楚慧杯初赛—RE
楚慧杯初赛——RE复现
Level_One
这里发现还是jeb好用
package com.example.mobile1;import android.os.Bundle;
import android.view.View.OnClickListener;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import androidx.appcompat.app.AppCompatActivity;
import java.nio.charset.StandardCharsets;public class MainActivity extends AppCompatActivity {Button check;EditText flag;String input;private String Encrypt(byte[] arg12) {String v0 = this.getResources().getString(0x7F0E006C); // string:table "n4/Xv90ElB32S6MmyK+iVIgkjU17CDGaLYxeuzsc8TqNOtrJWPfRp=HFhAwdb5oZQ"StringBuilder v1 = new StringBuilder();int[] v3 = new int[4];int v4 = arg12.length - arg12.length % 3;int v7;for(v7 = 0; v7 < v4; v7 += 3) {int v8 = 0;int v9 = 0;while(v8 < 3) {v9 = v9 << 8 | arg12[v7 + v8] & 0xFF;++v8;}int v8_1;for(v8_1 = 0; v8_1 < 4; ++v8_1) {v3[v8_1] = v9 & 0x3F;v9 >>= 6;}int v8_2;for(v8_2 = 3; v8_2 >= 0; --v8_2) {v1.append(((char)v0.charAt(v3[v8_2])));}}int v3_1 = arg12.length % 3;if(v3_1 == 1) {v1.append(((char)v0.charAt(arg12[arg12.length - 1] >> 2)));v1.append(((char)v0.charAt((arg12[arg12.length - 1] & 3) << 4)));v1.append("%&");}else if(v3_1 == 2) {v1.append(((char)v0.charAt(arg12[arg12.length - 2] >> 2)));v1.append(((char)v0.charAt(arg12[arg12.length - 1] >> 4 | (arg12[arg12.length - 2] & 3) << 4)));v1.append(((char)v0.charAt((arg12[arg12.length - 1] & 15) << 2)));v1.append('*');return v1.toString();}return v1.toString();}@Override // androidx.fragment.app.FragmentActivityprotected void onCreate(Bundle arg2) {super.onCreate(arg2);this.setContentView(0x7F0B001C); // layout:activity_mainthis.flag = (EditText)this.findViewById(0x7F0800C0); // id:inputButton v2 = (Button)this.findViewById(0x7F080060); // id:check_flagthis.check = v2;v2.setOnClickListener(new View.OnClickListener() {@Override // android.view.View$OnClickListenerpublic void onClick(View arg3) {MainActivity.this.input = MainActivity.this.flag.getText().toString();if(MainActivity.this.Encrypt(MainActivity.this.input.getBytes(StandardCharsets.UTF_8)).equals(MainActivity.this.getString(0x7F0E0025))) { // string:enc "UsPYUFORMXnHSXIe6xpFSilR2iKs6RvtjeVFSfpHSX9zM0Sp6XVFjeK5"Toast.makeText(MainActivity.this, "you got it", 1).show();return;}Toast.makeText(MainActivity.this, "error, try hard", 1).show();}});}
}一眼魔改Base系列
import base64
string_table="n4/Xv90ElB32S6MmyK+iVIgkjU17CDGaLYxeuzsc8TqNOtrJWPfRp=HFhAwdb5oZQ"
enc='UsPYUFORMXnHSXIe6xpFSilR2iKs6RvtjeVFSfpHSX9zM0Sp6XVFjeK5'
# -*- coding: utf-8
import base64STANDARD_ALPHABET = b'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/x'
CUSTOM_ALPHABET = b'n4/Xv90ElB32S6MmyK+iVIgkjU17CDGaLYxeuzsc8TqNOtrJWPfRp=HFhAwdb5oZQ'
ENCODE_TRANS = bytes.maketrans(STANDARD_ALPHABET, CUSTOM_ALPHABET)
DECODE_TRANS = bytes.maketrans(CUSTOM_ALPHABET, STANDARD_ALPHABET)def encode(input):return base64.b64encode(input).translate(ENCODE_TRANS)def decode(input):return base64.b64decode(input.translate(DECODE_TRANS))destr = decode(enc)
print(destr.decode()) #flag{380605c6-7123-4f71-b573-601e8c4457b4}
Level_Up
重点是SO文件
key和enc都给出，看加密
EXP
enc=b'gOuWlCTi+hhzCn6rWxDm8IuuBwiOtM+V/m39bthXTeT3E6WYrLU0CDqG76Kvpkmc'
key=b'followyourheart!'
