![\"file\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n
\u89e3\u5bc6Libil2cpp.so<\/p>\n
#!\/usr\/bin\/env python3\n"""\nrc4_encrypt.py\n\nUsage:\n python rc4_encrypt.py encrypt input.so output.so.enc\n python rc4_encrypt.py decrypt input.so.enc output.so.dec\n\nThis script performs RC4 encryption\/decryption (same operation).\nKey: "nihaounity" by default (you can change or pass your own key).\n"""\n\nimport sys\nimport os\n\nDEFAULT_KEY = b"nihaounity"\n\ndef rc4(data: bytes, key: bytes) -> bytes:\n """Simple RC4 implementation (KSA + PRGA)."""\n # Key-scheduling algorithm (KSA)\n S = list(range(256))\n j = 0\n key_len = len(key)\n if key_len == 0:\n raise ValueError("Key must not be empty")\n for i in range(256):\n j = (j + S[i] + key[i % key_len]) & 0xFF\n S[i], S[j] = S[j], S[i]\n\n # Pseudo-random generation algorithm (PRGA)\n i = 0\n j = 0\n out = bytearray(len(data))\n for n in range(len(data)):\n i = (i + 1) & 0xFF\n j = (j + S[i]) & 0xFF\n S[i], S[j] = S[j], S[i]\n K = S[(S[i] + S[j]) & 0xFF]^ 0x33\n out[n] = data[n] ^ K\n return bytes(out)\n\ndef process_file(mode: str, in_path: str, out_path: str, key: bytes):\n if not os.path.isfile(in_path):\n print(f"Input file not found: {in_path}")\n sys.exit(2)\n\n # Read input file\n with open(in_path, "rb") as f:\n data = f.read()\n\n # RC4 transform\n transformed = rc4(data, key)\n\n # Write output file (mode preserved with 0o644)\n tmp_out = out_path + ".tmp"\n with open(tmp_out, "wb") as f:\n f.write(transformed)\n os.replace(tmp_out, out_path)\n os.chmod(out_path, 0o644)\n print(f"{mode.title()} finished: {in_path} -> {out_path}")\n\ndef print_usage_and_exit():\n print("Usage:")\n print(" python rc4_encrypt.py encrypt input.so output.so.enc")\n print(" python rc4_encrypt.py decrypt input.so.enc output.so.dec")\n print("Optional: set RC4 key via environment variable RC4_KEY (bytes), or edit DEFAULT_KEY in script.")\n sys.exit(1)\n\ndef main():\n if len(sys.argv) != 4:\n print_usage_and_exit()\n\n mode = sys.argv[1].lower()\n input_path = sys.argv[2]\n output_path = sys.argv[3]\n\n if mode not in ("encrypt", "decrypt"):\n print_usage_and_exit()\n\n # Allow overriding key via env var (as hex or raw). If RC4_KEY_HEX set, use hex decode.\n env_key_hex = os.environ.get("RC4_KEY_HEX")\n env_key_raw = os.environ.get("RC4_KEY")\n if env_key_hex:\n try:\n key = bytes.fromhex(env_key_hex)\n except Exception as e:\n print("Invalid RC4_KEY_HEX:", e)\n sys.exit(3)\n elif env_key_raw:\n key = env_key_raw.encode("utf-8")\n else:\n key = DEFAULT_KEY\n\n process_file(mode, input_path, output_path, key)\n\nif __name__ == "__main__":\n main()\n<\/code><\/pre>\n\u68c0\u67e5metadata\u53ef\u4ee5\u53d1\u73b0\u662f\u52a0\u5bc6\u7684<\/p>\n
<\/div>
\n\u90a3\u4e48\u53ea\u80fd\u53bbil2cpp\u91cc\u9762\u770b\u4e86\uff0c\u90a3\u4e48metadata-loader\uff08il2cpp\u5b98\u65b9\u6e90\u4ee3\u7801\uff09\u4e2d\u6709\u4e00\u4e2a\u5b57\u7b26\u4e32\u53ef\u4ee5\u5e2e\u52a9\u6211\u4eec\u5b9a\u4f4d\u903b\u8f91<\/p>\n
