{"id":1244,"date":"2025-01-15T18:05:28","date_gmt":"2025-01-15T10:05:28","guid":{"rendered":"https:\/\/blog.shangwendada.top\/?p=1244"},"modified":"2025-01-16T16:47:14","modified_gmt":"2025-01-16T08:47:14","slug":"suctf2025su_appsu_harmony%e5%87%ba%e9%a2%98%e5%b0%8f%e8%ae%b0","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2025\/01\/15\/suctf2025su_appsu_harmony%e5%87%ba%e9%a2%98%e5%b0%8f%e8%ae%b0\/","title":{"rendered":"[SUCTF2025]SU_APP,SU_Harmony\u51fa\u9898\u5c0f\u8bb0"},"content":{"rendered":"

\u524d\u8a00<\/h2>\n

\u672c\u6b21SUCTF\u4e3b\u8981\u63d0\u4f9b\u4e86\u4e24\u9053\u8d5b\u9898\uff08\u867d\u7136\u88ab\u9a82\u8fa3\uff09\uff0c\u4f46\u662f\u8fd8\u662f\u5206\u4eab\u4e00\u4e0b\u51fa\u9898\u601d\u8def\uff0c\u4ee5\u53ca\u89e3\u9898\u601d\u8def\u3002<\/p>\n

SU_APP<\/h2>\n

\u672c\u9898\u4e3b\u8981\u662f\u81ea\u5b9a\u4e49linker\u52a0\u56faso\uff0c\u7136\u540e\u8fd8\u6709\u4e00\u4e2affi\u52a8\u6001\u8c03\u7528\u7684\uff0c\u5269\u4e0b\u7684\u5c31\u662f\u5e38\u89c1\u7684\u7ea6\u675f\u6c42\u89e3\u4e86\u3002linker\u6765\u81ea\u4e8engiokweng\uff0c\u4e0d\u5f97\u4e0d\u8bf4ngiokweng\u5927\u4f6c\u5bf9\u4e8eELF\u52a0\u8f7d\u6d41\u7a0b\u7684\u719f\u7ec3\u5ea6\u662f\u771f\u7684\u9ad8\u3002<\/p>\n

\u81ea\u5b9e\u73b0linker\u52a0\u56fa\u8be6\u60c5\u53ef\u89c1\uff1ahttps:\/\/bbs.kanxue.com\/thread-282316.htm<\/a>
\n\u53e6\u5916\uff1a\u8fd9\u9898\u6211\u4e3b\u8981\u8fd8\u662f\u60f3\u8003\u52a8\u6001\u7684\u4e00\u4e9b\u5904\u7406\u65b9\u5f0f\uff0c\u6bd4\u5982\u8bf4\u8fc7hook\u68c0\u6d4b\u53bbhook\u90a3\u4e2a\u9b54\u6539\u7684md5\u7ed3\u679c\u6216\u8005\u76f4\u63a5\u62ff\u5230RC4\u5904\u7406\u540e\u7684Sbox\u7684\uff0c\u6240\u4ee5\u5c31\u8bde\u751f\u4e86\u90a3\u4e2amd5\u7684\u9b54\u6539\uff0c\u5e76\u4e0d\u662f\u6211\u4e3a\u4e86\u9b54\u6539\u800c\u9b54\u6539\uff08\u5e08\u5085\u4eec\u522b\u9a82\u8fa3\u3002<\/p>\n

\u53e6\u5916\u672c\u9898\u5b58\u5728\u4e00\u4e9b\u91ca\u653e\u9759\u6001\u8d44\u6e90\u7684\u884c\u4e3a\uff0c\u53ef\u80fd\u9ad8\u7248\u672c\u7684\u624b\u673a\u5fc5\u987b\u5f97\u5f39\u7a97\u8bf7\u6c42\u6388\u6743\u624d\u53ef\u4ee5\uff0c\u6240\u4ee5\u4f1a\u5bfc\u81f4\u5d29\u6e83\uff0c\u4f46\u5176\u5b9e\u8fd9\u6837\u7684\u8bdd\u624b\u52a8\u91ca\u653e\u4e00\u4e0bassets\u53ef\u80fd\u5c31\u53ef\u4ee5\u907f\u514d\u8fd9\u4e2a\u95ee\u9898\u4e86\u3002\u8fd8\u6709\u4e00\u4e9b\u5947\u5947\u602a\u602a\u7684\u5d29\u6e83\u95ee\u9898\u4e5f\u53ef\u80fd\u662finlinehook\u8bef\u68c0\u6d4b\u5bfc\u81f4\u7684\uff0c\u5176\u5b9e\u5728\u8fd9\u91cc\u6574\u4e2aAPP\u7684log\u6211\u662f\u6ca1\u6709\u5220\u9664\u7684\uff1a
\n

\"file\"<\/div>
\n\u5982\u679c\u5728logcat\u4e2d\u80fd\u770b\u5230GO!\u90a3\u4e48\u57fa\u672c\u662f\u68c0\u6d4b\u95ee\u9898
\n\u7531\u4e8e\u6211\u53ea\u6709RedMi 10X\u548cPixel2\u53ef\u4ee5\u6d4b\u8bd5\uff0c\u5c31\u6ca1\u6709\u9002\u914d\u66f4\u591a\u7684\u6536\u96c6\u4e86\uff08\u8003\u8651\u7684\u4e0d\u591f\u5468\u5230\uff0c\u7ed9\u5404\u4f4d\u78d5\u4e00\u4e2a\u3002<\/p>\n

\u8a00\u5f52\u6b63\u4f20\uff0c\u63a5\u4e0b\u6765\u4ece\u51fa\u9898\u4eba\u7684\u8bbe\u8ba1\u601d\u8def\u4e0a\u53bb\u770b\u770b\u5982\u4f55\u89e3\u51b3\u8fd9\u9053\u9898\u3002<\/p>\n

Java\u5c42\u5206\u6790<\/h3>\n

\"file\"<\/div>
\n\u5f88\u7b80\u5355\u53ef\u4ee5\u53d1\u73b0\uff0cJava\u5c42\u5176\u5b9e\u5c31\u53ea\u662f\u505a\u4e86\u4e00\u4e0b\u7b7e\u540d\u9a8c\u8bc1\uff0c\u91ca\u653e\u9759\u6001\u8d44\u6e90\uff0c\u4ee5\u53ca\u8c03\u7528Native\u5c42\u7684\u9a8c\u8bc1\u65b9\u6cd5\uff0c\u4e3b\u8981\u903b\u8f91\u90fd\u5728\u4e8eNative\u5c42\u4e2d\uff0c\u6ce8\u518c\u4e86\u4e00\u4e2a\u53eb\u505aCheck\u7684\u65b9\u6cd5\u3002<\/p>\n

Native\u5c42\u5206\u6790<\/h3>\n

\u9759\u6001\u5206\u6790so\u7684\u5904\u7406\u8fc7\u7a0b<\/h4>\n

\u9996\u5148\u5bf9\u4e8e\u8fd9\u4e2aNative\u5c42\uff0c\u53ef\u4ee5\u770b\u5230\u4e00\u4e2aMainActivty_check\uff08\u4e0d\u77e5\u9053\u5927\u5bb6\u6709\u6ca1\u6709\u88ab\u9a97\u5230\u5462O\u3002o
\n

\"file\"<\/div>
\n\u5176\u5b9e\u4e0d\u96be\u53d1\u73b0\u8fd9\u4e2aMainActivty_check\u5c11\u4e86\u70b9\u4e1c\u897f\uff0c\u76f8\u8f83\u4e8e\u6b63\u5e38\u7684\u5c11\u4e86\u4e00\u4e2a"i"\uff0c\u559c\u559c\u3002
\n\u90a3\u4e48\u5176\u5b9e\u6211\u4eec\u9700\u8981\uff0c\u53bb\u5206\u6790JniOnload:<\/p>\n

\"file\"<\/div>
\n\u5728JniOnload\u91cc\u9762\u627e\u5230\u4e86\u4e00\u4e2a\u6ce8\u518c\u7684\u65b9\u6cd5\uff0c\u6211\u4eec\u770b\u770b\u5177\u4f53\u903b\u8f91
\n\u5982\u4e0b\u51fd\u6570\u8fdb\u884c\u4e86\u4e00\u4e2aloader\u884c\u4e3a
\n
\"file\"<\/div>
\n
\"file\"<\/div>
\n\u6839\u636e\u4e0b\u9762\u7684\u7279\u5f81\u7b49\u4e5f\u53ef\u4ee5\u53d1\u73b0\u662f\u4e00\u4e2a\u81ea\u5b9a\u4e49\u7684linker
\n
\"file\"<\/div>
\n\u90a3\u4e48loader\u4e86\u4ec0\u4e48\u5462\uff1f
\n\u5728\u4e4b\u524d\u7684\u4ee3\u7801\u4e2d\u5176\u5b9e\u5df2\u7ecf\u4f53\u73b0\u51fa\u6765\u4e86\uff1a
\n
\"file\"<\/div>
\nfiles\u4e0b\u9762\u7684main\uff0c\u90a3\u4e48\u8fd9\u4e2a\u662f\u54ea\u513f\u6765\u7684\u5462\uff1f
\n
\"file\"<\/div>
\n\u6b38\u563f\uff0c\u5176\u5b9e\u5c31\u662fasssets\u91cc\u7684main\u8fa3\u3002
\n\u597d\uff0c\u90a3\u4e48\u6211\u4eec\u7ee7\u7eed\u770b\u4e00\u770bmain\u662f\u4e2a\u4ec0\u4e48\u73a9\u610f\u3002
\n
\"file\"<\/div>
\n\u6559\u7ec3\uff0c\u600e\u4e48\u662f\u4e2ax86\uff1f
\n
\"file\"<\/div>
\n\u4e14\u542c\u6211\u7ec6\u7ec6\u9053\u6765\uff1a
\n
\"file\"<\/div>
\n\u5927\u5bb6\u53ef\u4ee5\u5173\u6ce8\u4e00\u4e0bngiokweng\u7684\u81ea\u5b9e\u73b0linker\u7684\u4ee3\u7801\uff0c\u6211\u5728\u5176\u4ee3\u7801\u4e0a\u505a\u4e86\u4e00\u90e8\u5206\u7684\u6539\u52a8
\n
\"file\"<\/div>
\n\u53ef\u4ee5\u770b\u5230\u6700\u4e3b\u8981\u7684\u6539\u52a8\u5728\u6620\u5c04main\u7684\u5185\u5b58\u7684\u65f6\u5019\uff0c\u8fd9\u91cc\u5176\u5b9e\u8df3\u8fc7\u4e86\u524d\u97620x91f0\u5b57\u8282\u7684\u6620\u5c04\uff0c\u6070\u6070\u8fd9\u4e2a0x91f0\u7684\u5927\u5c0f\u5c31\u662f\u524d\u9762\u7684x86\u7a0b\u5e8f\u7684\u5927\u5c0f\u3002
\n\u5728IDA\u4e2d\u7684\u8bd5\u56fe\u5982\u4e0b\uff1a
\n
\"file\"<\/div>
\n\u90a3\u4e48\u5176\u5b9e\u4f7f\u7528010\u6253\u5f00main\u6211\u4eec\u5c31\u80fd\u53d1\u73b0\u7aef\u502a\u4e86\u3002
\n\u770b\u52300x91f0\u7684\u4f4d\u7f6e\u51fa\u73b0\u4e86\u4e00\u4e2aSUCTF{You_Find_Me}\uff0c\u8fd9\u597d\u50cf\u4e5f\u4e0d\u592a\u5bf9\uff0c\u6211\u4eec\u7ee7\u7eed\u5f80\u540e\u770b\u3002
\n
\"file\"<\/div>
\n\u6211\u4eec\u67e5\u770b\u504f\u79fb\u540e\u7684\u5185\u5b58\u88ab\u4f20\u5230\u54ea\u513f\u53bb\u4e86
\n
\"file\"<\/div>
\n\u4f1a\u53d1\u73b0\u5728sub_21EE4\u91cc\u9762\u6709\u4e00\u4e2a\u975e\u5e38\u53ef\u4ee5\u7684\u64cd\u4f5c\uff1a
\n
\"file\"<\/div>
\n\u8fd9\u91ccveorq_s8<\/a>
\n\u662f\u4e2a\u975e\u5e38\u5178\u578b\u7684\u5411\u91cf\u64cd\u4f5c\uff0c\u6211\u4eec\u770b\u770b\u4ed6\u90fd\u5e72\u4e9b\u5565\uff1a
\n
\"file\"<\/div>
\n\u4e3b\u8981\u505a\u4e86\u4e00\u4e2a\u5f02\u6216\u64cd\u4f5c\uff0c\u5728\u4ee3\u7801\u4e2d\u663e\u7136\u5c31\u662f\u5f02\u62160x3c\uff0c\u6211\u4eec\u770b\u770b\u8fd9\u4e2astru\u5f02\u6216\u4e4b\u540e\u662f\u4ec0\u4e48\u5462
\n
\"file\"<\/div>
\n
\"file\"<\/div>
\n7f 45 4c \u54c8\u54c8\u54c8\uff0cELF\u5934\uff01
\n\u90a3\u4e48\u5176\u5b9e\u89e3\u5bc6\u5934\u5c31\u662f\u5728\u8fd9\u91cc\u4e86<\/p>\n

