有已知数独数据所在的81个int类型的数组（即9X9）

set_sudu((Sudu *)v8, (const std::string *)v9) != 1

int __cdecl set_sudu(Sudu *a1, const std::string *a2)
{std::string *v3; // [esp+0h] [ebp-38h]std::string *v4; // [esp+0h] [ebp-38h]int v5; // [esp+Ch] [ebp-2Ch]int v6; // [esp+1Ch] [ebp-1Ch] BYREFint v7; // [esp+20h] [ebp-18h] BYREFchar v8; // [esp+27h] [ebp-11h]const std::string *v9; // [esp+28h] [ebp-10h]int v10; // [esp+2Ch] [ebp-Ch]v10 = 0;v9 = a2;v7 = std::string::begin(v3);v6 = std::string::end(v4);while ( __gnu_cxx::operator!=<char const*,std::string>((int)&v7, (int)&v6) ){v8 = *(_BYTE *)__gnu_cxx::__normal_iterator<char const*,std::string>::operator*((int)&v7);if ( (unsigned __int8)Sudu::set_number((int)a1, (Sudu *)(v10 / 9), v10 % 9, v8 - 48, v5) != 1 )return 0;++v10;__gnu_cxx::__normal_iterator<char const*,std::string>::operator++(&v7);}return 1;
}

核心函数Sudu::set_number
这里v10/9也就是当前行数，v10%9也就是当前列数（代表有九列），v8 - 48代表字符变量转换为数字变量，

int __userpurge Sudu::set_number@(int a1@, Sudu *this, int a3, int a4, int a5)

int __userpurge Sudu::set_number@<eax>(int a1@<ecx>, Sudu *this, int a3, int a4, int a5)
{if ( !a4 )return 1;if ( (int)this < 0|| (int)this > 8|| a3 < 0|| a3 > 8|| *(_DWORD *)(a1 + 4 * (a3 + 9 * (_DWORD)this))|| a4 <= 0|| a4 > 9 ){return 0;}*(_DWORD *)(a1 + 4 * (9 * (_DWORD)this + a3)) = a4;return 1;
}

字符填充*(_DWORD *)(a1 + 4 * (9 * (_DWORD)this + a3)) = a4;，this也就是行数喽，a3列数喽，然后int类型变量*4，a1就是起始地址。分析完成

(unsigned __int8)Sudu::check((Sudu *)v8)

BOOL __fastcall Sudu::check(Sudu *a1)
{return (unsigned __int8)Sudu::check_block((int)a1)&& (unsigned __int8)Sudu::check_col((int)a1)&& (unsigned __int8)Sudu::check_row((int)a1);
}

(unsigned __int8)Sudu::check_block((int)a1)

int __fastcall Sudu::check_block(int a1)
{char v2[10]; // [esp+12h] [ebp-26h]int v3; // [esp+1Ch] [ebp-1Ch]int v4; // [esp+20h] [ebp-18h]int l; // [esp+24h] [ebp-14h]int k; // [esp+28h] [ebp-10h]int j; // [esp+2Ch] [ebp-Ch]int i; // [esp+30h] [ebp-8h]for ( i = 0; i <= 8; ++i ){for ( j = 1; j <= 9; ++j )v2[j] = 1;for ( k = 0; k <= 8; ++k ){v4 = 3 * (i / 3) + k / 3;v3 = 3 * (i % 3) + k % 3;v2[*(_DWORD *)(a1 + 4 * (v3 + 9 * v4))] = 0;}for ( l = 1; l <= 9; ++l ){if ( v2[l] )return 0;}}

核心代码为：

       v4 = 3 * (i / 3) + k / 3;v3 = 3 * (i % 3) + k % 3;v2[*(_DWORD *)(a1 + 4 * (v3 + 9 * v4))] = 0;

下标值*(_DWORD *)(a1 + 4 * (v3 + 9 * v4))三个为一组，分组进行提取，提取的时候，先提取前三行的前三个下标，把每一行的前三个下标提取后；再提取前三行的中间三个下标；紧接着是前三行最后三个下标。
然后中间三行，最后最后三行.(也就是把大正方形划分成了9个小正方形)

(unsigned __int8)Sudu::check_col((int)a1)

int __fastcall Sudu::check_col(int a1)
{char v2[10]; // [esp+Ah] [ebp-1Ah]int l; // [esp+14h] [ebp-10h]int k; // [esp+18h] [ebp-Ch]int j; // [esp+1Ch] [ebp-8h]int i; // [esp+20h] [ebp-4h]for ( i = 0; i <= 8; ++i ){for ( j = 1; j <= 9; ++j )v2[j] = 1;for ( k = 0; k <= 8; ++k )v2[*(_DWORD *)(a1 + 4 * (i + 9 * k))] = 0;for ( l = 1; l <= 9; ++l ){if ( v2[l] )return 0;}}return 1;
}

核心代码：

v2[*(_DWORD *)(a1 + 4 * (i + 9 * k))] = 0;