<\/div><\/p>\n
<\/div><\/p>\n
\u6240\u4ee5\u76f4\u63a5\u53ef\u4ee5\u770b\u5230else\u540e\u9762\u7684\u903b\u8f91\u5c31\u662f\u5f00\u59cb\u8f7d\u5165metadata\u4e86<\/p>\n
<\/div><\/p>\n
\u770b\u5230\u89e3\u5bc6\u903b\u8f91\uff0c\u76f4\u63a5\u5199\u89e3\u5bc6\u811a\u672c<\/p>\n
#!\/usr\/bin\/env python3\n"""\nil2cpp-style file "decryption" script that mirrors PromiseAntiencryption in C.\n\nUsage:\n python il2cpp_decrypt.py input_encrypted_file output_decrypted_file\n"""\n\nimport sys\nimport struct\nfrom pathlib import Path\n\nSAFE_SIZE = 1024 # \u4e0e C \u91cc\u4e00\u81f4\n\ndef decrypt_file(in_path: str, out_path: str, little_endian: bool = True):\n data = Path(in_path).read_bytes()\n total_len = len(data)\n\n if total_len < SAFE_SIZE + 4:\n raise ValueError("\u6587\u4ef6\u8fc7\u77ed\uff0c\u65e0\u6cd5\u5305\u542b\u5b89\u5168\u533a\u548c mask header")\n\n endian = "<" if little_endian else ">"\n u32 = endian + "I"\n\n # \u5728 safe_size \u504f\u79fb\u5904\u8bfb\u53d6 header uint32\uff0c\u4f4e 16 \u4f4d\u4e3a kl\n header_val = struct.unpack_from(u32, data, SAFE_SIZE)[0]\n kl = header_val & 0xffff\n if kl <= 0:\n raise ValueError(f"\u975e\u6cd5\u7684 kl: {kl}")\n\n # \u8ba1\u7b97\u504f\u79fb\n mask_header_offset = SAFE_SIZE # header \u5728\u8fd9\u91cc\n mask_array_offset = mask_header_offset + 4 # \u7d27\u8ddf header\n enc_data_offset = SAFE_SIZE + 4 * (kl + 1) # header + kl \u4e2a uint32 \u540e\u9762\u5c31\u662f\u52a0\u5bc6\u6570\u636e\n\n if total_len < enc_data_offset:\n raise ValueError("\u6587\u4ef6\u592a\u77ed\uff0c\u65e0\u6cd5\u5305\u542b\u58f0\u660e\u7684 mask \u6570\u7ec4\u548c\u52a0\u5bc6\u6570\u636e")\n\n # \u8bfb\u53d6 mask \u6570\u7ec4\uff08kl \u4e2a uint32\uff09\n mask = []\n for i in range(kl):\n off = mask_array_offset + 4 * i\n mask.append(struct.unpack_from(u32, data, off)[0])\n\n # \u52a0\u5bc6\u6570\u636e\u957f\u5ea6\uff08\u5b57\u8282\uff09\n enc_len = total_len - enc_data_offset\n # C \u4ee3\u7801\u4ee5 4 \u5b57\u8282\u4e3a\u5355\u4f4d\u5904\u7406 => \u5982\u679c\u4e0d\u662f 4 \u7684\u500d\u6570\uff0c\u6309\u53ef\u7528\u957f\u5ea6\u5904\u7406\uff08\u4e0e C \u4ee3\u7801\u4e00\u81f4\u6027\u4f9d\u8d56\u4e8e\u6e90\u6587\u4ef6\uff09\n enc_len_trunc = enc_len - (enc_len % 4)\n\n # \u6784\u9020\u8f93\u51fa\uff1a\u5148\u5199 safe \u533a\uff08\u539f\u6837 copy\uff09\uff0c\u7136\u540e\u5199\u89e3\u5bc6\u540e\u7684\u6570\u636e\n out_bytes = bytearray()\n out_bytes += data[0:SAFE_SIZE]\n\n # \u89e3\u5bc6\u5faa\u73af\uff08\u6bcf 4 \u5b57\u8282\uff09\n # i \u8868\u793a\u76f8\u5bf9\u4e8e enc_data_offset \u7684\u5b57\u8282\u504f\u79fb\uff080,4,8,...