[\u5c0f\u58f0\u8bf4]\uff1a\u5176\u5b9e\u8fd9\u4e2aELF\u5934\u662f\u4e13\u95e8\u7559\u7ed9\u5927\u5bb6\u4fee\u590d\u8fd9\u4e2aso\u6587\u4ef6\uff0c\u4e0d\u7528\u5927\u5bb6\u53bb\u8ba1\u7b97\u504f\u79fb\u5730\u5740\u5565\u7684\u4fee\u590delf\u5934\u4e86\u3002<\/p>\n

\"file\"<\/div><\/p>\n

\u4e0b\u9762\u6709\u4e00\u4e2a504\u957f\u5ea6\u7684\u8d4b\u503c\u5c31\u4e0d\u7528\u6211\u591a\u8bf4\u4e86\u5427\uff0c\u4fee\u590d\u5b8celf\u5934\u7684\u8bdd\u4f60\u770b\u5230\u7a0b\u5e8f\u5934\u6570\u91cf\u67099\u4e2a\u5176\u5b9e504\u6b63\u597d\u5c31\u662f9*0x38\u8fd9\u4e2a\u5c31\u662f\u5728\u56de\u586b\u6211\u4eec\u7684\u7a0b\u5e8f\u5934\u4e86\u3002<\/p>\n

\u505a\u5b8c\u8fd9\u4e9b\u5176\u5b9e\u6211\u4eec\u7684ELF\u6587\u4ef6\u5c31\u80fd\u4fee\u597d\u4e86\uff0c\u4f46\u662f\u8fd9\u91cc\u662f\u9996\u5148\u5e26\u5927\u5bb6\u9759\u6001\u5206\u6790\u4e00\u4e0b\uff0c\u90a3\u4e48\u5176\u5b9e\u8fd8\u662f\u6709\u52a8\u6001\u4e00\u628a\u68ad\u7684\u529e\u6cd5\u7684\u3002<\/p>\n

frida dumpso<\/h4>\n

\u9996\u5148\u9488\u5bf9\u4e00\u4e0b\u8fd9\u4e2afrida\u68c0\u6d4b\uff0c\u5176\u5b9e\u5c31\u662f\u4e00\u4e2ainlinehook\u7684\u68c0\u6d4b\u68c0\u6d4b\u7684libc\u4e2d\u7684signal\uff0c\u5176\u5b9e\u8fd9\u5c31\u662ffrida\u7684\u4e00\u4e2a\u5c0f\u7279\u5f81\u4e86\u3002\u53ef\u80fd\u6709\u4e00\u4e9b\u7c7b\u4f3c\u4e8evivo\u4e4b\u7c7b\u7684\u5382\u5546\u4ed6\u4eec\u542f\u52a8\u5d29\u6e83\u53ef\u80fd\u5c31\u5b58\u5728\u5382\u5546\u81ea\u5df1\u9b54\u6539\u4e86\u6216\u8005\u5565\u7684\u53ef\u80fd\u6027\uff0c\u8fd9\u91cc\u6211\u6ca1\u6709\u54cd\u5e94\u7684\u624b\u673a\uff0c\u5c31\u4e0d\u592a\u597d\u6d4b\u8bd5\u4e86\u3002
\n