按列进行赋值

(unsigned __int8)Sudu::check_row((int)a1)

int __fastcall Sudu::check_row(int a1)
{char v2[10]; // [esp+Ah] [ebp-1Ah]int l; // [esp+14h] [ebp-10h]int k; // [esp+18h] [ebp-Ch]int j; // [esp+1Ch] [ebp-8h]int i; // [esp+20h] [ebp-4h]for ( i = 0; i <= 8; ++i ){for ( j = 1; j <= 9; ++j )v2[j] = 1;for ( k = 0; k <= 8; ++k )v2[*(_DWORD *)(a1 + 4 * (k + 9 * i))] = 0;for ( l = 1; l <= 9; ++l ){if ( v2[l] )return 0;}}return 1;
}

按行进行赋值

总结：

满足条件：

  1. 9个小正方形里面都有1~9
  2. 大正方形的每行都有1~9
  3. 大正方形的每列都有1~9

搞了半天就是个数独

代码

在线解数独：http://shudu.gwalker.cn/

flag{347589162528416937916237458261875349739164825854392716493658271175923684682741593}

注意

需要把原来有数字的位置换为0，原因这里：为了防止*(a1 + 4 * (a3+9*this))成立,


a3为下标，举例也就是2，此时直接不满足。如果在上面a4的值为0的话，那么么直接返回1，也就不用进行下一步的判断了：

if ( !a4 )return 1;

这里的a4也就是输入的数值

flag{340089102508406930016207058060875349709064820854392006093650071170023604602740590}

apk crack

查壳

so层分析


虚晃一枪

jeb分析

main函数

 if(new simple(v3).check()) {((TextView)v2).setText(P_ichunqiu.A);}else {((TextView)v2).setText(P_ichunqiu.B);}