\uff09\n for i in range(0, enc_len_trunc, 4):\n # index = (i + (i \/\/ kl)) % kl \uff08\u6ce8\u610f C \u4e2d i\/kl \u4e3a\u6574\u9664\uff09\n idx = (i + (i \/\/ kl)) % kl\n mask_word = mask[idx]\n enc_word = struct.unpack_from(u32, data, enc_data_offset + i)[0]\n plain_word = mask_word ^ enc_word\n out_bytes += struct.pack(u32, plain_word)\n\n # \u5982\u679c enc_len \u4e0d\u662f 4 \u7684\u500d\u6570\uff0cC \u7248\u672c\u5b9e\u9645\u4e0a\u4e0d\u4f1a\u5904\u7406\u672b\u5c3e\u4e0d\u8db3 4 \u5b57\u8282\u7684\u90e8\u5206\uff08\u56e0\u4e3a\u5b83\u6b65\u957f\u4e3a4\uff09\n # \u4e3a\u4e86\u5b89\u5168\uff0c\u8fd9\u91cc\u628a\u539f\u59cb\u6b8b\u4f59\u5b57\u8282\u5ffd\u7565\uff08\u4e0e C \u884c\u4e3a\u4e00\u81f4\uff09\u3002\u5982\u9700\u4fdd\u7559\u672a\u5904\u7406\u5c3e\u90e8\uff0c\u53ef\u53d6\u6d88\u4e0b\u9762\u6ce8\u91ca\u3002\n # if enc_len % 4 != 0:\n # out_bytes += data[enc_data_offset + enc_len_trunc : enc_data_offset + enc_len]\n\n # \u8f93\u51fa\u5230\u6587\u4ef6\n Path(out_path).write_bytes(bytes(out_bytes))\n print(f"\u5df2\u5199\u51fa\u89e3\u5bc6\u7ed3\u679c: {out_path} (\u8f93\u51fa\u5927\u5c0f {len(out_bytes)} \u5b57\u8282)")\n\ndef main():\n if len(sys.argv) != 3:\n print("\u7528\u6cd5: python il2cpp_decrypt.py input_encrypted_file output_decrypted_file")\n sys.exit(2)\n in_f = sys.argv[1]\n out_f = sys.argv[2]\n try:\n decrypt_file(in_f, out_f, little_endian=True)\n except Exception as e:\n print("\u89e3\u5bc6\u5931\u8d25:", e)\n sys.exit(1)\n\nif __name__ == "__main__":\n main()\n<\/code><\/pre>\n<\/div><\/p>\n
\u89e3\u5bc6\u540e\u7684\u6539\u540d\u56deglobal-metadata.dat<\/p>\n
\u7136\u540e\u4f7f\u7528il2cppdumper<\/p>\n
<\/div><\/p>\n
dump\u6210\u529f\u8f7d\u5165\u7b26\u53f7,\u7136\u540e\u627e\u5230flagcheck\uff0c\u76f4\u63a5\u770b\u903b\u8f91<\/p>\n
<\/div><\/p>\n
<\/div><\/p>\n
\u5bc6\u6587\u5728\u8fd9\u91cc\u4e0b\u65ad\u70b9\u83b7\u53d6<\/p>\n
<\/div><\/p>\n
<\/div><\/p>\n
\u81ea\u7136Tea\u7684key\u4e5f\u9700\u8981\u8c03\u8bd5\u83b7\u53d6\u6216\u8005frida Hook<\/p>\n
<\/div><\/p>\n
\u4f46\u9700\u8981\u8fc7Frida check<\/p>\n
\u6216\u8005\u6839\u636eil2cpp\u7279\u6027<\/p>\n
\u6570\u636e\u5728\u8fd9\u91cc\u521d\u59cb\u5316<\/p>\n
<\/div><\/p>\n
<\/div><\/p>\n
4\u4e2aint\u662ftea key<\/p>\n
40\u4e2abyte\u662f\u5bc6\u6587<\/p>\n
C8E4E9E3F34C25560172B0D40B6DF4823260AA87EC6866054AA4691711E5D7BF<\/p>\n
\u627e\u5230\u54c8\u5e0c<\/p>\n
\u5728il2cppdumper\u751f\u6210\u7684dump.cs\u4e2d\u67e5\u627e<\/p>\n
<\/div><\/p>\n
\u627e\u5230offset\uff0c\u7136\u540e\u76f4\u63a5\u9759\u6001dump<\/p>\n
#!\/usr\/bin\/env python3\nimport argparse\nimport os\nimport sys\nfrom pathlib import Path\nimport textwrap\nimport binascii\n\nDEFAULTS = [\n # (offset, size, shortname)\n (0xF901D, 40, "29FC2CC7_40"), # your __StaticArrayInitTypeSize=40 29FC2...\n (0xF9045, 16, "C8E4E9E3_16"), # your __StaticArrayInitTypeSize=16 C8E4...\n]\n\ndef parse_extra(s):\n # format: offset:size:name (offset can be hex with 0x)\n parts = s.split(":")\n if len(parts) < 2:\n raise ValueError("extra must be offset:size[:name]")\n off = int(parts[0], 0)\n size = int(parts[1], 0)\n name = parts[2] if len(parts) >= 3 else f"blob_{off:X}"\n return (off, size, name)\n\ndef to_csharp_byte_array(b: bytes, per_line=16):\n hexs = [f"0x{c:02X}" for c in b]\n lines = []\n for i in range(0, len(hexs), per_line):\n lines.append(", ".join(hexs[i:i+per_line]))\n joined = (",\\n ").join(lines)\n return "new byte[] {\\n " + joined + "\\n};"\n\ndef main():\n p = argparse.ArgumentParser(description="Extract raw blobs from global-metadata.dat by offset+size.")