\"file\"<\/div>
\n\u6bd4\u8f83\u70b9\u5728\u8fd9\u91cc\uff0c\u5176\u5b9e\u53ea\u9700\u8981hook\u6389\u8fd9\u4e2a\u70b9\u5c31OK\u4e86\u3002
\n\u4e0b\u9762\u662f\u4e00\u4e2ahook fread\u7684\u901a\u7528\u65b9\u6cd5\uff1a<\/p>\n
function hook_memcmp_addr() {\n    var memcmp_addr = Module.findExportByName("libc.so", "fread");\n    if (memcmp_addr !== null) {\n        console.log("fread address: ", memcmp_addr);\n        Interceptor.attach(memcmp_addr, {\n            onEnter: function (args) {\n                this.buffer = args[0];  \n                this.size = args[1];   \n                this.count = args[2];   \n                this.stream = args[3];  \n            },\n            onLeave: function (retval) {\n                if (this.count.toInt32() == 8) {\n                    Memory.writeByteArray(this.buffer, [0x50, 0x00, 0x00, 0x58, 0x00, 0x02, 0x1f, 0xd6]);\n                    retval.replace(8); \n                }\n            }\n        });\n    } else {\n\n    }\n}<\/code><\/pre>\n
\u6709\u4e86\u8fd9\u4e2a\u4e4b\u540e\u6211\u4eec\u5c31\u662f\u4e00\u5957\u5f88\u57fa\u7840\u7684\u6d41\u7a0b\u6765hook\u4e86\uff1a
\n\u9996\u5148hook android_dlopne_ext \u6765hook\uff0clibsuapp\u3002
\nNative hook\u4ec0\u4e48\u903b\u8f91\u54b1\u5148\u4e0d\u8bf4<\/p>\n
function Hookdlopenext() {\n    hook_memcmp_addr()\n\n    var dlopen = Module.findExportByName(null, "android_dlopen_ext");\n    Interceptor.attach(dlopen, {\n        onEnter: function (args) {\n            var filePath = args[0].readCString();\n\n            if (filePath.indexOf("suapp") != -1) {\n                this.isCanHook = true;\n\n            }\n        }, onLeave: function (retValue) {\n            if (this.isCanHook) {\n                this.isCanHook = false;\n                NativeHook();\n\n            }\n        }\n    })\n}\n\nsetImmediate(Hookdlopenext);<\/code><\/pre>\n
\u8fd9\u4e00\u5957hook\u4e0a\u4e86\u4e4b\u540e\u6211\u4eec\u5c3d\u91cf\u662f\u7a0d\u7b49\u4e00\u4e0b\u5728\u8fdb\u884cdump\u64cd\u4f5c
\ndump\u7684\u4ee3\u7801\uff1a<\/p>\n
function dump_so(so_name) {\n    var libso = Process.getModuleByName(so_name);\n    console.log("[name]:", libso.name);\n    console.log("[base]:", libso.base);\n    console.log("[size]:", ptr(libso.size));\n    console.log("[path]:", libso.path);\n    var file_path = "\/sdcard\/Download\/" + libso.name + "_" + libso.base + "_" + ptr(libso.size) + ".so";\n    var file_handle = new File(file_path, "wb");\n    if (file_handle && file_handle != null) {\n        Memory.protect(ptr(libso.base), libso.size, 'rwx');\n        var libso_buffer = ptr(libso.base).readByteArray(libso.size);\n        file_handle.write(libso_buffer);\n        file_handle.flush();\n        file_handle.close();\n        console.log("[dump]:", file_path);\n    }\n\n}\n<\/code><\/pre>\n
\"file\"<\/div>
\ndump\u4e0b\u6765\u4e4b\u540e\u6211\u4eec\u518d\u4ecedump\u7684\u8def\u5f84\u91cc\u9762pull\u4e0b\u6765
\n
\"file\"<\/div>
\n\u62ff\u5230\u4e4b\u540e\u6211\u4eec\u5728\u6839\u636e\u4e4b\u524d\u8bf4\u7684\uff0c\u628a\u5185\u5b58\u4e2d\u7684\u5934\u586b\u5145\u56de\u53bb
\n\u4f7f\u7528\u5982\u4e0bIDApython\u62ff\u5230ELF\u5934<\/p>\n
addr = 0x4D2D0\nfor i in range(addr,addr + 0x40):\n    print(hex(get_wide_byte(i)^0x3c),end=" ")\n<\/code><\/pre>\n
\"file\"<\/div>
\npatch\u8fdb\u53bb\u5c31\u597d\u4e86\u3002
\n\u63a5\u4e0b\u6765\u4fee\u590d\u7a0b\u5e8f\u5934\uff1a<\/p>\n
addr = 0x4D0D0\nfor i in range(addr,addr + 0x40):\n    print(hex(get_wide_byte(i)),end=" ")<\/code><\/pre>\n
\"file\"<\/div>
\n\u4fee\u590d\u597d\u4e86\u4e4b\u540e\u6211\u4eecida\u6253\u5f00\u5c31\u53ef\u4ee5\u53cd\u7f16\u8bd1\u4e86\uff1a
\n
\"file\"<\/div>
\n\u4f46\u662f\u5f88\u4e71So\u770b\u8d77\u6765\u6ca1\u6709\u7b26\u53f7\u8868\uff0cdump\u4e0b\u6765\u7684so\u5bfc\u5165\u5bfc\u51fa\u8868\u4f4d\u7f6e\u4e0d\u6b63\u786e\u9700\u8981\u4fee\u6b63\u504f\u79fb\uff0c\u5982\u4f55\u4fee\u590d\u5462\uff1f
\n\u9700\u8981\u7528\u5230SoFixer<\/a>\u6765\u4fee\u590d\u4e00\u4e0b<\/p>\n
.\\SoFixer-Windows-64.exe -s .\\libsuapp.so_0x7d248e7000_0x25000.so -o libsuapp.sofix -m 0x7d248e7000 -d<\/code><\/pre>\n
\"file\"<\/div>
\n\u63a5\u4e0b\u6765\u5c31\u53ef\u4ee5\u4e00\u7779\u6211\u4eecCheck\u51fd\u6570\u7684\u771f\u5bb9\u4e86
\n
\"file\"<\/div><\/p>\n
getFlag<\/h4>\n
\u5509\uff0c\u597d\u61d2\uff0c\u4e0d\u60f3\u6253\u5b57\uff0c\u8fd9\u8be5\u5982\u4f55\u662f\u597d\uff0c\u5c31\u8ba9chatGPT\u6765\u5f53\u9ed1\u5974\u5427\u3002
\n
\"file\"<\/div>
\n\u56de\u590d\u6765\u81ea\u4e8eGPT\uff1a
\n
\"file\"<\/div>
\n\u8fd9\u56de\u590d \u6709\u70b9\u8bf4\u4e86\u548c\u6ca1\u8bf4\u4e00\u6837\uff0c\u5509\u7b97\u4e86\uff0c\u770b\u6765\u662f\u4e0d\u80fd\u5077\u61d2\u4e86\u3002
\n
\"file\"<\/div>
\n\u9996\u5148\u83b7\u53d6\u6765\u81ea\u4e8eJni\u7684input\u5b57\u7b26\u4e32\uff0c\u7136\u540e\u6821\u9a8c\u957f\u5ea6\u4e4b\u540e\u5f00\u59cb\u5224\u65ad\uff0c\u6bcf\u6b21\u83b7\u53d6\u516d\u4e2a\u6765\u81ea\u4e8esub_a158\u7684\u8fd4\u56de\u503c
\nsub_a158\u7684\u903b\u8f91\u5f88\u591a\u5927\u4f6c\u90fd\u5206\u6790\u8fc7\u4e86\uff0c\u901a\u8fc7\u9b54\u6539\u7684md5\u4ea7\u751fkey\uff0c\u7136\u540e\u521d\u59cb\u5316\u4e00\u4e2arc4\u901a\u8fc7rc4\u4ea7\u751f\u4e00\u4e2a\u4f2a\u968f\u673a\u6d41\u6765\u5f62\u6210\u6211\u4eec\u7684\u63a7\u5236\u6d41\u3002
\n\u63a5\u4e0b\u6765\u7ee7\u7eed\u770b\u903b\u8f91<\/p>\n
\"file\"<\/div>
\n\u6839\u636ev7\u5728off_21680\u53d6\u51fd\u6570\u6307\u9488\u6765\u83b7\u53d6\u5bf9\u5e94\u7684\u52a0\u5bc6\u51fd\u6570\uff0c\u6211\u4eec\u770b\u4e00\u770b21680\u662f\u4ec0\u4e48\u73a9\u610f
\n
\"file\"<\/div>
\n
\"file\"<\/div>
\n\u662f\u4e00\u4e2a\u51fd\u6570\u7ed3\u6784\u4f53\uff0c\u7b2c\u4e00\u4e2a\u662f\u51fd\u6570\u6307\u9488\uff0c\u7b2c\u4e8c\u4e2a\u662f\u51fd\u6570\u7684\u53c2\u6570\u6570\u91cf\uff0c\u81f3\u4e8e\u600e\u4e48\u77e5\u9053\u7b2c\u4e8c\u4e2a\u662f\u53c2\u6570\u6570\u91cf\u7684\uff0c\u53ef\u4ee5\u5728\u4e3b\u903b\u8f91\u4e2d\u627e\u5230\uff08\u5b9e\u5728\u662f\u4e0d\u60f3\u6253\u5b57\u4e86\uff0c\u592a\u7d2f\u4e86\u3002
\n\u63a5\u4e0b\u6765\u6211\u4eec\u53ef\u4ee5\u4fee\u590d\u4e00\u4e0b\u8fd9\u4e2a\u7ed3\u6784\u4f53\uff1a
\n\u5927\u6982\u662f\u8fd9\u4e2a\u6837\u5b50\uff1a<\/p>\n
typedef int (*Func1)(int, int, int);\ntypedef int (*Func2)(int, int, int, int);\ntypedef int (*Func3)(int, int, int, int, int);\n\ntypedef struct {\n    union {\n        Func1 func1;  \/\/ Function with 1 parameter\n        Func2 func2;  \/\/ Function with 2 parameters\n        Func3 func3;  \/\/ Function with 3 parameters\n    } func;\n    int param_count;  \/\/ Number of parameters\n} OperationFunction;<\/code><\/pre>\n
\u6211\u4eec\u53ea\u9700\u8981\u5bfc\u5165\u8fdb\u53bb\u5c31\u597d\u4e86
\n
\"file\"<\/div>
\n\u627e\u5230Local Types\u754c\u9762\uff0c\u662f\u7531\u5feb\u6377\u952e\u53ef\u4ee5\u6253\u5f00\u7684Shif+F1
\n
\"file\"<\/div>
\n\u70b9\u51fb\u952e\u76d8\u4e0a\u7684insert\uff0c\u5c31\u53ef\u4ee5\u52a0\u5165\u7ed3\u6784\u4f53\u4e86
\n
\"file\"<\/div>
\n
\"file\"<\/div>
\n\u5927\u6982\u5c31\u662f\u8fd9\u6837\uff0c\u4e0d\u4fee\u590d\u4e5f\u6ca1\u5173\u7cfb\uff0c\u53cd\u6b63\u5c31\u662f\u901a\u8fc7sub_a158\u7684\u8fd4\u56de\u503c\u53bb\u53bb\u76f8\u5bf9\u5e94\u7684\u65b9\u6cd5\uff0c\u7136\u540esub_a158\u7684\u8fd4\u56de\u503c\u4f5c\u4e3a\u53c2\u6570\u4e86\uff0c\u63a5\u4e0b\u6765\u5c31\u662f\u8981\u83b7\u53d6\u8fd4\u56de\u503c\u4e86\u3002
\n\u6211\u4eec\u53ea\u9700\u8981\u83b7\u53d6\u4e86sub_a158\u7684\u8fd4\u56de\u503c\u5c31\u53ef\u4ee5\u590d\u73b0\u63a7\u5236\u6d41\u4e86\u3002
\n\u6211\u4eec\u901a\u8fc7frida\u5bf9\u4e8esub_a158\u8fdb\u884chook\uff0c\u83b7\u53d6\u4ed6\u7684\u8fd4\u56de\u503c\uff1a<\/p>\n
function NativeHook() {\n    var base = Module.getBaseAddress("libsuapp.so");\n    console.log("[Base]->", base);\n    Interceptor.attach(base.add("0xA158"), {\n        onEnter: function (args) {\n\n        },\n        onLeave: function (retval) {\n            randcode.push(retval.toInt32())\n        }\n    });\n    Interceptor.attach(base.add("0x9FA8"), {\n        onEnter: function (args) {\n            console.log(randcode);\n\n            console.log(randcode.length);\n            while (randcode.length) {\n                randcode.pop();\n            }\n        },\n        onLeave: function (retval) {\n\n        }\n    });\n}<\/code><\/pre>\n
\u5b8c\u6574\u811a\u672c\u5982\u4e0b\uff1a<\/p>\n
\nfunction hook_memcmp_addr() {\n    var memcmp_addr = Module.findExportByName("libc.so", "fread");\n    if (memcmp_addr !== null) {\n        console.log("fread address: ", memcmp_addr);\n        Interceptor.attach(memcmp_addr, {\n            onEnter: function (args) {\n                this.buffer = args[0];  \n                this.size = args[1];   \n                this.count = args[2];   \n                this.stream = args[3];  \n            },\n            onLeave: function (retval) {\n                if (this.count.toInt32() == 8) {\n                    Memory.writeByteArray(this.buffer, [0x50, 0x00, 0x00, 0x58, 0x00, 0x02, 0x1f, 0xd6]);\n                    retval.replace(8); \n                }\n            }\n        });\n    } else {\n\n    }\n}\n\nvar randcode = [];\nfunction dump_so(so_name) {\n    var libso = Process.getModuleByName(so_name);\n    console.log("[name]:", libso.name);\n    console.log("[base]:", libso.base);\n    console.log("[size]:", ptr(libso.size));\n    console.log("[path]:", libso.path);\n    var file_path = "\/sdcard\/Download\/" + libso.name + "_" + libso.base + "_" + ptr(libso.size) + ".so";\n    var file_handle = new File(file_path, "wb");\n    if (file_handle && file_handle != null) {\n        Memory.protect(ptr(libso.base), libso.size, 'rwx');\n        var libso_buffer = ptr(libso.base).readByteArray(libso.size);\n        file_handle.write(libso_buffer);\n        file_handle.flush();\n        file_handle.close();\n        console.log("[dump]:", file_path);\n    }\n\n}\n\nfunction NativeHook() {\n    var base = Module.getBaseAddress("libsuapp.so");\n    console.log("[Base]->", base);\n    Interceptor.attach(base.add("0xA158"), {\n        onEnter: function (args) {\n\n        },\n        onLeave: function (retval) {\n            randcode.push(retval.toInt32())\n        }\n    });\n    Interceptor.attach(base.add("0x9FA8"), {\n        onEnter: function (args) {\n            console.log(randcode);\n\n            console.log(randcode.length);\n            while (randcode.length) {\n                randcode.pop();\n            }\n        },\n        onLeave: function (retval) {\n\n        }\n    });\n\n}\n\nfunction Hookdlopenext() {\n    hook_memcmp_addr()\n\n    var dlopen = Module.findExportByName(null, "android_dlopen_ext");\n    Interceptor.attach(dlopen, {\n        onEnter: function (args) {\n            var filePath = args[0].readCString();\n\n            if (filePath.indexOf("suapp") != -1) {\n                this.isCanHook = true;\n\n            }\n        }, onLeave: function (retValue) {\n            if (this.isCanHook) {\n                this.isCanHook = false;\n                NativeHook();\n\n            }\n        }\n    })\n}\n\nsetImmediate(Hookdlopenext);\n<\/code><\/pre>\n