check函数

simple类中check函数是主要：

public class simple {private byte[] A;private byte[] B;public simple(String arg5) {int v3 = 50;super();this.A = new byte[v3];this.B = arg5.getBytes();int v0;for(v0 = 0; v0 < this.B.length; ++v0) {this.A[v0] = this.B[v0];}this.B = new byte[v3];}public boolean check() {byte v11 = 57;byte v9 = 0x30;byte[] v2 = new byte[203];v2[0] = 0x2F;v2[1] = v9;v2[2] = 81;v2[3] = 82;v2[4] = 0x4F;v2[5] = 54;v2[6] = 77;v2[7] = v9;v2[8] = 50;v2[9] = v9;v2[10] = v9;v2[11] = 0x2F;v2[12] = v9;v2[13] = 65;v2[14] = 54;v2[15] = 77;v2[16] = v9;v2[17] = 50;v2[18] = v9;v2[19] = v9;v2[20] = 0x2F;v2[21] = v11;v2[22] = v11;v2[23] = 70;v2[24] = v9;v2[25] = 0x2F;v2[26] = 49;v2[27] = v9;v2[28] = 56;v2[29] = 70;v2[30] = 49;v2[0x1F] = 0x2F;v2[0x20] = 49;v2[33] = 49;v2[34] = 49;v2[35] = 70;v2[36] = 50;v2[37] = 0x2F;v2[38] = 53;v2[39] = 51;v2[40] = 70;v2[41] = 51;v2[42] = 0x2F;v2[43] = 49;v2[44] = v9;v2[45] = 49;v2[46] = 70;v2[0x2F] = 52;v2[v9] = 0x2F;v2[49] = 49;v2[50] = 49;v2[51] = 52;v2[52] = 70;v2[53] = 53;v2[54] = 0x2F;v2[55] = v9;v2[56] = 70;v2[v11] = 54;v2[58] = 0x4F;v2[59] = v9;v2[60] = 71;v2[61] = v9;v2[62] = 77;v2[0x3F] = v9;v2[0x40] = v9;v2[65] = 50;v2[66] = v9;v2[67] = v9;v2[68] = 65;v2[69] = v9;v2[70] = 68;v2[71] = v9;v2[72] = 77;v2[73] = v9;v2[74] = v9;v2[75] = 50;v2[76] = v9;v2[77] = v9;v2[78] = 0x4F;v2[0x4F] = 49;v2[80] = 71;v2[81] = 49;v2[82] = 77;v2[83] = v9;v2[84] = v9;v2[85] = 50;v2[86] = v9;v2[87] = v9;v2[88] = 65;v2[89] = 49;v2[90] = 68;v2[91] = 49;v2[92] = 77;v2[93] = v9;v2[94] = v9;v2[0x5F] = 50;v2[0x60] = v9;v2[97] = v9;v2[98] = 0x4F;v2[99] = 50;v2[100] = 71;v2[101] = 50;v2[102] = 77;v2[103] = v9;v2[104] = v9;v2[105] = 50;v2[106] = v9;v2[107] = v9;v2[108] = 65;v2[109] = 50;v2[110] = 68;v2[0x6F] = 50;v2[0x70] = 77;v2[0x71] = v9;v2[0x72] = v9;v2[0x73] = 50;v2[0x74] = v9;v2[0x75] = v9;v2[0x76] = 0x4F;v2[0x77] = 51;v2[120] = 71;v2[0x79] = 51;v2[0x7A] = 77;v2[0x7B] = v9;v2[0x7C] = v9;v2[0x7D] = 50;v2[0x7E] = v9;v2[0x7F] = v9;v2[0x80] = 65;v2[0x81] = 51;v2[130] = 68;v2[0x83] = 51;v2[0x84] = 77;v2[0x85] = v9;v2[0x86] = v9;v2[0x87] = 50;v2[0x88] = v9;v2[0x89] = v9;v2[0x8A] = 0x4F;v2[0x8B] = 52;v2[140] = 71;v2[0x8D] = 52;v2[0x8E] = 77;v2[0x8F] = v9;v2[0x90] = v9;v2[0x91] = 50;v2[0x92] = v9;v2[0x93] = v9;v2[0x94] = 65;v2[0x95] = 52;v2[150] = 68;v2[0x97] = 52;v2[0x98] = 77;v2[0x99] = v9;v2[0x9A] = v9;v2[0x9B] = 50;v2[0x9C] = v9;v2[0x9D] = v9;v2[0x9E] = 0x4F;v2[0x9F] = 53;v2[0xA0] = 71;v2[0xA1] = 53;v2[0xA2] = 77;v2[0xA3] = v9;v2[0xA4] = v9;v2[0xA5] = 50;v2[0xA6] = v9;v2[0xA7] = v9;v2[0xA8] = 65;v2[0xA9] = 53;v2[170] = 68;v2[0xAB] = 53;v2[0xAC] = 77;v2[0xAD] = v9;v2[0xAE] = v9;v2[0xAF] = 50;v2[0xB0] = v9;v2[0xB1] = v9;v2[0xB2] = 0x2F;v2[0xB3] = 49;v2[200] = 0x2F;v2[201] = v9;int v3 = 0;byte v0 = 0;byte v1 = 0;byte[] v5 = new byte[1000];int v4 = 0;int v6;for(v6 = 0; true; v6 = 0) {label_441:switch(v2[v3]) {case 0: {goto label_700;}case 47: {goto label_686;}case 65: {goto label_543;}case 66: {goto label_654;}case 67: {goto label_648;}case 68: {goto label_573;}case 69: {goto label_451;}case 70: {goto label_588;}case 71: {goto label_603;}case 72: {goto label_618;}case 73: {goto label_499;}case 74: {goto label_633;}case 75: {goto label_636;}case 76: {goto label_639;}case 77: {goto label_671;}case 78: {goto label_657;}case 79: {goto label_513;}case 80: {goto label_528;}case 81: {goto label_445;}case 82: {goto label_454;}case 83: {goto label_558;}case 84: {goto label_457;}case 85: {goto label_485;}case 86: {goto label_651;}case 87: {goto label_448;}case 88: {goto label_645;}case 89: {goto label_471;}case 90: {goto label_642;}}goto label_443;do {label_485:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v1 = v5[v6];v6 = 0;goto label_443;do {label_618:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);this.B[v6] = v1;v6 = 0;goto label_443;do {label_558:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);this.A[v6] = v1;v6 = 0;goto label_443;do {label_686:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v0 = ((byte)v6);v6 = 0;goto label_443;do {label_499:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v5[v6] = v1;v6 = 0;goto label_443;label_633:v0 = ((byte)(v0 ^ v1));goto label_443;label_700:boolean v7 = v0 != 0 ? true : false;return v7;label_636:v0 = ((byte)(v0 | v1));goto label_443;do {label_573:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v0 = this.B[v6];v6 = 0;goto label_443;label_445:v5[v4] = v0;++v4;goto label_443;label_639:v0 = ((byte)(v0 & v1));goto label_443;label_448:--v4;v0 = v5[v4];goto label_443;do {label_513:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v0 = this.A[v6];v6 = 0;goto label_443;label_642:v0 = ((byte)(v0 ^ -1));goto label_443;label_451:v5[v4] = v1;++v4;goto label_443;label_645:v0 = ((byte)(v0 + v1));goto label_443;label_454:--v4;v1 = v5[v4];goto label_443;label_648:v0 = ((byte)(v0 - v1));goto label_443;do {label_457:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v0 = v5[v6];v6 = 0;goto label_443;label_651:v0 = ((byte)(v0 * v1));goto label_443;do {label_588:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);this.B[v6] = v0;v6 = 0;goto label_443;label_654:v0 = ((byte)(v0 / v1));goto label_443;do {label_528:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);this.A[v6] = v0;v6 = 0;goto label_443;do {label_657:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v3 = v6;}do {label_471:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v5[v6] = v0;v6 = 0;goto label_443;do {label_603:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v1 = this.B[v6];v6 = 0;goto label_443;do {label_543:++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v1 = this.A[v6];v6 = 0;goto label_443;label_671:if(v0 < v1) {do {++v3;v6 = v2[v3] + v6 * 10 - 0x30;if(v2[v3 + 1] > v11) {break;}}while(v2[v3 + 1] >= v9);v3 = v6;v6 = 0;goto label_441;}label_443:++v3;goto label_441;}
}