\n p.add_argument("--meta", "-m", required=True, help="Path to global-metadata.dat")\n p.add_argument("--outdir", "-o", default="extracted_private_impl", help="Output directory")\n p.add_argument("--extra", "-e", action="append", help="Extra offset:size[:name] (hex allowed), repeatable")\n p.add_argument("--defaults", action="store_true", help="Also extract script's built-in defaults")\n args = p.parse_args()\n\n meta_path = Path(args.meta)\n if not meta_path.is_file():\n print("Error: metadata file not found:", meta_path)\n sys.exit(2)\n\n outdir = Path(args.outdir)\n outdir.mkdir(parents=True, exist_ok=True)\n\n targets = []\n if args.defaults or not args.extra:\n # Add defaults if requested or if no extras provided\n targets.extend(DEFAULTS)\n\n if args.extra:\n for s in args.extra:\n try:\n t = parse_extra(s)\n except Exception as ex:\n print("Failed to parse extra:", s, ex)\n sys.exit(2)\n targets.append(t)\n\n print(f"Reading metadata: {meta_path}")\n with open(meta_path, "rb") as f:\n metadata = f.read()\n\n meta_len = len(metadata)\n print(f"Metadata length: {meta_len} bytes\\n")\n\n for off, size, name in targets:\n if off < 0 or off >= meta_len:\n print(f"[!] Offset 0x{off:X} out of range (file size {meta_len}): skipping {name}")\n continue\n # defensive: don't read past EOF\n read_size = min(size, meta_len - off)\n if read_size <= 0:\n print(f"[!] Nothing to read at 0x{off:X} for {name}")\n continue\n\n blob = metadata[off:off+read_size]\n binfname = outdir \/ f"{name}_0x{off:X}_len{read_size}.bin"\n with open(binfname, "wb") as out:\n out.write(blob)\n\n print(f"[+] Extracted {name}: offset=0x{off:X}, size={read_size} -> {binfname}")\n # print hex preview (first 256 bytes)\n preview = binascii.hexlify(blob[:256]).decode()\n spaced = " ".join(preview[i:i+2] for i in range(0, len(preview), 2))\n print(" preview:", spaced if spaced else "(empty)")\n # print as C# initializer\n cs = to_csharp_byte_array(blob)\n print("\\n C# byte[] initializer:\\n")\n print(textwrap.indent(cs, " "))\n print("\\n" + ("-"*60) + "\\n")\n\n print("Done. Files saved under:", outdir.resolve())\n\nif __name__ == "__main__":\n main()\n<\/code><\/pre>\n<\/div><\/p>\n
\u8fd8\u539f\u51fa\u6765\u7684\u52a0\u5bc6\u903b\u8f91\u5c31\u5982\u4e0b<\/p>\n