\u4f46\u662f\u7531\u4e8eso\u662flinker\u7684\u4e00\u5f00\u59cb\u53ef\u80fdhook\u4e0d\u5230\u5f97\u9700\u8981\u91cd\u65b0\u8f7d\u5165\u4e00\u4e0bNativeHook()
\n
\"file\"<\/div>
\n\u8fd9\u6837\u5c31\u53ef\u4ee5\u4e86
\n\u63a5\u4e0b\u6765\u8f93\u516532\u4f4dflag\u957f\u5ea6\uff08\u4e3a\u4ec0\u4e4832\uff0c\u5728\u4ee3\u7801\u4e2d\u6709\uff0c\u5224\u65ad\u4e8632
\n
\"file\"<\/div>
\n\u63a5\u4e0b\u6765\u6211\u4eec\u5c31\u83b7\u53d6\u5230opcode\u4e86
\n\u5982\u4f55\u5904\u7406\u5462\uff0c\u8fa3\u4e48\u591a\u903b\u8f91\uff0c\u5176\u5b9e\u6709\u4e00\u4e2a\u5c0f\u5c0f\u7684tips\uff0c\u9996\u5148\u6211\u4eec\u628a\u6240\u6709\u7684\u903b\u8f91\u51fd\u6570
\n
\"file\"<\/div>
\n\u4e5f\u5c31\u662f\u8fd9\u4e9b\u7684\u547d\u540d\u4e00\u4e0b<\/p>\n
import idautils\nimport idc\nimport idaapi\n\ndef rename_functions(start_name, num_funcs, prefix='func_'):\n    """\n    \u4ece\u6307\u5b9a\u51fd\u6570\u5f00\u59cb\uff0c\u6279\u91cf\u91cd\u547d\u540d\u540e\u7eed\u51fd\u6570\u3002\n\n    Args:\n        start_name (str): \u8d77\u59cb\u51fd\u6570\u7684\u540d\u79f0\u3002\n        num_funcs (int): \u8981\u91cd\u547d\u540d\u7684\u51fd\u6570\u6570\u91cf\u3002\n        prefix (str): \u65b0\u51fd\u6570\u540d\u79f0\u7684\u524d\u7f00\u3002\n    """\n    # \u83b7\u53d6\u8d77\u59cb\u51fd\u6570\u7684\u5730\u5740\n    start_ea = idc.get_name_ea_simple(start_name)\n    if start_ea == idc.BADADDR:\n        print("\u9519\u8bef: \u672a\u627e\u5230\u540d\u79f0\u4e3a '{}' \u7684\u51fd\u6570\u3002".format(start_name))\n        return\n\n    # \u83b7\u53d6\u6240\u6709\u51fd\u6570\u5730\u5740\u5e76\u6392\u5e8f\n    functions = list(idautils.Functions())\n    functions = sorted(functions)\n\n    # \u67e5\u627e\u8d77\u59cb\u51fd\u6570\u5728\u51fd\u6570\u5217\u8868\u4e2d\u7684\u7d22\u5f15\n    try:\n        start_index = functions.index(start_ea)\n    except ValueError:\n        print("\u9519\u8bef: \u8d77\u59cb\u51fd\u6570\u5730\u5740\u672a\u5728\u51fd\u6570\u5217\u8868\u4e2d\u627e\u5230\u3002")\n        return\n\n    # \u68c0\u67e5\u662f\u5426\u6709\u8db3\u591f\u7684\u51fd\u6570\u8fdb\u884c\u91cd\u547d\u540d\n    if start_index + num_funcs > len(functions):\n        print("\u8b66\u544a: \u51fd\u6570\u6570\u91cf\u4e0d\u8db3\uff0c\u6700\u591a\u53ea\u80fd\u91cd\u547d\u540d {} \u4e2a\u51fd\u6570\u3002".format(len(functions) - start_index))\n        num_funcs = len(functions) - start_index\n\n    # \u6267\u884c\u6279\u91cf\u91cd\u547d\u540d\n    for i in range(num_funcs):\n        func_ea = functions[start_index + i]\n        old_name = idc.get_func_name(func_ea)\n        new_name = "{}{}".format(prefix, i)\n\n        # \u5c1d\u8bd5\u91cd\u547d\u540d\u51fd\u6570\n        success = idc.set_name(func_ea, new_name, idc.SN_NOWARN)\n        if success:\n            print("\u6210\u529f: \u5c06\u51fd\u6570 0x{:X} ('{}') \u91cd\u547d\u540d\u4e3a '{}'\u3002".format(func_ea, old_name, new_name))\n        else:\n            print("\u5931\u8d25: \u65e0\u6cd5\u5c06\u51fd\u6570 0x{:X} ('{}') \u91cd\u547d\u540d\u4e3a '{}'\u3002".format(func_ea, old_name, new_name))\n\ndef main():\n    start_func_name = "sub_A224"  # \u8d77\u59cb\u51fd\u6570\u540d\u79f0\uff0c\u6839\u636e\u9700\u8981\u4fee\u6539\n    number_of_functions = 256    # \u8981\u91cd\u547d\u540d\u7684\u51fd\u6570\u6570\u91cf\n    prefix = "func_"             # \u65b0\u51fd\u6570\u540d\u79f0\u7684\u524d\u7f00\n\n    rename_functions(start_func_name, number_of_functions, prefix)\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
\"file\"<\/div>
\n\u5176\u5b9e\u7ffb\u627e\u4e00\u4e0b\u5c31\u53ef\u4ee5\u53d1\u73b0\u6240\u6709\u7684\u7b97\u6cd5\u90fd\u662f\u7531+\u548c^\u7ec4\u6210\u7684\uff0c\u90a3\u4e48\u8fd9\u6837\u6392\u5217\u7ec4\u5408\u4e5f\u4e0d\u8fc7\u5341\u51e0\u79cd\uff0c\u6211\u4eec\u901a\u8fc7\u540d\u79f0\u8ba1\u7b97\u4e00\u4e0b\u54ea\u4e9b\u662f\u76f8\u7b49\u7684\uff1a<\/p>\n
import idaapi\nimport idautils\nimport hashlib\nimport re  # \u5bfc\u5165\u6b63\u5219\u8868\u8fbe\u5f0f\u6a21\u5757\n\n# \u83b7\u53d6\u51fd\u6570\u7684\u5b57\u8282\u7801\uff08\u5b57\u8282\u5e8f\u5217\uff09\ndef get_function_bytes(func_start):\n    func = idaapi.get_func(func_start)\n    func_end = func.end_ea  # \u4f7f\u7528 end_ea \u83b7\u53d6\u51fd\u6570\u7ed3\u675f\u5730\u5740\n    func_bytes = bytearray()\n    for addr in range(func_start, func_end):\n        func_bytes.append(idaapi.get_byte(addr))  # \u4f7f\u7528 idaapi.get_byte \u83b7\u53d6\u5b57\u8282\n    return func_bytes\n\n# \u8ba1\u7b97\u5b57\u8282\u7801\u7684\u54c8\u5e0c\u503c\u4f5c\u4e3a\u76f8\u4f3c\u5ea6\u7684\u5ea6\u91cf\ndef get_function_hash(func_start):\n    func_bytes = get_function_bytes(func_start)\n    return hashlib.md5(func_bytes).hexdigest()\n\n# \u83b7\u53d6\u6240\u6709\u7b26\u5408\u6761\u4ef6\uff08__Z8func_*\uff09\u51fd\u6570\u7684\u54c8\u5e0c\u503c\uff0c\u5e76\u63d0\u53d6\u6570\u5b57\ndef get_all_functions():\n    functions = {}\n    func_pattern = re.compile(r'func_(\\d+)')  # \u4fee\u6539\u6b63\u5219\u8868\u8fbe\u5f0f\uff0c\u5339\u914d __Z8func_ \u540e\u9762\u8ddf\u6570\u5b57\n    for func_start in idautils.Functions():\n        func_name = idaapi.get_func_name(func_start)\n        # \u68c0\u67e5\u51fd\u6570\u540d\u662f\u5426\u7b26\u5408 "__Z8func_*" \u683c\u5f0f\n        match = func_pattern.search(func_name)\n        if match:\n            func_number = int(match.group(1))  # \u63d0\u53d6\u51fd\u6570\u540d\u4e2d\u7684\u6570\u5b57\u90e8\u5206\n            func_hash = get_function_hash(func_start)  # \u8ba1\u7b97\u54c8\u5e0c\u503c\n            if func_hash not in functions:\n                functions[func_hash] = []  # \u5982\u679c\u6ca1\u6709\u8be5\u54c8\u5e0c\u7684\u7ec4\uff0c\u5219\u521b\u5efa\u4e00\u4e2a\u65b0\u7ec4\n            functions[func_hash].append(func_number)  # \u5c06\u51fd\u6570\u7684\u6570\u5b57\u52a0\u5165\u5bf9\u5e94\u54c8\u5e0c\u7684\u7ec4\u4e2d\n    return functions\n\n# \u8f93\u51fa\u76f8\u540c\u54c8\u5e0c\u7684\u51fd\u6570\u6570\u5b57\u7ec4\n\ndef print_functions_by_hash(functions):\n    count = 1\n    for func_hash, func_numbers in functions.items():\n        # \u8f93\u51fa\u54c8\u5e0c\u503c\u548c\u5bf9\u5e94\u7684\u6570\u5b57\u6570\u7ec43\n        print(f"type{count}: {sorted(func_numbers)}")\n        count += 1\n\n# \u4e3b\u51fd\u6570\ndef main():\n    functions = get_all_functions()  # \u83b7\u53d6\u6240\u6709\u51fd\u6570\u5e76\u6309\u54c8\u5e0c\u5206\u7ec4\n    print_functions_by_hash(functions)  # \u8f93\u51fa\u6309\u54c8\u5e0c\u5206\u7ec4\u7684\u6570\u5b57\u6570\u7ec4\n\n# \u8fd0\u884c\u4e3b\u51fd\u6570\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
\"file\"<\/div>
\n\u53ea\u670914\u79cdtype\u3002
\n\u90a3\u5c31\u6413\u4e2a\u89e3\u91ca\u5668\u5427\uff1a<\/p>\n
#include <bits\/stdc++.h>\nusing namespace std;\n\n\/\/ \u5404\u79cd\u7c7b\u578b\u7684\u64cd\u4f5c\u51fd\u6570\nvoid type1(int a1, int a2, int a3, int a4) {\n    \/\/ a4 + a3 + a1 + a2;\n    printf("a[%d] = a[%d] + a[%d] + %d + %d;\\n", a3, a4, a3, a1, a2);\n}\n\nvoid type2(int a1, int a2, int a3, int a4, int a5) {\n    \/\/ (a5 ^ (a3 + a1 + a4)) + a2\n    printf("a[%d] = (a[%d] ^ (%d + %d + a[%d])) + %d;\\n", a4, a5, a3, a1, a4, a2);\n}\n\nvoid type3(int a1, int a2, int a3, int a4, int a5) {\n    \/\/ a5 + a4 + a3 + a1 + a2\n    printf("a[%d] = a[%d] + a[%d] + %d + %d + %d;\\n", a4, a5, a4, a3, a2, a1);\n}\n\nvoid type4(int a1, int a2, int a3) {\n    \/\/ (a3 ^ a1) + a2;\n    printf("a[%d] = (a[%d] ^ %d) + a[%d];\\n", a2, a3, a1, a2);\n}\n\nvoid type5(int a1, int a2, int a3, int a4) {\n    \/\/ (a1 ^ (a3 + a4)) + a2\n    printf("a[%d] = (%d ^ (a[%d] + a[%d])) + %d;\\n", a3, a1, a3, a4, a2);\n}\n\nvoid type6(int a1, int a2, int a3, int a4) {\n    \/\/ (a4 ^ a3 ^ a1) + a2;\n    printf("a[%d] = (a[%d] ^ a[%d] ^ %d) + %d;\\n", a3, a4, a3, a1, a2);\n}\n\nvoid type7(int a1, int a2, int a3, int a4) {\n    \/\/ (a4 ^ (a1 + a3)) + a2;\n    printf("a[%d] = (a[%d] ^ (%d + a[%d])) + %d;\\n", a3, a4, a1, a3, a2);\n}\n\nvoid type8(int a1, int a2, int a3) {\n    \/\/ a3 + a1 + a2;\n    printf("a[%d] = a[%d] + %d + a[%d];\\n", a2, a3, a1, a2);\n}\n\nvoid type9(int a1, int a2, int a3, int a4, int a5) {\n    \/\/ (a3 ^ a1 ^ (a4 + a5)) + a2\n    printf("a[%d] = (%d ^ %d ^ (a[%d] + a[%d])) + %d;\\n", a4, a3, a1, a4, a5, a2);\n}\n\nvoid type10(int a1, int a2, int a3, int a4, int a5) {\n    \/\/ (a1 ^ (a4 + a3 + a5)) + a2;\n    printf("a[%d] = (%d ^ (a[%d] + %d + a[%d])) + %d;\\n", a4, a1, a4, a3, a5, a2);\n}\n\nvoid type11(int a1, int a2, int a3, int a4, int a5) {\n    \/\/ ((a4 + a5) ^ (a1 + a3)) + a2;\n    printf("a[%d] = ((a[%d] + a[%d]) ^ (%d + %d)) + %d;\\n", a4, a4, a5, a1, a3, a2);\n}\n\nvoid type12(int a1, int a2, int a3, int a4, int a5) {\n    \/\/ (a5 ^ a4 ^ a3 ^ a1) + a2;\n    printf("a[%d] = (a[%d] ^ a[%d] ^ %d ^ %d) + %d;\\n", a4, a5, a4, a3, a1, a2);\n}\n\nvoid type13(int a1, int a2, int a3, int a4, int a5) {\n    \/\/ (a5 ^ a1 ^ (a3 + a4)) + a2;\n    printf("a[%d] = (a[%d] ^ %d ^ (%d + a[%d])) + %d;\\n", a4, a5, a1, a3, a4, a2);\n}\n\nvoid type14(int a1, int a2, int a3, int a4, int a5) {\n    \/\/ (a5 ^ a4 ^ (a1 + a3)) + a2;\n    printf("a[%d] = (a[%d] ^ a[%d] ^ (%d + %d)) + %d;\\n", a4, a5, a4, a1, a3, a2);\n}\n\nvector<int> type1e = {0, 2, 11, 12, 15, 21, 26, 28, 39, 44, 53, 57, 62, 63, 72, 74, 77, 81, 90, 94, 97, 108, 113, 118, 121, 122, 125, 142, 144, 145, 151, 161, 162, 166, 181, 183, 185, 192, 199, 203, 215, 226, 230, 238, 242, 