jeb动调apk

溯源

拖进ida

int __cdecl main(int argc, const char **argv, const char **envp)
{int v3; // eaxint v4; // ecxint v5; // eaxint v6; // ebxint v7; // eaxint v8; // ediunsigned int v9; // ecxunsigned int v10; // edxint v11; // esiint v12; // eax_DWORD *v13; // ediint v14; // ecxint v15; // esivoid *v16; // esiint v17; // eaxint v18; // ebxconst char *v19; // edxint v20; // eaxvoid *v21; // ecxvoid *v22; // eaxint v24; // [esp+10h] [ebp-1008h]int v25; // [esp+14h] [ebp-1004h]int v26; // [esp+18h] [ebp-1000h] BYREFvoid *Block; // [esp+1Ch] [ebp-FFCh]int v28; // [esp+20h] [ebp-FF8h]int v29; // [esp+24h] [ebp-FF4h]int i; // [esp+28h] [ebp-FF0h]int v31; // [esp+2Ch] [ebp-FECh]void *v32[5]; // [esp+30h] [ebp-FE8h] BYREFunsigned int v33; // [esp+44h] [ebp-FD4h]char v34[4000]; // [esp+48h] [ebp-FD0h] BYREF__int128 v35[2]; // [esp+FE8h] [ebp-30h]int v36; // [esp+1014h] [ebp-4h]v3 = sub_5A1A30(std::cout, "please input key:");std::ostream::operator<<(v3, sub_5A1C60);v32[4] = 0;v33 = 15;LOBYTE(v32[0]) = 0;v36 = 0;sub_5A1D90(std::cin, v32);                    // 输入数据sub_5A1300(v32, (int)v34);sub_5A1120(&v26, (int)v34, v4);v5 = 999;LOBYTE(v36) = 1;v6 = v26;for ( i = 999; i >= 0; --i ){v7 = (unsigned __int8)byte_5A3230[v5];      // 取出数组元素v8 = 4;v31 = 4;do{v9 = v7 & 3;                              // 取出数组元素低二位v9v24 = v7 >> 2;                            // 取出数组元素高六位v24v10 = 5 - v9;v35[0] = *(_OWORD *)&dword_5A3660;if ( v9 < 2 )                             // 如果数组元素低二位小于2（即0和1）v10 = 1 - v9;v35[1] = *(_OWORD *)&word_5A3620;v11 = v28 + *((_DWORD *)v35 + 2 * v10);   // v35=[0,1,0,ff,1,0,ff,0]v12 = v29 + *((_DWORD *)v35 + 2 * v10 + 1);v25 = v11;if ( v11 >= 0 && v11 < v6 && v12 >= 0 && v12 < v6 )// 进行v11和v12的判断，这里v6是一个固定值A{v13 = (char *)Block + 4 * v29 + 4 * v28 * v6;// v13=x*10+yv14 = v12 + v11 * v6;                   // v14=y0+x0*10v15 = *((_DWORD *)Block + v14);*((_DWORD *)Block + v14) = *v13;        // v14和v13进行交换，v15作为temp*v13 = v15;v8 = v31;                               // v8和v31进行配合，进行递减v28 = v25;                              // v11赋值给v28，进行偏移赋值v29 = v12;                              // v12赋值给v29，进行偏移赋值}v7 = v24;                                 // 把右移的值赋给v7，以便下一次右移v31 = --v8;}while ( v8 );v5 = i - 1;}v16 = Block;v17 = 0;v18 = v6 * v6;if ( v18 <= 0 ){LABEL_15:v19 = "success";}else{while ( *((_DWORD *)Block + v17) == v17 ){if ( ++v17 >= v18 )goto LABEL_15;}v19 = "fail";}v20 = sub_5A1A30(std::cout, v19);std::ostream::operator<<(v20, sub_5A1C60);j_j_free(v16);if ( v33 >= 0x10 ){v21 = v32[0];if ( v33 + 1 >= 0x1000 ){if ( ((int)v32[0] & 0x1F) != 0 )invalid_parameter_noinfo_noreturn();v22 = (void *)*((_DWORD *)v32[0] - 1);if ( v22 >= v32[0] )invalid_parameter_noinfo_noreturn();if ( (unsigned int)(v32[0] - v22) < 4 )invalid_parameter_noinfo_noreturn();if ( (unsigned int)(v32[0] - v22) > 0x23 )invalid_parameter_noinfo_noreturn();v21 = (void *)*((_DWORD *)v32[0] - 1);}