#include<cstdio>\n#include<cmath>\n#include<map>\n#include<vector>\n#include<queue>\n#include<stack>\n#include<set>\n#include<string>\n#include<cstring>\n#include<list>\n#include<stdlib.h>\nusing namespace std;\ntypedef int status;\ntypedef int selemtype;\n\nunsigned int Key[7] = {0x12345678, 0x09101112, 0x13141516, 0x15161718};\n\nvoid tea_encrypt(uint32_t *v, uint32_t *k) {\n printf("%X %X\\n",v[0],v[1]);\n uint32_t v0 = v[0], v1 = v[1], sum = 0, i;\n uint32_t delta = 0x61C88647;\n\n for (i = 0; i < 16; i++) {\n v0 += ((v1 << 4) + k[0]) ^ (v1 + sum) ^ ((v1 >> 5) + k[1]);\n v1 += ((v0 << 4) + k[2]) ^ (v0 + sum) ^ ((v0 >> 5) + k[3]);\n sum -= delta;\n }\n\n v[0] = v0;\n v[1] = v1;\n}\n\nunsigned char Cipher[256] = "flag{unitygame_I5S0ooFunny_Isnotit?????}";\nunsigned int Tmp[4] = {0};\nint main() {\n unsigned int *p1 = (unsigned int *)(Cipher);\n unsigned int *p2 = (unsigned int *)(Cipher + 4);\n printf("%s\\n", Cipher);\n\n Tmp[0] = *p1, Tmp[1] = *p2;\n tea_encrypt(Tmp, Key);\n printf("%X %X\\n", *p1, *p2);\n *p1 = Tmp[0];\n *p2 = Tmp[1];\n for (int i = 2 ; i < strlen((char*) Cipher) \/ 4 ; i += 2 ) {\n tea_encrypt(Tmp, Key);\n\n *p1 = Tmp[0];\n *p2 = Tmp[1];\n\/\/ printf("%X %X\\n", *p1, *p2);\n unsigned int *p3 = (unsigned int *)(Cipher + i * 4);\n unsigned int *p4 = (unsigned int *)(Cipher + i * 4 + 4);\n *p3 ^= *p1;\n *p4 ^= *p2;\n };\n for (int i = 0 ; i < 40 ; i ++ ) {\n printf("0x%X,", Cipher[i]);\n }\n\n}<\/code><\/pre>\n\u5199\u89e3\u5bc6\u903b\u8f91\u5982\u4e0b\uff1a<\/p>\n
#include <cstdio>\n#include <cstring>\n#include <cstdint>\n#include <iostream>\n\nusing namespace std;\n\nunsigned int Key[6] = {0x12345678, 0x09101112, 0x13141516, 0x15161718};\n\nvoid tea_decrypt(uint32_t *v, uint32_t *k) {\n\/\/ printf("%X %X\\n",v[0],v[1]);\n uint32_t v0 = v[0], v1 = v[1], sum = 0, i;\n uint32_t delta = 0x61C88647;\n for (int i = 0 ; i < 16 ; i ++ ) sum -= 0x61C88647;\n for (i = 0; i < 16; i++) {\n sum += delta;\n v1 -= ((v0 << 4) + k[2]) ^ (v0 + sum) ^ ((v0 >> 5) + k[3]);\n v0 -= ((v1 << 4) + k[0]) ^ (v1 + sum) ^ ((v1 >> 5) + k[1]);\n\n }\n\n v[0] = v0;\n v[1] = v1;\n}\n\nunsigned int Tmp[4] = {0};\n\nint main() {\n unsigned char EncryptedCipher[45] = {\n0xAF,0x58,0x64,0x40,0x9D,0xB9,0x21,0x67,0xAE,0xB5,0x29,0x4,0x9E,0x86,0xC5,0x43,0x23,0xF,0xBF,0xA6,0xB2,0xAE,0x4A,0xB5,0xC5,0x69,0xB7,0xA8,0x3,0xD1,0xAE,0xCF,0xC6,0x2C,0x5B,0x7F,0xA2,0x86,0x1E,0x1A, };\n unsigned int *p1 = (unsigned int *)(EncryptedCipher);\n unsigned int *p2 = (unsigned int *)(EncryptedCipher + 4);\n for (int i = 8 ; i >= 2 ; i -= 2) {\n\n unsigned int *p3 = (unsigned int *)(EncryptedCipher + i * 4);\n unsigned int *p4 = (unsigned int *)(EncryptedCipher + i * 4 + 4);\n *p3 ^= *p1;\n *p4 ^= *p2;\n puts((char*)EncryptedCipher);\n Tmp[0] = *p1, Tmp[1] = *p2;\n tea_decrypt(Tmp, Key);\n *p1 = Tmp[0], *p2 = Tmp[1];\n\n }\n Tmp[0] = *p1, Tmp[1] = *p2;\n tea_decrypt(Tmp, Key);\n *p1 = Tmp[0], *p2 = Tmp[1];\n puts((char*)EncryptedCipher);\n\n}<\/code><\/pre>\n\u62ff\u5230flag\uff1aflag{unitygame_I5S0ooFunny_Isnotit?????}<\/p>\n