244, 247};\nvector<int> type21 = {1, 5, 34, 49, 84, 93, 130, 152, 154, 155, 207, 216, 217};\nvector<int> type31 = {3, 20, 24, 38, 42, 64, 70, 71, 73, 82, 124, 132, 176, 189, 196, 209, 220, 223, 224, 225, 237, 255};\nvector<int> type41 = {4, 9, 10, 14, 22, 23, 25, 31, 32, 33, 45, 69, 92, 99, 103, 111, 115, 117, 129, 147, 149, 150, 156, 164, 165, 172, 175, 241, 250, 254};\nvector<int> type51 = {6, 7, 29, 46, 47, 51, 60, 65, 76, 80, 85, 88, 98, 177, 182, 193, 208, 210, 221, 222, 236};\nvector<int> type61 = {8, 50, 54, 89, 126, 133, 198, 219, 240};\nvector<int> type71 = {13, 48, 55, 106, 119, 120, 127, 148, 170, 171, 197, 218, 233, 248, 252, 253};\nvector<int> type81 = {16, 17, 19, 30, 35, 36, 37, 43, 56, 59, 67, 68, 78, 79, 96, 100, 101, 107, 112, 114, 116, 123, 131, 135, 138, 139, 143, 158, 159, 160, 163, 167, 168, 169, 173, 178, 180, 188, 191, 194, 195, 204, 205, 211, 212, 227, 228, 229, 234, 235, 245, 249, 251};\nvector<int> type91 = {18, 134, 136, 140, 174, 213, 232};\nvector<int> type101 = {27, 58, 86, 104, 110, 146, 157, 179, 184, 202, 239, 243, 246};\nvector<int> type111 = {40, 52, 66, 95, 109, 128, 141, 153, 206, 231};\nvector<int> type121 = {41, 87, 200, 201};\nvector<int> type131 = {61, 91, 102, 137, 186, 187, 190, 214};\nvector<int> type141 = {75, 83, 105};\n\n\/\/ \u7c7b\u578b\u67e5\u627e\u51fd\u6570\uff0c\u6839\u636eopcode\u9009\u62e9\u5bf9\u5e94\u7684\u7c7b\u578b\nint getType(int opcode) {\n    if (find(type1e.begin(), type1e.end(), opcode) != type1e.end()) return 1;\n    if (find(type21.begin(), type21.end(), opcode) != type21.end()) return 2;\n    if (find(type31.begin(), type31.end(), opcode) != type31.end()) return 3;\n    if (find(type41.begin(), type41.end(), opcode) != type41.end()) return 4;\n    if (find(type51.begin(), type51.end(), opcode) != type51.end()) return 5;\n    if (find(type61.begin(), type61.end(), opcode) != type61.end()) return 6;\n    if (find(type71.begin(), type71.end(), opcode) != type71.end()) return 7;\n    if (find(type81.begin(), type81.end(), opcode) != type81.end()) return 8;\n    if (find(type91.begin(), type91.end(), opcode) != type91.end()) return 9;\n    if (find(type101.begin(), type101.end(), opcode) != type101.end()) return 10;\n    if (find(type111.begin(), type111.end(), opcode) != type111.end()) return 11;\n    if (find(type121.begin(), type121.end(), opcode) != type121.end()) return 12;\n    if (find(type131.begin(), type131.end(), opcode) != type131.end()) return 13;\n    if (find(type141.begin(), type141.end(), opcode) != type141.end()) return 14;\n    return -1;  \/\/ \u672a\u627e\u5230\u7c7b\u578b\n}\n\nunsigned char opcode[9999] = {\n\n    197, 209, 172, 235, 111, 151, 86, 73, 250, 217, 100, 170, 148, 158, 131, 38, 12, 91, 144, 225, 179, 115, 215, 28, 179, 62, 108, 138, 151, 151, 187, 180, 121, 23, 144, 41, 58, 174, 213, 108, 23, 86, 95, 152, 140, 85, 168, 160, 126, 128, 125, 129, 83, 19, 219, 109, 9, 68, 177, 83, 60, 167, 228, 182, 146, 173, 109, 238, 105, 46, 30, 2, 72, 123, 40, 146, 148, 254, 10, 45, 146, 143, 152, 220, 23, 51, 201, 211, 238, 50, 140, 155, 78, 110, 148, 51, 89, 209, 57, 149, 77, 50, 187, 168, 180, 117, 19, 238, 47, 229, 177, 104, 182, 57, 159, 248, 46, 100, 172, 210, 27, 137, 255, 61, 211, 110, 93, 198, 226, 103, 80, 168, 206, 11, 188, 164, 12, 61, 33, 141, 229, 136, 231, 197, 178, 150, 8, 184, 203, 194, 35, 97, 45, 205, 72, 116, 215, 169, 230, 243, 183, 38, 201, 126, 174, 101, 27, 100, 107, 185, 68, 124, 19, 235, 111, 196, 48, 186, 220, 75, 132, 101, 111, 172, 60, 164, 163, 152, 192, 128, 99, 25, 117, 27, 167, 48, 163, 227, 84, 217, 28, 160, 24, 54, 211, 217, 68, 51, 189, 214, 29, 42, 80, 152, 13, 160, 228, 37, 117, 142, 92, 189, 208, 62, 141, 137, 246, 93, 202, 90, 175, 126, 59, 72, 0, 126, 7, 84, 136, 111, 57, 129, 105, 60, 65, 98, 210, 217, 96, 47, 92, 68, 79, 177, 85, 78, 42, 1, 123, 175, 81, 177, 183, 139, 146, 255, 228, 254, 242, 28, 84, 120, 50, 57, 1, 183, 55, 102, 1, 212, 15, 152, 154, 169, 10, 134, 55, 252, 15, 104, 98, 165, 255, 46, 250, 125, 215, 225, 68, 165, 255, 177, 86, 210, 104, 0, 249, 168, 101, 207, 53, 224, 218, 128, 152, 0, 222, 95, 94, 241, 65, 69, 82, 180, 98, 170, 194, 105, 128, 25, 166, 46, 65, 239, 165, 179, 206, 32, 29, 250, 72, 107, 104, 45, 175, 116, 36, 59, 144, 115, 254, 215, 196, 168, 202, 81, 201, 191, 183, 96, 160, 241, 68, 220, 244, 114, 94, 235, 60, 101, 87, 189, 50, 253, 190, 122, 99, 162, 149, 19, 128, 38, 177, 171, 34, 198, 195, 159, 103, 162, 35, 249, 222, 210, 148, 8, 65, 253, 109, 90, 241, 17, 237, 142, 143, 106, 139, 28, 7, 167, 247, 249, 152, 132, 22, 190, 233, 163, 113, 54, 234, 119, 132, 144, 89, 79, 231, 9, 172, 253, 39, 189, 230, 211, 123, 225, 37, 147, 51, 55, 152, 34, 196, 224, 252, 161, 68, 209, 67, 74, 119, 212, 130, 17, 43, 55, 88, 72, 141, 254, 137, 54, 30, 38, 71, 232, 74, 72, 229, 3, 118, 115, 110, 233, 45, 60, 241, 101, 178, 141, 197, 244, 73, 217, 142, 230, 241, 231, 202, 222, 82, 242, 138, 185, 226, 8, 191, 201, 154, 183, 7, 50, 137, 34, 138, 139, 114, 162, 49, 117, 173, 168, 197, 209, 172, 235, 111, 151, 86, 73, 250, 217, 100, 170, 148, 158, 131, 38, 12, 91, 144, 225, 179, 115, 215, 28, 179, 62, 108, 138, 151, 151, 187, 180, 121, 23, 144, 41, 58, 174, 213, 108, 23, 86, 95, 152, 140, 85, 168, 160, 126, 128, 125, 129, 83, 19, 219, 109, 9, 68, 177, 83, 60, 167, 228, 182, 146, 173, 109, 238, 105, 46, 30, 2, 72, 123, 40, 146, 148, 254, 10, 45, 146, 143, 152, 220, 23, 51, 201, 211, 238, 50, 140, 155, 78, 110, 148, 51, 89, 209, 57, 149, 77, 50, 187, 168, 180, 117, 19, 238, 47, 229, 177, 104, 182, 57, 159, 248, 46, 100, 172, 210, 27, 137, 255, 61, 211, 110, 93, 198, 226, 103, 80, 168, 206, 11, 188, 164, 12, 61, 33, 141, 229, 136, 231, 197, 178, 150, 8, 184, 203, 194, 35, 97, 45, 205, 72, 116, 215, 169, 230, 243, 183, 38, 201, 126, 174, 101, 27, 100, 107, 185, 68, 124, 19, 235, 111, 196, 48, 186, 220, 75, 132, 101, 111, 172, 60, 164, 163, 152, 192, 128, 99, 25, 117, 27, 167, 48, 163, 227, 84, 217, 28, 160, 24, 54, 211, 217, 68, 51, 189, 214, 29, 42, 80, 152, 13, 160, 228, 37, 117, 142, 92, 189, 208, 62, 141, 137, 246, 93, 202, 90, 175, 126, 59, 72, 0, 126, 7, 84, 136, 111, 57, 129, 105, 60, 65, 98, 210, 217, 96, 47, 92, 68, 79, 177, 85, 78, 42, 1, 123, 175, 81, 177, 183, 139, 146, 255, 228, 254, 242, 28, 84, 120, 50, 57, 1, 183, 55, 102, 1, 212, 15, 152, 154, 169, 10, 134, 55, 252, 15, 104, 98, 165, 255, 46, 250, 125, 215, 225, 68, 165, 255, 177, 86, 210, 104, 0, 249, 168, 101, 207, 53, 224, 218, 128, 152, 0, 222, 95, 94, 241, 65, 69, 82, 180, 98, 170, 194, 105, 128, 25, 166, 46, 65, 239, 165, 179, 206, 32, 29, 250, 72, 107, 104, 45, 175, 116, 36, 59, 144, 115, 254, 215, 196, 168, 202, 81, 201, 191, 183, 96, 160, 241, 68, 220, 244, 114, 94, 235, 60, 101, 87, 189, 50, 253, 190, 122, 99, 162, 149, 19, 128, 38, 177, 171, 34, 198, 195, 159, 103, 162, 35, 249, 222, 210, 148, 8, 65, 253, 109, 90, 241, 17, 237, 142, 143, 106, 139, 28, 7, 167, 247, 249, 152, 132, 22, 190, 233, 163, 113, 54, 234, 119, 132, 144, 89, 79, 231, 9, 172, 253, 39, 189, 230, 211, 123, 225, 37, 147, 51, 55, 152, 34, 196, 224, 252, 161, 68, 209, 67, 74, 119, 212, 130, 17, 43, 55, 88, 72, 141, 254, 137, 54, 30, 38, 71, 232, 74, 72, 229, 3, 118, 115, 110, 233, 45, 60, 241, 101, 178, 141, 197, 244, 73, 217, 142, 230, 241, 231, 202, 222, 82, 242, 138, 185, 226, 8, 191, 201, 154, 183, 7, 50, 137, 34, 138, 139, 114, 162, 49, 117, 173, 168, 197, 209, 172, 235, 111, 151, 86, 73, 250, 217, 100, 170, 148, 158, 131, 38, 12, 91, 144, 225, 179, 115, 215, 28, 179, 62, 108, 138, 151, 151, 187, 180, 121, 23, 144, 41, 58, 174, 213, 108, 23, 86, 95, 152, 140, 85, 168, 160, 126, 128, 125, 129, 83, 19, 219, 109, 9, 68, 177, 83, 60, 167, 228, 182, 146, 173, 109, 238, 105, 46, 30, 2, 72, 123, 40, 146, 148, 254, 10, 45, 146, 143, 152, 220, 23, 51, 201, 211, 238, 50, 140, 155, 78, 110, 148, 51, 89, 209, 57, 149, 77, 50, 187, 168, 180, 117, 19, 238, 47, 229, 177, 104, 182, 57, 159, 248, 46, 100, 172, 210, 27, 137, 255, 61, 211, 110, 93, 198, 226, 103, 80, 168, 206, 11, 188, 164, 12, 61, 33, 141, 229, 136, 231, 197, 178, 150, 8, 184, 203, 194, 35, 97, 45, 205, 72, 116, 215, 169, 230, 243, 183, 38, 201, 126, 174, 101, 27, 100, 107, 185, 68, 124, 19, 235, 111, 196, 48, 186, 220, 75, 132, 101, 111, 172, 60, 164, 163, 152, 192, 128, 99, 25, 117, 27, 167, 48, 163, 227, 84, 217, 28, 160, 24, 54, 211, 217, 68, 51, 189, 214, 29, 42, 80, 152, 13, 160, 228, 37, 117, 142, 92, 189, 208, 62, 141, 137, 246, 93, 202, 90, 175, 126, 59, 72, 0, 126, 7, 84, 136, 111, 57, 129, 105, 60, 65, 98, 210, 217, 96, 47, 92, 68, 79, 177, 85, 78, 42, 1, 123, 175, 81, 177, 183, 139, 146, 255, 228, 254, 242, 28, 84, 120, 50, 57, 1, 183, 55, 102, 1, 212, 15, 152, 154, 169, 10, 134, 55, 252, 15, 104, 98, 165, 255, 46, 250, 125, 215, 225, 68, 165, 255, 177, 86, 210, 104, 0, 249, 168, 101, 207, 53, 224, 218, 128, 152, 0, 222, 95, 94, 241, 65, 69, 82, 180, 98, 170, 194, 105, 128, 25, 166, 46, 65, 239, 165, 179, 206, 32, 29, 250, 72, 107, 104, 45, 175, 116, 36, 59, 144, 115, 254, 215, 196, 168, 202, 81, 201, 191, 183, 96, 160, 241, 68, 220, 244, 114, 94, 235, 60, 101, 87, 189, 50, 253, 190, 122, 99, 162, 149, 19, 128, 38, 177, 171, 34, 198, 195, 159, 103, 162, 35, 249, 222, 210, 148, 8, 65, 253, 109, 90, 241, 17, 237, 142, 143, 106, 139, 28, 7, 167, 247, 249, 152, 132, 22, 190, 233, 163, 113, 54, 234, 119, 132, 144, 89, 79, 231, 9, 172, 253, 39, 189, 230, 211, 123, 225, 37, 147, 51, 55, 152, 34, 196, 224, 252, 161, 68, 209, 67, 74, 119, 212, 130, 17, 43, 55, 88, 72, 141, 254, 137, 54, 30, 38, 71, 232, 74, 72, 229, 3, 118, 115, 110, 233, 45, 60, 241, 101, 178, 141, 197, 244, 73, 217, 142, 230, 241, 231, 202, 222, 82, 242, 138, 185, 226, 8, 191, 201, 154, 183, 7, 50, 137, 34, 138, 139, 114, 162, 49, 117, 173, 168\n\n};\n\nint main() {\n\n    for (int i = 0; i < 1536; i += 6) {\n        int a = opcode[i], b = opcode[i + 1], c = opcode[i + 2];\n        int indexA = opcode[i + 3] % 32;\n        int indexB = opcode[i + 4] % 32;\n        int logic = opcode[i + 5];\n        switch (getType(logic)) {\n            case 1:\n                type1(a, b, indexA, indexB);\n                break;\n            case 2:\n                type2(a, b, c, indexA, indexB);\n                break;\n            case 3:\n                type3(a, b, c, indexA, indexB);\n                break;\n            case 4:\n                type4(a, indexA, indexB);\n                break;\n            case 5:\n                type5(a, b, indexA, indexB);\n                break;\n            case 6:\n                type6(a, b, indexA, indexB);\n                break;\n            case 7:\n                type7(a, b, indexA, indexB);\n                break;\n            case 8:\n                type8(a, indexA, indexB);\n                break;\n            case 9:\n                type9(a, b, c, indexA, indexB);\n                break;\n            case 10:\n                type10(a, b, c, indexA, indexB);\n                break;\n            case 11:\n                type11(a, b, c, indexA, indexB);\n                break;\n            case 12:\n                type12(a, b, c, indexA, indexB);\n                break;\n            case 13:\n                type13(a, b, c, indexA, indexB);\n                break;\n            case 14:\n                type14(a, b, c, indexA, indexB);\n                break;\n            default:\n                cout << "Unknown logic type: " << logic << endl;\n        }\n    }\n}\n<\/code><\/pre>\n