正向解析

a =[0xA0, 0x8E, 0xE2, 0x80, 0xBD, 0x9E, 0x82, 0x91, 0x1D, 0xB5, 0xDF, 0x8A, 0xC8, 0x98, 0x04, 0x4C, 0x19, 0x53, 0xC5, 0xB5, 0x32, 0xCC, 0x74, 0xC6, 0x48, 0x60, 0xB7, 0xFB, 0x29, 0x3F, 0x2E, 0xFE, 0xED, 0x9B, 0x56, 0xCE, 0x74, 0x9B, 0x5E, 0x84, 0xE4, 0x36, 0xE2, 0x58, 0x68, 0x8C, 0x53, 0xF6, 0x51, 0x13, 0x91, 0xFF, 0x01, 0x8C, 0x41, 0x52, 0x47, 0x66, 0xCE, 0x22, 0x45, 0x4B, 0xE4, 0xDC, 0x68, 0x80, 0x5B, 0x4C, 0xCE, 0xC2, 0x73, 0x9E, 0x7B, 0x02, 0x04, 0x72, 0x55, 0xBD, 0x00, 0x95, 0x84, 0x2D, 0xDB, 0x99, 0x9A, 0x1F, 0xB3, 0x1E, 0x6C, 0xC7, 0xE0, 0x22, 0xDF, 0x6E, 0xEB, 0x6A, 0xB5, 0x7C, 0xAF, 0xFA, 0xD6, 0xAC, 0x2D, 0x4A, 0x93, 0x78, 0xBF, 0x3C, 0x1A, 0xD2, 0xE0, 0x2F, 0xDD, 0x46, 0x63, 0x8E, 0x14, 0x4E, 0x54, 0x53, 0xED, 0xA3, 0xD2, 0x42, 0x22, 0x8C, 0xC0, 0xFB, 0x62, 0xA6, 0x91, 0xC3, 0xF5, 0x23, 0xFE, 0xBE, 0xE5, 0x46, 0x0E, 0x15, 0xF5, 0x20, 0x0E, 0x91, 0x1B, 0x97, 0x06, 0x2B, 0x9A, 0xCD, 0x0A, 0x5B, 0x97, 0x3C, 0xE5, 0xB6, 0x1A, 0xBC, 0x7D, 0x51, 0xA0, 0xA3, 0xCF, 0x82, 0x13, 0x16, 0x90, 0x90, 0x7C, 0xAD, 0xDE, 0xB6, 0x87, 0xEF, 0x53, 0x38, 0xFA, 0xCF, 0xBA, 0xD3, 0xEE, 0x35, 0x67, 0xC6, 0x38, 0x43, 0x91, 0xDA, 0xBE, 0xC0, 0xEB, 0xD2, 0x67, 0x83, 0xE7, 0x12, 0x9C, 0x71, 0xAC, 0xB4, 0x5D, 0x9B, 0xDB, 0x60, 0x29, 0xB0, 0x1D, 0xA7, 0x21, 0x9E, 0x01, 0x0D, 0x89, 0xA6, 0x0D, 0x94, 0xC3, 0x73, 0x79, 0x81, 0xBD, 0xE8, 0x85, 0x5E, 0x29, 0x4E, 0xC3, 0x78, 0x5B, 0xBB, 0x72, 0xBB, 0x99, 0x1E, 0x33, 0xDF, 0x8E, 0xEF, 0x7F, 0x69, 0xC8, 0x2F, 0x95, 0x58, 0x41, 0xDF, 0x01, 0x04, 0x2E, 0xCB, 0xB5, 0x06, 0x26, 0xED, 0x83, 0xA7, 0x6B, 0x3C, 0xF1, 0xA1, 0x6E, 0xDD, 0xAF, 0xB5, 0xEC, 0x5A, 0xE2, 0x60, 0x16, 0x71, 0x1E, 0x87, 0x88, 0xD4, 0x1A, 0x6F, 0x83, 0x1F, 0xBB, 0x83, 0x6A, 0x47, 0x5B, 0xEB, 0xFE, 0x2B, 0x08, 0x34, 0xA6, 0x53, 0x3E, 0x97, 0x24, 0x1D, 0xFA, 0x61, 0xCA, 0x83, 0xEC, 0x9F, 0xAC, 0x28, 0x15, 0x3D, 0xC0, 0x3E, 0xAD, 0x1A, 0xBF, 0xA8, 0x79, 0x73, 0xE3, 0x25, 0xC6, 0x57, 0xEB, 0xCC, 0x33, 0x2D, 0xDC, 0x9B, 0x54, 0x68, 0x32, 0x25, 0xD4, 0x3B, 0xAF, 0xB1, 0x68, 0x9C, 0x77, 0x6E, 0xC3, 0xCA, 0xD9, 0xBC, 0xA0, 0x7A, 0x33, 0xB4, 0xEF, 0x14, 0x85, 0xE8, 0x3A, 