\u81f3\u6b64\u5168\u6587\u5b8c\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u524d\u8a00 \u6b63\u503c\u67d0\u6bd4\u8d5b\u51fa\u9898\uff0c\u4e00\u9053\u56f0\u96be\u9898\u4e0d\u77e5\u9053\u8981\u600e\u4e48\u51fa\u624d\u597d\uff0c\u7a81\u7136\u60f3\u8d77\u4e86il2cpp\u5728\u5b89\u5353\u5e73\u53f0\u7684\u52a0\u5bc6\uff0c\u4f46\u662f\u672c\u4eba\u53c8\u4e0d\u592a\u4f1a\u8fd9 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1522","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=1522"}],"version-history":[{"count":26,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1522\/revisions"}],"predecessor-version":[{"id":1584,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/1522\/revisions\/1584"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=1522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=1522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=1522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1761470166103.png\")
\n<\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1761470914355.png\")
<\/div>![](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762163496294.png\")
\n<\/p>\n![](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762164880718.png\")
\n<\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762166351180.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762167564566.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762182389917.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762184857599.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762186461100.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762222947556.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762224503263.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762225980653.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762225997416.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226021102.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226030080.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226038060.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226045179.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226051716.png\")
<\/div>![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226059887.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226067832.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226081544.png\")
<\/div>![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226087371.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226101078.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226107418.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226125712.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226132164.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226141950.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226148463.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226154499.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226160561.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226168780.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226174728.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226180273.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226188357.png\")
<\/div><\/p>\n![\"file\"](\"https:\/\/blog.shangwendada.top\/wp-content\/uploads\/2025\/10\/image-1762226213547.png\")
<\/div><\/p>\n