\"file\"<\/div><\/p>\n
\u6559\u7ec3\u90fd\u6709\u903b\u8f91\u4e86\uff0c\u4e0d\u4f1a\u8fd8\u6413\u4e0d\u51faz3\u628a\uff1f
\n\u90a3\u6211\u5c31\u7ed9\u4f60\u4e00\u4e2a\u751f\u6210z3\u7684\u811a\u672c\u5427\uff1a<\/p>\n
import re\nfrom z3 import *\n\ndef translate_transformation(line):\n    """\n    Translates a single C++ transformation line into a Python Z3 constraint.\n\n    Args:\n        line (str): A line of C++ code representing a transformation.\n\n    Returns:\n        str: A line of Python code formatted for Z3.\n    """\n    # Remove any trailing semicolon and whitespace\n    line = line.strip().rstrip(';')\n\n    # Match the pattern a[index] = expression\n    match = re.match(r'a\\[(\\d+)\\]\\s*=\\s*(.+)', line)\n    if not match:\n        raise ValueError(f"Invalid transformation line: {line}")\n\n    index = match.group(1)\n    expression = match.group(2)\n\n    # Function to replace integers with BitVecVal(x, 32), excluding indices in a[index]\n    def replace_int_literals(match):\n        num = match.group(0)\n        # If the number is part of 'a[number]', return as is\n        if match.group(1):\n            return num\n        else:\n            return f'BitVecVal({num}, 32)'\n\n    # Regular expression to find integer literals not preceded by 'a['\n    # This uses a negative lookbehind to ensure numbers inside a[...] are not matched\n    int_literal_pattern = re.compile(r'(?<!a\\[)\\b(0x[0-9a-fA-F]+|\\d+)\\b')\n\n    # Replace all integer literals not inside a[...] with BitVecVal(x, 32)\n    processed_expression = int_literal_pattern.sub(replace_int_literals, expression)\n\n    # Construct the Python assignment statement\n    python_line = f'a[{index}] = {processed_expression}'\n\n    return python_line\n\ndef translate_transformations(cpp_transformations):\n    """\n    Translates multiple C++ transformation lines into Python Z3 constraints.\n\n    Args:\n        cpp_transformations (str): Multiline string of C++ transformation lines.\n\n    Returns:\n        list: List of Python Z3 constraint lines.\n    """\n    python_constraints = []\n    for line in cpp_transformations.strip().split('\\n'):\n        # Remove comments\n        line = line.split('\/\/')[0]\n        # Skip empty lines or lines that do not contain transformations\n        if not line.strip() or not line.strip().startswith('a['):\n            continue\n        python_line = translate_transformation(line)\n        python_constraints.append(python_line)\n    return python_constraints\n\ndef generate_z3_script(transformation_constraints, results, input_size=32):\n    """\n    Generates the complete Z3 Python script with the given constraints.\n\n    Args:\n        transformation_constraints (list): List of Python Z3 constraint lines.\n        results (list): List of expected result values.\n        input_size (int): Size of the input array.\n\n    Returns:\n        str: The complete Python Z3 script as a string.\n    """\n    script_lines = [\n        "from z3 import *",\n        "",\n        "# Initialize Z3 solver",\n        "s = Solver()",\n        "",\n        "# Define input characters as 8-bit BitVec variables",\n        f"input_vars = [BitVec(f'c{{i}}', 8) for i in range({input_size})]",\n        "",\n        "# Initialize array 'a' with {0} elements, initially set to input characters".format(input_size),\n        f"a = [ZeroExt(24, input_vars[i]) for i in range({input_size})]",\n        "",\n        "# Translated Python Z3 Constraints"\n    ]\n\n    # Add transformation constraints\n    for constraint in transformation_constraints:\n        script_lines.append(constraint)\n\n    # Define the results array\n    script_lines.extend([\n        "",\n        "# Define the results array",\n        "results = [",\n    ])\n    # Format results as hex for readability\n    for res in results:\n        script_lines.append(f"    0x{res:x},")\n    script_lines.append("]")\n\n    # Add constraints that a[i] == results[i]\n    script_lines.append("")\n    script_lines.append("# After all transformations, set constraints that a[i] == results[i]")\n    script_lines.append("for i in range({0}):".format(input_size))\n    script_lines.append("    s.add(a[i] == results[i])")\n\n    # Add constraints for input characters to be printable ASCII (optional)\n    script_lines.append("")\n    script_lines.append("# Add constraints for input characters to be printable ASCII (optional)")\n    script_lines.append("for c in input_vars:")\n    script_lines.append("    s.add(c >= 32, c <= 126)  # Printable ASCII range")\n\n    # Add the solver check and model extraction\n    script_lines.extend([\n        "",\n        "# Check if the constraints are satisfiable",\n        "if s.check() == sat:",\n        "    model = s.model()",\n        "    # Extract the input string",\n        "    input_string = ''.join([chr(model[c].as_long()) for c in input_vars])",\n        "    print(f\\"Found input: {input_string}\\")",\n        "else:",\n        "    print(\\"No solution found.\\")",\n        ""\n    ])\n\n    return '\\n'.join(script_lines)\n\n# Example usage\nif __name__ == "__main__":\n    cpp_transformations = """\n    a[11] = a[15] + a[11] + 197 + 209;\n    a[25] = (a[4] ^ (86 + a[25])) + 73;\n    a[6] = (a[12] ^ 148 ^ (131 + a[6])) + 158;\n    a[19] = a[23] + a[19] + 144 + 225;\n    a[10] = a[23] + a[10] + 179 + 62;\n    a[23] = (a[16] ^ a[23] ^ 121 ^ 187) + 180;\n    a[12] = (58 ^ (a[12] + 213 + a[23])) + 174;\n    a[21] = a[8] + 95 + a[21];\n    a[1] = a[19] + 126 + a[1];\n    a[4] = (a[17] ^ a[4] ^ (219 + 9)) + 109;\n    a[22] = a[18] + 60 + a[22];\n    a[14] = a[30] + a[14] + 109 + 238;\n    a[18] = (a[20] ^ 72) + a[18];\n    a[15] = a[24] + a[15] + 146 + 45 + 10;\n    a[19] = (a[14] ^ a[19] ^ 23) + 51;\n    a[14] = (140 ^ (a[14] + a[20])) + 155;\n    a[21] = (a[13] ^ a[21] ^ 89) + 209;\n    a[21] = a[19] + a[21] + 187 + 168;\n    a[8] = a[22] + a[8] + 47 + 229;\n    a[4] = (159 ^ (a[4] + a[12])) + 248;\n    a[29] = (27 ^ (a[29] + 255 + a[19])) + 137;\n    a[7] = a[16] + 93 + a[7];\n    a[4] = (a[12] ^ 206 ^ (188 + a[4])) + 11;\n    a[8] = (a[7] ^ (33 + a[8])) + 141;\n    a[24] = a[11] + 178 + a[24];\n    a[13] = a[8] + 35 + a[13];\n    a[19] = a[23] + a[19] + 230 + 169 + 215;\n    a[5] = a[27] + 201 + a[5];\n    a[28] = a[19] + 107 + a[28];\n    a[26] = (a[28] ^ a[26] ^ (111 + 48)) + 196;\n    a[12] = (a[28] ^ 132) + a[12];\n    a[0] = (a[3] ^ 163) + a[0];\n    a[16] = a[3] + 117 + a[16];\n    a[0] = (a[24] ^ a[0] ^ 84) + 217;\n    a[19] = (a[29] ^ 211 ^ (68 + a[19])) + 217;\n    a[24] = a[13] + 29 + a[24];\n    a[14] = a[28] + a[14] + 117 + 37 + 228;\n    a[9] = (a[22] ^ (141 + 208 + a[9])) + 62;\n    a[30] = a[27] + a[30] + 202 + 90;\n    a[20] = (a[8] ^ 0) + a[20];\n    a[28] = (57 ^ (a[28] + a[1])) + 129;\n    a[15] = a[28] + 210 + a[15];\n    a[14] = (a[10] ^ (85 + 79 + a[14])) + 177;\n    a[17] = a[23] + 123 + a[17];\n    a[30] = a[18] + a[30] + 146 + 255;\n    a[25] = a[1] + a[25] + 84 + 120;\n    a[20] = (a[15] ^ (1 + 55 + a[20])) + 102;\n    a[6] = (a[23] ^ (154 + a[6])) + 169;\n    a[5] = (15 ^ (a[5] + a[31])) + 104;\n    a[1] = (a[4] ^ 250) + a[1];\n    a[18] = a[8] + a[18] + 255 + 177;\n    a[15] = a[21] + a[15] + 101 + 168 + 249;\n    a[0] = ((a[0] + a[30]) ^ (218 + 152)) + 128;\n    a[5] = a[18] + 94 + a[5];\n    a[9] = (a[0] ^ 98) + a[9];\n    a[15] = (166 ^ (a[15] + 65 + a[5])) + 46;\n    a[26] = a[8] + 206 + a[26];\n    a[20] = a[4] + 104 + a[20];\n    a[23] = a[4] + 144 + a[23];\n    a[31] = a[23] + 202 + a[31];\n    a[28] = a[20] + 160 + a[28];\n    a[5] = a[23] + a[5] + 60 + 235 + 94;\n    a[26] = a[3] + a[26] + 50 + 253;\n    a[6] = (a[17] ^ (149 + a[6])) + 19;\n    a[31] = a[7] + a[31] + 34 + 198;\n    a[18] = (a[20] ^ a[18] ^ 35) + 249;\n    a[26] = a[17] + 65 + a[26];\n    a[10] = a[11] + a[10] + 237 + 142;\n    a[25] = a[24] + a[25] + 247 + 167 + 7;\n    a[3] = (a[17] ^ a[3] ^ 22) + 190;\n    a[16] = a[25] + 234 + a[16];\n    a[29] = a[7] + a[29] + 172 + 9 + 231;\n    a[1] = (a[5] ^ 230) + a[1];\n    a[2] = a[4] + a[2] + 152 + 55 + 51;\n    a[17] = a[3] + a[17] + 252 + 161;\n    a[17] = (a[11] ^ (119 + a[17])) + 212;\n    a[30] = (a[9] ^ a[30] ^ 88) + 72;\n    a[8] = a[10] + a[8] + 30 + 38;\n    a[19] = (a[14] ^ (229 + a[19])) + 3;\n    a[5] = ((a[5] + a[18]) ^ (45 + 241)) + 60;\n    a[25] = a[14] + a[25] + 197 + 244;\n    a[30] = a[18] + a[30] + 241 + 231;\n    a[8] = (a[31] ^ a[8] ^ 226 ^ 138) + 185;\n    a[18] = (a[9] ^ (7 + 154 + a[18])) + 183;\n    a[2] = (a[17] ^ 138) + a[2];\n    a[17] = a[12] + 173 + a[17];\n    a[9] = (a[26] ^ (86 + 111 + a[9])) + 151;\n    a[30] = a[3] + a[30] + 148 + 170 + 100;\n    a[1] = (a[19] ^ 12) + a[1];\n    a[30] = a[12] + 215 + a[30];\n    a[20] = (a[25] ^ 151) + a[20];\n    a[14] = a[21] + a[14] + 144 + 41;\n    a[24] = (23 ^ (a[24] + a[12])) + 86;\n    a[0] = (a[29] ^ 168) + a[0];\n    a[13] = a[9] + 83 + a[13];\n    a[7] = (177 ^ (a[7] + a[4])) + 