0xEB, 0xA6, 0x44, 0x26, 0xD1, 0x04, 0xBB, 0xD1, 0x29, 0x85, 0x1C, 0xE6, 0x3C, 0xEA, 0x45, 0xC2, 0xD5, 0xD6, 0x0E, 0xCE, 0xF1, 0x3C, 0xEF, 0xA7, 0x7E, 0xD8, 0xAF, 0xB8, 0x8A, 0xE5, 0x7D, 0xFE, 0x1E, 0x32, 0x7A, 0x18, 0x04, 0x96, 0x21, 0x8B, 0x7F, 0x41, 0x3A, 0x68, 0x66, 0x50, 0x4C, 0x25, 0x1D, 0x19, 0x41, 0x0E, 0x3D, 0x3A, 0x65, 0x1E, 0x5E, 0xCD, 0xF2, 0x4E, 0x3F, 0x7C, 0xA3, 0x3C, 0x2D, 0x55, 0x00, 0x12, 0x4E, 0x4A, 0xD7, 0x31, 0x93, 0x50, 0x8A, 0xB9, 0x1E, 0x2B, 0xA9, 0x9D, 0xDF, 0xA9, 0x4D, 0x83, 0x61, 0x97, 0x4B, 0x93, 0xFB, 0x63, 0x17, 0xFB, 0x20, 0x13, 0x7A, 0xA6, 0xD1, 0x81, 0x78, 0x5A, 0xCC, 0xA5, 0x1C, 0x33, 0x4F, 0x68, 0x13, 0x1F, 0x4B, 0x6F, 0xA7, 0x25, 0xC9, 0x23, 0xF8, 0x78, 0xD7, 0xEA, 0x50, 0x52, 0xFF, 0x02, 0x5C, 0x40, 0x69, 0x03, 0x5D, 0x16, 0x27, 0x01, 0x8B, 0xE7, 0x47, 0x2E, 0xD6, 0x18, 0x43, 0x16, 0xE6, 0x03, 0xD5, 0xBC, 0x14, 0x6E, 0xB4, 0x7A, 0xED, 0x30, 0x84, 0xB8, 0xEE, 0xCD, 0x28, 0xB1, 0xC6, 0x1D, 0xC9, 0x58, 0x64, 0x66, 0xFD, 0xB2, 0x38, 0xC9, 0xDF, 0x9C, 0x69, 0xFB, 0x89, 0xEA, 0x79, 0xAB, 0xEC, 0x9A, 0xE8, 0xE4, 0xCB, 0x23, 0x83, 0xE6, 0x53, 0xB9, 0xFA, 0x44, 0xC8, 0xC0, 0x5D, 0x65, 0xDF, 0xBF, 0x4D, 0x82, 0x7A, 0xCD, 0x12, 0x64, 0x87, 0xC7, 0x44, 0x16, 0xEC, 0x3F, 0x51, 0x02, 0x9A, 0xD2, 0xDE, 0x7F, 0x12, 0x71, 0x20, 0x72, 0x12, 0x72, 0xCD, 0x01, 0x8C, 0x52, 0xB2, 0xB4, 0xE2, 0x47, 0xA5, 0x5B, 0x39, 0xF6, 0x6F, 0xA9, 0x61, 0x2D, 0xC2, 0x74, 0x7F, 0xE8, 0x7C, 0x0B, 0x45, 0x47, 0x11, 0x1A, 0x04, 0x32, 0xF1, 0x12, 0x27, 0x74, 0x51, 0x46, 0x48, 0x6D, 0x1A, 0x86, 0xCE, 0x0F, 0xF1, 0x31, 0x40, 0x61, 0x10, 0x85, 0xB0, 0x60, 0xF7, 0xB8, 0xE4, 0xEE, 0xBD, 0xB1, 0x50, 0x67, 0x49, 0x02, 0x66, 0xE8, 0x98, 0x5D, 0x02, 0x0F, 0xBE, 0x7F, 0x9D, 0x27, 0x8A, 0x5B, 0x0D, 0x96, 0xFC, 0x31, 0xC1, 0xD4, 0x91, 0xD1, 0xB4, 0x15, 0x58, 0x8C, 0xE9, 0x08, 0x71, 0xEC, 0x02, 0x76, 0x8D, 0xCC, 0x6E, 0xD1, 0x24, 0xE5, 0xD4, 0x95, 0x4C, 0x6E, 0x39, 0xA6, 0xC4, 0x16, 0x10, 0xCF, 0x62, 0x4D, 0x28, 0x9C, 0x75, 0xC0, 0x78, 0xCB, 0xAE, 0x31, 0xFB, 0x19, 0xC5, 0x8C, 0x09, 0x9C, 0xCB, 0x25, 0x15, 0x4C, 0x64, 0xB8, 0xC9, 0xF0, 0x24, 0xD6, 0xEC, 0x26, 0xB7, 0xA7, 0x1B, 0x7D, 