83;\n    a[14] = (146 ^ (a[14] + a[9])) + 173;\n    a[27] = (30 ^ (a[27] + 72 + a[8])) + 2;\n    a[13] = a[18] + 148 + a[13];\n    a[19] = a[9] + 152 + a[19];\n    a[27] = (238 ^ (a[27] + 140 + a[14])) + 50;\n    a[17] = (a[25] ^ 148) + a[17];\n    a[8] = (a[20] ^ 77) + a[8];\n    a[5] = (19 ^ (a[5] + 47 + a[17])) + 238;\n    a[24] = a[14] + 182 + a[24];\n    a[9] = (a[31] ^ 172 ^ (27 + a[9])) + 210;\n    a[6] = (a[2] ^ 211) + a[6];\n    a[11] = (a[28] ^ 80) + a[11];\n    a[13] = (33 ^ 12 ^ (a[13] + a[5])) + 61;\n    a[22] = (231 ^ (a[22] + 178 + a[8])) + 197;\n    a[1] = a[13] + 203 + a[1];\n    a[9] = (72 ^ (a[9] + 215 + a[6])) + 116;\n    a[30] = a[14] + 183 + a[30];\n    a[25] = a[4] + a[25] + 107 + 100 + 27;\n    a[4] = (a[16] ^ 19 ^ (111 + a[4])) + 235;\n    a[5] = (a[15] ^ 220) + a[5];\n    a[24] = ((a[24] + a[0]) ^ (60 + 163)) + 164;\n    a[27] = (a[7] ^ (99 + a[27])) + 25;\n    a[25] = a[28] + 163 + a[25];\n    a[25] = (24 ^ (a[25] + a[4])) + 54;\n    a[10] = (a[16] ^ (29 + 189 + a[10])) + 214;\n    a[5] = a[21] + a[5] + 13 + 160;\n    a[30] = (a[13] ^ 92 ^ (208 + a[30])) + 189;\n    a[26] = (a[15] ^ a[26] ^ 246) + 93;\n    a[30] = (a[7] ^ (0 + 59 + a[30])) + 72;\n    a[1] = (136 ^ (a[1] + a[9])) + 111;\n    a[25] = (65 ^ (a[25] + a[0])) + 98;\n    a[17] = a[21] + 92 + a[17];\n    a[15] = (42 ^ (a[15] + a[17])) + 1;\n    a[31] = (a[4] ^ 183) + a[31];\n    a[24] = a[18] + a[24] + 242 + 28;\n    a[6] = a[1] + 1 + a[6];\n    a[9] = (154 ^ 15 ^ (a[9] + a[10])) + 152;\n    a[8] = (a[2] ^ 55) + a[8];\n    a[29] = a[23] + a[29] + 250 + 46 + 255;\n    a[17] = (68 ^ (a[17] + a[22])) + 165;\n    a[8] = (a[5] ^ (249 + 104 + a[8])) + 0;\n    a[0] = a[24] + a[0] + 53 + 224;\n    a[17] = (a[1] ^ 222) + a[17];\n    a[10] = (a[2] ^ a[10] ^ (82 + 98)) + 180;\n    a[14] = (128 ^ (a[14] + 166 + a[1])) + 25;\n    a[0] = (a[29] ^ 165) + a[0];\n    a[13] = a[15] + 72 + a[13];\n    a[19] = a[30] + a[19] + 36 + 59;\n    a[17] = a[9] + 196 + a[17];\n    a[17] = a[4] + a[17] + 160 + 96 + 183;\n    a[11] = a[28] + 244 + a[11];\n    a[29] = a[30] + a[29] + 87 + 189;\n    a[19] = a[0] + a[19] + 149 + 162 + 99;\n    a[6] = a[3] + 177 + a[6];\n    a[25] = (103 ^ (a[25] + a[30])) + 162;\n    a[29] = a[13] + a[29] + 148 + 8;\n    a[14] = (a[15] ^ (241 + a[14])) + 17;\n    a[7] = a[23] + 139 + a[7];\n    a[30] = a[9] + 152 + a[30];\n    a[23] = a[4] + a[23] + 113 + 54;\n    a[9] = (a[12] ^ (89 + a[9])) + 79;\n    a[19] = a[27] + a[19] + 230 + 189 + 39;\n    a[23] = (a[24] ^ (51 + 37 + a[23])) + 147;\n    a[1] = a[4] + a[1] + 252 + 224 + 196;\n    a[20] = a[2] + 67 + a[20];\n    a[8] = (a[13] ^ 43) + a[8];\n    a[6] = (30 ^ 137 ^ (a[6] + a[7])) + 54;\n    a[3] = (a[22] ^ 74) + a[3];\n    a[28] = a[17] + 110 + a[28];\n    a[20] = (a[9] ^ (197 + 178 + a[20])) + 141;\n    a[7] = (142 ^ (a[7] + a[10])) + 230;\n    a[25] = (a[2] ^ a[25] ^ 82) + 242;\n    a[23] = (a[7] ^ a[23] ^ 191) + 201;\n    a[11] = a[18] + a[11] + 137 + 34;\n    a[8] = a[5] + a[8] + 173 + 117 + 49;\n    a[23] = a[22] + a[23] + 111 + 235 + 172;\n    a[10] = a[20] + 250 + a[10];\n    a[27] = a[16] + a[27] + 12 + 38 + 131;\n    a[28] = a[19] + a[28] + 179 + 115;\n    a[23] = a[27] + 108 + a[23];\n    a[9] = (144 ^ 121 ^ (a[9] + a[26])) + 23;\n    a[22] = (a[31] ^ (23 + 213 + a[22])) + 108;\n    a[0] = ((a[0] + a[30]) ^ (140 + 168)) + 85;\n    a[19] = ((a[19] + a[27]) ^ (125 + 83)) + 129;\n    a[19] = a[28] + 9 + a[19];\n    a[13] = a[13] + a[13] + 228 + 182;\n    a[2] = a[8] + 105 + a[2];\n    a[30] = (a[10] ^ 40) + a[30];\n    a[28] = (146 ^ (a[28] + a[23])) + 143;\n    a[18] = (a[12] ^ (238 + 201 + a[18])) + 211;\n    a[19] = a[25] + a[19] + 148 + 110 + 78;\n    a[18] = a[27] + 57 + a[18];\n    a[14] = a[15] + 180 + a[14];\n    a[25] = (a[31] ^ (177 + a[25])) + 104;\n    a[18] = (a[27] ^ 46 ^ (172 + a[18])) + 100;\n    a[14] = (a[29] ^ a[14] ^ 255) + 61;\n    a[8] = a[14] + a[8] + 226 + 103;\n    a[29] = ((a[29] + a[1]) ^ (188 + 12)) + 164;\n    a[5] = (a[18] ^ 229) + a[5];\n    a[2] = a[3] + a[2] + 8 + 184;\n    a[20] = a[23] + 45 + a[20];\n    a[6] = (a[9] ^ a[6] ^ 230) + 243;\n    a[4] = a[11] + a[4] + 174 + 101;\n    a[11] = a[15] + a[11] + 19 + 124 + 68;\n    a[11] = a[4] + 48 + a[11];\n    a[4] = (a[3] ^ (60 + 111 + a[4])) + 172;\n    a[25] = (192 ^ (a[25] + 99 + a[21])) + 128;\n    a[3] = (a[20] ^ (163 + 167 + a[3])) + 48;\n    a[22] = (a[19] ^ (24 + 28 + a[22])) + 160;\n    a[22] = a[29] + a[22] + 189 + 51 + 68;\n    a[0] = a[4] + 80 + a[0];\n    a[29] = a[16] + a[29] + 117 + 142;\n    a[29] = a[10] + a[29] + 141 + 137;\n    a[8] = (a[0] ^ a[8] ^ 175) + 126;\n    a[15] = (a[25] ^ 7) + a[15];\n    a[2] = (a[18] ^ (65 + 105 + a[2])) + 60;\n    a[4] = (96 ^ (a[4] + a[15])) + 47;\n    a[1] = (a[27] ^ 85) + a[1];\n    a[11] = a[18] + a[11] + 183 + 177 + 81;\n    a[28] = (a[20] ^ (228 + a[28])) + 254;\n    a[23] = (a[23] ^ 50 ^ (1 + a[23])) + 57;\n    a[24] = a[26] + 1 + a[24];\n    a[28] = (10 ^ (a[28] + 55 + a[15])) + 134;\n    a[14] = a[26] + a[14] + 98 + 165;\n    a[5] = (215 ^ (a[5] + a[31])) + 225;\n    a[0] = a[25] + 86 + a[0];\n    a[0] = ((a[0] + a[26]) ^ (101 + 53)) + 207;\n    a[31] = (a[30] ^ 152) + a[31];\n    a[20] = (a[2] ^ (65 + a[20])) + 69;\n    a[25] = (194 ^ (a[25] + a[6])) + 105;\n    a[19] = (a[14] ^ 65) + a[19];\n    a[11] = (a[8] ^ 29) + a[11];\n    a[27] = (a[16] ^ 175) + a[27];\n    a[8] = a[10] + a[8] + 254 + 215;\n    a[0] = (a[0] ^ 201) + a[0];\n    a[18] = a[30] + 68 + a[18];\n    a[29] = (a[18] ^ (60 + a[29])) + 101;\n    a[2] = a[21] + 190 + a[2];\n    a[11] = (a[2] ^ a[11] ^ 128) + 38;\n    a[2] = a[3] + 195 + a[2];\n    a[8] = (a[1] ^ (222 + a[8])) + 210;\n    a[17] = a[13] + a[17] + 109 + 90;\n    a[28] = a[7] + 143 + a[28];\n    a[4] = (a[22] ^ 247 ^ (152 + a[4])) + 249;\n    a[22] = (a[10] ^ (233 + a[22])) + 163;\n    a[15] = (a[7] ^ 132) + a[15];\n    a[29] = a[6] + 172 + a[29];\n    a[19] = (a[19] ^ (123 + a[19])) + 225;\n    a[0] = a[28] + a[0] + 152 + 34;\n    a[10] = a[23] + 68 + a[10];\n    a[23] = a[24] + a[23] + 130 + 17;\n    a[22] = a[30] + a[22] + 137 + 254 + 141;\n    a[8] = a[5] + a[8] + 74 + 232 + 71;\n    a[9] = (118 ^ (a[9] + a[13])) + 115;\n    a[13] = a[5] + a[13] + 241 + 101;\n    a[6] = ((a[6] + a[17]) ^ (73 + 142)) + 217;\n    a[18] = a[10] + a[18] + 202 + 222;\n    a[9] = a[26] + a[9] + 226 + 8;\n    a[2] = a[10] + 7 + a[2];\n    a[21] = a[13] + 114 + a[21];\n    """\n\n    results = [\n        0xd7765, 0x11ebd, 0x32d12, 0x13778, 0x8a428,\n        0xb592, 0x3fa57, 0x1616, 0x3659e, 0x2483a,\n        0x2882, 0x508f4, 0xbad, 0x27920, 0xf821,\n        0x19f83, 0xf97, 0x33904, 0x170d5, 0x16c,\n        0xcf5d, 0x280d2, 0xa8ade, 0x9eaa, 0x9dab,\n        0x1f45e, 0x3214, 0x52fa, 0x6d57a, 0x460ed,\n        0x124ff, 0x13936\n    ]\n    translated_constraints = translate_transformations(cpp_transformations)\n\n    z3_script = generate_z3_script(translated_constraints, results, input_size=32)\n\n    with open('z3_solver.py', 'w') as f:\n        f.write(z3_script)\n\n    print("Z3 solver script 'z3_solver.py' has been generated.")\n<\/code><\/pre>\n
\u5b8c\u4e8b\u4e4b\u540e\u5c31\u53ef\u4ee5\u8dd1\u8fd9\u4e2a\u811a\u672c\u6765\u83b7\u53d6flag\u4e86\uff0c\u751f\u6210\u51fa\u6765\u7684\u811a\u672c\u5982\u4e0b\uff1a
\n\u81ea\u5df1\u8dd1\u4e0a\u9762\u811a\u672c\u83b7\u53d6\u6216\u8005\u5728\u9644\u4ef6\u91cc\u9762\u62ff\u5427.
\n
\"file\"<\/div><\/p>\n
SU_Harmony<\/h2>\n
\u8fd9\u9053\u9898\u5176\u5b9eArk\u5c42\u662f\u6ca1\u6709\u4e1c\u897f\u7684\uff0c\u6211\u4eec\u76f4\u63a5\u770blib\u5c31\u884c\uff1a
\n
\"file\"<\/div>
\n\u8fdb\u6765\u4e4b\u540e\u5176\u5b9e\u9e3f\u8499\u7684\u6ce8\u518c\u6d41\u7a0b\u4e5f\u5dee\u4e0d\u591a
\n
\"file\"<\/div>
\n
\"file\"<\/div>
\n
\"file\"<\/div>
\n\u8fd9\u6837\u5c31\u627e\u5230\u4e3b\u903b\u8f91\u4e86\uff1a
\n
\"file\"<\/div>
\n\u8fd9\u4e2a\u6df7\u6dc6\u5176\u5b9e\u5f88\u7b80\u5355
\n
\"file\"<\/div>
\n\u4e3b\u903b\u8f91\u4f9d\u65e7\u662f\u4e00\u773c\u9876\u9488\u7684
\n
\"file\"<\/div>
\n\u5f80\u4e0b\u770b\u5c31\u662f\u7740\u91cc\u7684\u4e3b\u8981\u64cd\u4f5c\u4e86
\n
\"file\"<\/div>
\"file\"<\/div>
\n\u5176\u5b9e\u5c31\u662f\u4e00\u4e9b\u9ad8\u7cbe\u5ea6\u7b97\u6cd5\uff0c\u4eba\u5de5\u770b\uff0cai\u770b\u90fd\u5f88\u5feb\u901f\u7684\uff0c\u8fd9\u91cc\u516c\u5e03\u4e00\u4e0b\u8ba1\u7b97\u903b\u8f91\u7684\u6e90\u7801\u5427\uff1a<\/p>\n
#include <stdio.h>\n#include <string.h>\n#include <stdlib.h>\n\n\/\/ \u5b9a\u4e49\u6700\u5927\u4f4d\u6570\uff0c\u6839\u636e\u9700\u8981\u8c03\u6574\n#define MAX_DIGITS 5000\n\n\/\/ \u53cd\u8f6c\u5b57\u7b26\u4e32\nvoid reverse_str(char *str) {\n    int len = strlen(str);\n    for(int i=0; i<len\/2; i++) {\n        char temp = str[i];\n        str[i] = str[len-1-i];\n        str[len-1-i] = temp;\n    }\n}\n\n\/\/ \u5927\u6574\u6570\u52a0\u6cd5\uff1aresult = num1 + num2\nvoid add(char *num1, char *num2, char *result) {\n    char a[MAX_DIGITS] = {0};\n    char b[MAX_DIGITS] = {0};\n    strcpy(a, num1);\n    strcpy(b, num2);\n\n    reverse_str(a);\n    reverse_str(b);\n\n    int len1 = strlen(a);\n    int len2 = strlen(b);\n    int maxlen = len1 > len2 ? len1 : len2;\n    int carry = 0;\n    result[0] = '\\0';\n\n    for(int i=0; i<maxlen; i++) {\n        int digit1 = i < len1 ? a[i] - '0' : 0;\n        int digit2 = i < len2 ? b[i] - '0' : 0;\n        int sum = digit1 + digit2 + carry;\n        carry = sum \/ 10;\n        sum = sum % 10;\n        char temp = sum + '0';\n        strncat(result, &temp, 1);\n    }\n    if(carry) {\n        char temp = carry + '0';\n        strncat(result, &temp, 1);\n    }\n\n    reverse_str(result);\n\n    \/\/ \u53bb\u9664\u524d\u5bfc\u96f6\n    int start = 0;\n    while(result[start] == '0' && start < strlen(result)-1) {\n        start++;\n    }\n    if(start > 0) {\n        memmove(result, result + start, strlen(result) - start + 1);\n    }\n}\n\n\/\/ \u5927\u6574\u6570\u51cf\u6cd5\uff1aresult = num1 - num2 (\u5047\u8bbe num1 >= num2)\nvoid subtract(char *num1, char *num2, char *result) {\n    char a[MAX_DIGITS] = {0};\n    char b[MAX_DIGITS] = {0};\n    strcpy(a, num1);\n    strcpy(b, num2);\n\n    reverse_str(a);\n    reverse_str(b);\n\n    int len1 = strlen(a);\n    int len2 = strlen(b);\n    int borrow = 0;\n    