0x96, 0xF5, 0xBA, 0xF8, 0xA3, 0xC0, 0xEC, 0x6B, 0xED, 0x68, 0x1F, 0x00, 0x2E, 0xE7, 0x89, 0x26, 0xA1, 0x49, 0x2C, 0xEB, 0xEF, 0xBB, 0x91, 0xD4, 0x6E, 0x54, 0x25, 0x9F, 0x33, 0x9B, 0x89, 0xC5, 0xAF, 0x76, 0xE1, 0x8E, 0x4D, 0x24, 0x47, 0xC6, 0x84, 0x1B, 0xD1, 0xCF, 0xA8, 0x39, 0x46, 0x0B, 0x78, 0x16, 0x73, 0x60, 0xC9, 0xA0, 0xE5, 0x5F, 0xF8, 0xB6, 0x2B, 0x18, 0x3C, 0x66, 0x77, 0x0D, 0x9F, 0x1E, 0x6F, 0xFE, 0xC3, 0x41, 0x61, 0x6F, 0xA1, 0x8C, 0x2D, 0xA0, 0x57, 0x6A, 0xC3, 0x32, 0x83, 0x36, 0x7E, 0x3C, 0xE8, 0x1D, 0x36, 0x4C, 0x44, 0x63, 0x2D, 0x6B, 0x38, 0xEE, 0xBB, 0x94, 0xF6, 0x53, 0x2A, 0x45, 0xE1, 0xF8, 0xA2, 0x11, 0x74, 0x75, 0x2F, 0xF9, 0x94, 0x96, 0x20, 0x9E, 0x89, 0x6E, 0x03, 0xDA, 0x50, 0x0D, 0x79, 0x16, 0xE3, 0x71, 0xF1, 0x9A, 0xEE, 0xBF, 0x0A, 0xF7, 0x7E, 0x3B, 0xE8, 0xFB, 0xA2, 0x31, 0x97, 0x6D, 0x12, 0xCC, 0x01, 0x65, 0xAD, 0x81, 0x70, 0xEC, 0x4B, 0x49, 0xD6, 0x62, 0xD3, 0xD8, 0xE4, 0x04, 0x64, 0x43, 0x72, 0x8F, 0x3E, 0xD4, 0xD6, 0x7C, 0xA7, 0xBD, 0x88, 0xA1, 0xE4, 0x38, 0x4D, 0xA5, 0x4C, 0xDE, 0x6F, 0x8A, 0xB8, 0xA3, 0x62, 0x71, 0x67, 0x13, 0x4A, 0x3B, 0xE9, 0xC7, 0xF2, 0x97, 0x81, 0x33, 0x0F, 0x3C, 0x66, 0xED, 0x86, 0xCD, 0x01, 0x0E, 0xD4, 0x39, 0x0D, 0xA7, 0xC1, 0xAB, 0x50, 0x85, 0xC1, 0x2E, 0xBA, 0xFB, 0x9D, 0xDE, 0xA9, 0xC9, 0xA0, 0x2C, 0xB9, 0x7B, 0x81, 0xD7, 0x48, 0xFB, 0xFA, 0xD3, 0xF2, 0x5C, 0x53, 0x8E, 0x62, 0x74, 0xBD, 0xB8, 0x5F, 0xA7, 0x8A, 0xEE, 0x7D, 0xA9, 0x89, 0x7C, 0x3C, 0x21, 0xEA, 0xA1, 0xCE, 0x8F, 0x0F, 0x1F, 0xB4, 0x36, 0xB9, 0x82, 0x4D, 0xFC, 0xED, 0x25, 0xB4, 0xDA, 0xF0, 0x11, 0x2B, 0xBD, 0xB8, 0xEE, 0xEA, 0x9A, 0xA6, 0x44, 0xCC, 0xA4, 0xD1, 0x48, 0xD4, 0x11, 0x18, 0x7B, 0x2E, 0x75, 0x84, 0x57, 0x7D, 0x1B, 0xCC, 0xBE, 0x0C, 0xBB, 0x55, 0xCA, 0x9F, 0x56, 0x29, 0xCD, 0x34, 0xEE, 0xD0, 0x58, 0x7A, 0x2E, 0x8B, 0xFC, 0x48, 0xA3, 0xA2, 0x9C, 0x7D, 0x5B, 0x9A,
]
v35=[0,1,0,-1,1,0,-1,0]
b=[0,0,0,0]
def test(l):x=0y=0for i in a[::-1]:for j in range(4):i=i//4b=i&3if(c<2):v10=1-belse:v10=5-bx0=x+v35[2*v10]y0=y+v35[2*v10+1]if(x0<0 or x0>=10 or y0<0 or y0>=10):continueelse:change(l,x*10+y,x0*10+y0)log.append([x*10+y,x0*10+y0])x=x0y=y0