result[0] = '\\0';\n\n    for(int i=0; i<len1; i++) {\n        int digit1 = a[i] - '0';\n        int digit2 = i < len2 ? (b[i] - '0') : 0;\n        int sub = digit1 - digit2 - borrow;\n        if(sub < 0) {\n            sub += 10;\n            borrow = 1;\n        }\n        else {\n            borrow = 0;\n        }\n        char temp = sub + '0';\n        strncat(result, &temp, 1);\n    }\n\n    \/\/ \u53bb\u9664\u591a\u4f59\u76840\n    while(strlen(result) > 1 && result[strlen(result)-1] == '0') {\n        result[strlen(result)-1] = '\\0';\n    }\n\n    reverse_str(result);\n}\n\n\/\/ \u5927\u6574\u6570\u4e58\u6cd5\uff1aresult = num1 * num2\nvoid multiply(char *num1, char *num2, char *result) {\n    int len1 = strlen(num1);\n    int len2 = strlen(num2);\n    int total_len = len1 + len2;\n    int temp_result[MAX_DIGITS] = {0};\n\n    \/\/ \u4ece\u53f3\u5230\u5de6\u8ba1\u7b97\u6bcf\u4e00\u4f4d\u7684\u4e58\u79ef\n    for(int i=len1-1; i>=0; i--) {\n        for(int j=len2-1; j>=0; j--) {\n            int p1 = i + j;\n            int p2 = i + j + 1;\n            int mul = (num1[i] - '0') * (num2[j] - '0') + temp_result[p2];\n            temp_result[p2] = mul % 10;\n            temp_result[p1] += mul \/ 10;\n        }\n    }\n\n    \/\/ \u6784\u5efa\u7ed3\u679c\u5b57\u7b26\u4e32\n    int i = 0;\n    while(i < total_len && temp_result[i] == 0) i++;\n    if(i == total_len) {\n        strcpy(result, "0");\n        return;\n    }\n    result[0] = '\\0';\n    for(; i < total_len; i++) {\n        char digit = temp_result[i] + '0';\n        strncat(result, &digit, 1);\n    }\n}\n\n\/\/ \u5927\u6574\u6570\u4e58\u4ee5\u5355\u4e2a\u6570\u5b57\uff1aresult = num * digit\nvoid multiply_single_digit(char *num, int digit, char *result) {\n    if(digit < 0 || digit > 9) {\n        strcpy(result, "0");\n        return;\n    }\n    char a[MAX_DIGITS] = {0};\n    strcpy(a, num);\n    reverse_str(a);\n\n    int carry = 0;\n    result[0] = '\\0';\n\n    for(int i=0; i<strlen(a); i++) {\n        int prod = (a[i] - '0') * digit + carry;\n        carry = prod \/ 10;\n        int sum = prod % 10;\n        char temp = sum + '0';\n        strncat(result, &temp, 1);\n    }\n    if(carry) {\n        char temp = carry + '0';\n        strncat(result, &temp, 1);\n    }\n\n    reverse_str(result);\n\n    \/\/ \u53bb\u9664\u524d\u5bfc\u96f6\n    int start = 0;\n    while(result[start] == '0' && start < strlen(result)-1) {\n        start++;\n    }\n    if(start > 0) {\n        memmove(result, result + start, strlen(result) - start + 1);\n    }\n}\n\n\/\/ \u5927\u6574\u6570\u9664\u4ee52\uff1aresult = num \/ 2\nvoid divide_by_two(char *num, char *result) {\n    int len = strlen(num);\n    int carry = 0;\n    result[0] = '\\0';\n\n    for(int i=0; i<len; i++) {\n        int current = carry * 10 + (num[i] - '0');\n        int quotient = current \/ 2;\n        carry = current % 2;\n        char temp = quotient + '0';\n        \/\/ \u5904\u7406\u524d\u5bfc\u96f6\n        if(!(i == 0 && quotient == 0)) {\n            strncat(result, &temp, 1);\n        }\n    }\n    if(strlen(result) == 0) {\n        strcpy(result, "0");\n    }\n}\n\nvoid uint_to_dec_str(unsigned int num, char *str) {\n    int i = 0;\n\n    \/\/ \u7279\u6b8a\u60c5\u51b5\u5904\u7406\uff1anum == 0\n    if(num == 0) {\n        str[i++] = '0';\n        str[i] = '\\0';\n        return;\n    }\n\n    \/\/ \u9010\u4f4d\u63d0\u53d6\u6570\u5b57\u5e76\u5b58\u5165\u5b57\u7b26\u4e32\uff08\u9006\u5e8f\uff09\n    while(num > 0) {\n        int digit = num % 10;\n        str[i++] = digit + '0';\n        num \/= 10;\n    }\n\n    \/\/ \u6dfb\u52a0\u5b57\u7b26\u4e32\u7ec8\u6b62\u7b26\n    str[i] = '\\0';\n\n    \/\/ \u53cd\u8f6c\u5b57\u7b26\u4e32\u4ee5\u5f97\u5230\u6b63\u786e\u7684\u987a\u5e8f\n    reverse_str(str);\n    printf("input : %s",str);\n}\n\n\/\/ \u68c0\u67e5\u5b57\u7b26\u4e32\u662f\u5426\u4e3a\u6709\u6548\u7684\u975e\u8d1f\u6574\u6570\nint is_valid_number(char *num) {\n    if(strlen(num) == 0) return 0;\n    for(int i=0; i<strlen(num); i++) {\n        if(num[i] < '0' || num[i] > '9') return 0;\n    }\n    return 1;\n}\n\nint main() {\n    \/*\n\n    12-28 00:51:55.741   16594-16594   A03200\/Native Log               com.swdd.suapp2       I     input2uintArray[0] = 54435553\n    12-28 00:51:55.741   16594-16594   A03200\/Native Log               com.swdd.suapp2       I     input2uintArray[1] = 614d7b46\n    12-28 00:51:55.741   16594-16594   A03200\/Native Log               com.swdd.suapp2       I     input2uintArray[2] = 575f6837\n    12-28 00:51:55.741   16594-16594   A03200\/Native Log               com.swdd.suapp2       I     input2uintArray[3] = 646c726f\n    12-28 00:51:55.741   16594-16594   A03200\/Native Log               com.swdd.suapp2       I     input2uintArray[4] = 535f7349\n    12-28 00:51:55.741   16594-16594   A03200\/Native Log               com.swdd.suapp2       I     input2uintArray[5] = 33425f30\n    12-28 00:51:55.741   16594-16594   A03200\/Native Log               com.swdd.suapp2       I     input2uintArray[6] = 31747561\n    12-28 00:51:55.741   16594-16594   A03200\/Native Log               com.swdd.suapp2       I     input2uintArray[7] = 7d6c7566\n\n    *\/\n    char b[MAX_DIGITS];\n    char b_squared[MAX_DIGITS] = {0};\n    char two_b[MAX_DIGITS] = {0};\n    char sum[MAX_DIGITS] = {0};\n    char numerator[MAX_DIGITS] = {0};\n    char final_result[MAX_DIGITS] = {0};\n    unsigned int x;\n    \/\/ \u63d0\u793a\u7528\u6237\u8f93\u5165\n    printf("\u8bf7\u8f93\u5165\u4e0a\u9650\u503c b\uff1a");\n    if(scanf("%x", &x) != 1) {\n        printf("\u8f93\u5165\u65e0\u6548\uff0c\u8bf7\u8f93\u5165\u4e00\u4e2a\u6574\u6570\u3002\\n");\n        return 1;\n    }\n    uint_to_dec_str(x,b);\n\n\/\/  gets(b);\n    \/\/ \u8f93\u5165\u9a8c\u8bc1\n    if(!is_valid_number(b)) {\n        printf("\u8f93\u5165\u65e0\u6548\uff0c\u8bf7\u8f93\u5165\u4e00\u4e2a\u975e\u8d1f\u6574\u6570\u3002\\n");\n        return 1;\n    }\n\n    \/\/ \u8ba1\u7b97 b^2\n    multiply(b, b, b_squared);\n    \/\/ printf("b^2 = %s\\n", b_squared); \/\/ \u8c03\u8bd5\u7528\n\n    \/\/ \u8ba1\u7b97 2 * b\n    multiply_single_digit(b, 2, two_b);\n    \/\/ printf("2*b = %s\\n", two_b); \/\/ \u8c03\u8bd5\u7528\n\n    \/\/ \u8ba1\u7b97 b^2 + 2*b\n    add(b_squared, two_b, sum);\n    \/\/ printf("b^2 + 2*b = %s\\n", sum); \/\/ \u8c03\u8bd5\u7528\n\n    \/\/ \u8ba1\u7b97 b^2 + 2*b - 3\n    subtract(sum, "3", numerator);\n    \/\/ printf("b^2 + 2*b - 3 = %s\\n", numerator); \/\/ \u8c03\u8bd5\u7528\n\n    \/\/ \u8ba1\u7b97 (b^2 + 2*b - 3) \/ 2\n    divide_by_two(numerator, final_result);\n\n    \/\/ \u8f93\u51fa\u7ed3\u679c\n    printf("\u51fd\u6570 f(x) = x + 1 \u5728\u533a\u95f4 [1, %s] \u4e0a\u7684\u5b9a\u79ef\u5206\u7ed3\u679c\u4e3a\uff1a%s\\n", b, final_result);\n\n    return 0;\n}\n<\/code><\/pre>\n
\u6240\u4ee5\u89e3\u4e00\u4e2a\u65b9\u7a0b\u5c31\u597d\u4e86\uff1a
\nexp\uff1a<\/p>\n
import struct\nimport math\n\n# \u5b9a\u4e49\u52a0\u5bc6\u5217\u8868\uff08\u5047\u8bbe\u4e3a\u5341\u8fdb\u5236\u5b57\u7b26\u4e32\uff09\nencList = [\n    "999272289930604998",\n    "1332475531266467542",\n    "1074388003071116830",\n    "1419324015697459326",\n    "978270870200633520",\n    "369789474534896558",\n    "344214162681978048",\n    "2213954953857181622"\n]\n\ndef solve_x(enc_num):\n    """\n    \u6839\u636e\u516c\u5f0f f(x) = (x^2 + 2x - 3) \/ 2 = enc_num \u53cd\u5411\u8ba1\u7b97 x\n    """\n    # \u8ba1\u7b97 8 * enc_num + 16\n    val = 8 * enc_num + 16\n    # \u8ba1\u7b97\u6574\u6570\u5e73\u65b9\u6839\n    sqrt_val = math.isqrt(val)\n    # \u521d\u6b65\u8ba1\u7b97 x_i\n    x_i = (sqrt_val - 2) \/\/ 2\n    # \u9a8c\u8bc1 x_i \u662f\u5426\u6ee1\u8db3\u65b9\u7a0b\n    if (x_i ** 2 + 2 * x_i - 3) \/\/ 2 == enc_num:\n        return x_i\n    # \u5982\u679c\u4e0d\u6ee1\u8db3\uff0c\u5c1d\u8bd5 x_i + 1\n    x_i += 1\n    if (x_i ** 2 + 2 * x_i - 3) \/\/ 2 == enc_num:\n        return x_i\n    # \u5982\u679c\u4ecd\u4e0d\u6ee1\u8db3\uff0c\u629b\u51fa\u5f02\u5e38\n    raise ValueError(f"\u65e0\u6cd5\u627e\u5230\u6ee1\u8db3\u65b9\u7a0b\u7684 x_i \u5bf9\u4e8e enc_num={enc_num}")\n\n# \u8ba1\u7b97\u6240\u6709 x_i\nx_list = []\nfor idx, enc in enumerate(encList):\n    enc_num = int(enc)\n    try:\n        x = solve_x(enc_num)\n        x_list.append(x)\n        print(f"encList[{idx}]: {enc_num}, x[{idx}]: {x}")\n    except ValueError as e:\n        print(f"Error for encList[{idx}]: {e}")\n        exit(1)\n\n# \u5c06 x_i \u6253\u5305\u4e3a\u5c0f\u7aef\u5b57\u8282\u5e8f\u76844\u5b57\u8282\u65e0\u7b26\u53f7\u6574\u6570\ninput_bytes = b''.join([struct.pack('<I', x) for x in x_list])\n\n# \u5c1d\u8bd5\u5c0632\u5b57\u8282\u8f93\u5165\u89e3\u7801\u4e3aASCII\u5b57\u7b26\u4e32\ntry:\n    ascii_str = input_bytes.decode('ascii')\n    print(f"ASCII String: {ascii_str}")\nexcept UnicodeDecodeError:\n    print("\u8f93\u5165\u65e0\u6cd5\u89e3\u7801\u4e3a\u6709\u6548\u7684ASCII\u5b57\u7b26\u4e32\u3002")\n    # \u8f93\u51fa\u5341\u516d\u8fdb\u5236\u8868\u793a\n    print(f"Hex Input: {input_bytes.hex()}")\n\n# \u8f93\u51fa\u8be6\u7ec6\u4fe1\u606f\nprint("\\n\u8be6\u7ec6\u4fe1\u606f:")\nfor i, x in enumerate(x_list):\n    packed = struct.pack('<I', x)\n    ascii_chars = ''.join([chr(b) if 32 <= b <= 126 else '.' for b in packed])\n    print(f"x[{i}]: {x} -> Bytes: {packed.hex()} -> ASCII: {ascii_chars}")\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u524d\u8a00 \u672c\u6b21SUCTF\u4e3b\u8981\u63d0\u4f9b\u4e86\u4e24\u9053\u8d5b\u9898\uff08\u867d\u7136\u88ab\u9a82\u8fa3\uff09\uff0c\u4f46\u662f\u8fd8\u662f\u5206\u4eab\u4e00\u4e0b\u51fa\u9898\u601d\u8def\uff0c\u4ee5\u53ca\u89e3\u9898\u601d\u8def\u3002 SU_APP  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1244","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=1244"}],"version-history":[{"count":39,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1244\/revisions"}],"predecessor-version":[{"id":1342,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1244\/revisions\/1342"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=1244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=1244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=1244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}