逆向脚本

2017年CISCN初赛相关推荐

  1. NOIP 2017 提高组 初赛

    NOIP 2017 提高组 初赛 做题感悟. 五.完善程序,是本张试卷最简单的题目,两道题做完,大约花了10分钟.2017-10-17 18:25 对了答案,破天荒,全对. 1.(大整数除法) 有如下 ...

  2. 2023全国大学生信息安全竞赛(ciscn)初赛题解

    战队信息 安全知识 甚至不用看视频,百度就有答案.除了那个最新的美国时政,其它的ChatGPT就能回答. Misc 签到卡 关注公众号,根据提示,直接print(open('/flag').read( ...

  3. 2021年CISCN初赛re

    文章目录 glass.apk 直接分析jni的函数: baby.bc .bc转换为可执行程序 fill_number(__int64)input) docheck(input, input):z3约束 ...

  4. 2017 蓝桥杯初赛 分巧克力

    资源限制 时间限制:1.0s 内存限制:256.0MB 问题描述 儿童节那天有K位小朋友到小明家做客.小明拿出了珍藏的巧克力招待小朋友们. 小明一共有N块巧克力,其中第i块是Hi x Wi的方格组成的 ...

  5. CSP-J CSP-S初赛相关知识汇总

    [计算机科学速成课][40集全/精校] - Crash Course Computer Science [计算机科学速成课][40集全/精校] - Crash Course Computer Scie ...

  6. 2022年 CSP-J1 CSP-S1 初赛 如何进行复习 如何做题

    第一题 单选题: 这个包含了2018年及以前年份的的单选或不定项选择(提高组 初赛) 以及问题求解题等考点 这一部分建议直接做历年的真题就可以了,至少要做最近的5年真题 做题的顺序:由最近往前做,也就 ...

  7. 北邮2018计算机院考研复试机试上机题解+结果统计

    昨天刚考完,oj上题目已经看不了了,不过交的代码都还在,趁热回忆一下 整体情况: 共169人,第四题全军覆没,8人3A,77人2A,40人1A,44人0A. 最后的排行榜(id截掉了): proble ...

  8. HDU 6114 Chess 【组合数】（2017百度之星程序设计大赛 - 初赛（B））

    Chess Time Limit: 2000/1000 MS (Java/Others)    Memory Limit: 32768/32768 K (Java/Others) Total Subm ...

  9. [蓝桥杯2017初赛]跳蚱蜢-map标记+bfs+环形数组

    解题思路: 这题如果我们考虑蚱蜢跳,有很多蚱蜢,有很多情况,所以我们让空盘跳,这样就简化题目了,然后我们化圆为直,将题目的情况看成字符串012345678,最后要变成087654321,这样题目就变得 ...

最新文章

  1. 数据分析索引总结（上）Pandas单级索引
  2. C语言 · 求矩阵各个元素的和
  3. android频道编辑实现_短说频道功能详解—构建你社区的小门户
  4. python调用系统命令_Python如何调用外部系统命令
  5. TensorBoard使用
  6. jdbc的预处理中如何处理模糊查询
  7. Linux 写入ntfs很慢,ntfs-3g 写入 速度优化
  8. 想多赚点钱，一个最简单的办法，找到适合自身的坑
  9. 多对多关联映射（双向关联）见项目：me_many_to_many
  10. 自学-Linux-老男孩Linux77期-day5
  11. Axure 8.0破解版下载
  12. 如何将一个服务器加入域控中,Windows Server如何创建域并加入域
  13. Linux系列（五）、Vim编辑器的使用、账号用户组的管理、磁盘管理、进程管理
  14. 阿里云 linux nginx 环境配置 该网页无法正常运作
  15. 用python画皮卡丘的代码-用python画一只可爱的皮卡丘
  16. STM32HAL库-移植mbedtls开源库示例（一）
  17. ora-00257报错解决办法
  18. bootstrapt学习指南_Bootstrap学习文档（一）
  19. 触发器详解——（二）JK触发器
  20. 2019年淘宝运营里中小卖家需要掌握的技能！

热门文章

  1. 苹果原壁纸高清_苹果壁纸 | 高清图片全面屏壁纸
  2. 三国志战略版360区S4服务器合并信息,三国志战略版S2赛季合区须知，季转服功能介绍...
  3. SWIG：SWIG的简介、安装、使用方法之详细攻略
  4. 成功解决(Win32): 已加载“C:\Windows\SysWOW64\ntdll.dll”。无法查找或打开 PDB 文件。
  5. Interview：算法岗位面试—11.07早上上海某机器人公司(上市)面试之项目考察、比赛考察、图像算法的考察等
  6. AI英特尔杯公开课：2019.06.27在线直播《研究生人工智能创新大赛—AI赋能，创新引领》课堂笔记和感悟(一)
  7. DL之LiRDNNCNN：利用LiR、DNN、CNN算法对MNIST手写数字图片(csv)识别数据集实现(10)分类预测
  8. Py之wxPython：利用wxPython设计CMD软件窗口进行交互可视化
  9. Web应用开发技术(2)-html
  10. Mysql常用函数之Concat函数