import base64
tmep_string=base64.b64decode(enc)
print(tmep_string)
from Crypto.Cipher import AESaes = AES.new(key,AES.MODE_ECB) #创建一个aes对象
den_text = aes.decrypt(tmep_string) # 解密密文
print(den_text)
#b'flag{6b1df900-1284-11ed-9fa7-5405dbe5e745}\\x06\\x06\\x06\\x06\\x06\\x06'ezevem
__int64 __fastcall main(int a1, char **a2, char **a3)
{int v4; // [rsp+4h] [rbp-DCh]int i; // [rsp+8h] [rbp-D8h]int j; // [rsp+Ch] [rbp-D4h]int enc[40]; // [rsp+10h] [rbp-D0h]__int64 v8[4]; // [rsp+B0h] [rbp-30h] BYREFint v9; // [rsp+D0h] [rbp-10h]__int16 v10; // [rsp+D4h] [rbp-Ch]char v11; // [rsp+D6h] [rbp-Ah]unsigned __int64 v12; // [rsp+D8h] [rbp-8h]v12 = __readfsqword(0x28u);memset(v8, 0, sizeof(v8));v9 = 0;v10 = 0;v11 = 0;enc[38] = 0;enc[0] = 138;enc[1] = 144;enc[2] = 131;enc[3] = 137;enc[4] = 125;enc[5] = 136;enc[6] = 131;enc[7] = 52;enc[8] = 135;enc[9] = 134;enc[10] = 135;enc[11] = 51;enc[12] = 134;enc[13] = 57;enc[14] = 56;enc[15] = 55;enc[16] = 134;enc[17] = 135;enc[18] = 58;enc[19] = 58;enc[20] = 54;enc[21] = 60;enc[22] = 54;enc[23] = 56;enc[24] = 51;enc[25] = 138;enc[26] = 136;enc[27] = 53;enc[28] = 59;enc[29] = 134;enc[30] = 60;enc[31] = 52;enc[32] = 52;enc[33] = 55;enc[34] = 53;enc[35] = 54;enc[36] = 54;enc[37] = 127;v4 = 0;printf("plz enter flag: ");__isoc99_scanf("%s", v8);for ( i = 0; i <= 37; ++i )input[i] = *((char *)v8 + i);while ( opt[v4] ){switch ( opt[v4] ){case 1u:Xor(opt[v4 + 1], opt[v4 + 2]);break;case 2u:Add(opt[v4 + 1], opt[v4 + 2]);break;case 3u:Sub(opt[v4 + 1], opt[v4 + 2]);break;case 4u:Left(opt[v4 + 1], opt[v4 + 2]); // temp[opt[v4 + 1]] <<= temp[opt[v4 + 2]];break;case 5u:Right(opt[v4 + 1], opt[v4 + 2]); // temp[a1] = (int)temp[a1] >> temp[a2];break;case 6u:SetInput(opt[v4 + 1], opt[v4 + 2]); // input[a1] = temp[a2];break;case 7u:GetInput(opt[v4 + 1], opt[v4 + 2]); // temp[a1] = input[a2];break;case 8u:SetTemp(opt[v4 + 1], opt[v4 + 2]); // temp[a1] = a2;break;default:break;}v4 += 3;}for ( j = 0; j <= 37; ++j ){if ( enc[j] != input[j + 50] )exit(0);}printf("yes flag is %s", (const char *)v8);return 0LL;
}
拿到输出
temp[1]= 17;
temp[2]= 19;
temp[0] = szInput[0];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[0] = temp[0];
temp[0] = szInput[1];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[1] = temp[0];
temp[0] = szInput[2];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[2] = temp[0];
temp[0] = szInput[3];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[3] = temp[0];
temp[0] = szInput[4];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[4] = temp[0];
temp[0] = szInput[5];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[5] = temp[0];
temp[0] = szInput[6];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[6] = temp[0];
temp[0] = szInput[7];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[7] = temp[0];
temp[0] = szInput[8];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[8] = temp[0];
temp[0] = szInput[9];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[9] = temp[0];
temp[0] = szInput[10];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[10] = temp[0];
temp[0] = szInput[11];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[11] = temp[0];
temp[0] = szInput[12];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[12] = temp[0];
temp[0] = szInput[13];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[13] = temp[0];
temp[0] = szInput[14];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[14] = temp[0];
temp[0] = szInput[15];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[15] = temp[0];
temp[0] = szInput[16];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[16] = temp[0];
temp[0] = szInput[17];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[17] = temp[0];
temp[0] = szInput[18];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[18] = temp[0];
temp[0] = szInput[19];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[19] = temp[0];
temp[0] = szInput[20];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[20] = temp[0];
temp[0] = szInput[21];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[21] = temp[0];
temp[0] = szInput[22];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[22] = temp[0];
temp[0] = szInput[23];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[23] = temp[0];
temp[0] = szInput[24];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[24] = temp[0];
temp[0] = szInput[25];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[25] = temp[0];
temp[0] = szInput[26];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[26] = temp[0];
temp[0] = szInput[27];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[27] = temp[0];
temp[0] = szInput[28];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[28] = temp[0];
temp[0] = szInput[29];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[29] = temp[0];
temp[0] = szInput[30];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[30] = temp[0];
temp[0] = szInput[31];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[31] = temp[0];
temp[0] = szInput[32];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[32] = temp[0];
temp[0] = szInput[33];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[33] = temp[0];
temp[0] = szInput[34];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[34] = temp[0];
temp[0] = szInput[35];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[35] = temp[0];
temp[0] = szInput[36];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[36] = temp[0];
temp[0] = szInput[37];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[37] = temp[0];
这里其实是异或再加，
使用z3
enc=[138, 144, 131, 137, 125, 136, 131, 52, 135, 134, 135, 51, 134, 57, 56, 55, 134, 135, 58, 58, 54, 60, 54, 56, 51, 138, 136, 53, 59, 134, 60, 52, 52, 55, 53, 54, 54, 127, 0]
from z3 import *
s=Solver()
szInput=[BitVec(f'{i}',64) for i in range(38)]
for i in szInput:s.add(i<127)s.add(i>0)temp=[0]*38
temp[1]= 17;
temp[2]= 19;
temp[0] = szInput[0];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[0] = temp[0];
temp[0] = szInput[1];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[1] = temp[0];
temp[0] = szInput[2];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[2] = temp[0];
temp[0] = szInput[3];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[3] = temp[0];
temp[0] = szInput[4];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[4] = temp[0];
temp[0] = szInput[5];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[5] = temp[0];
temp[0] = szInput[6];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[6] = temp[0];
temp[0] = szInput[7];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[7] = temp[0];
temp[0] = szInput[8];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[8] = temp[0];
temp[0] = szInput[9];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[9] = temp[0];
temp[0] = szInput[10];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[10] = temp[0];
temp[0] = szInput[11];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[11] = temp[0];
temp[0] = szInput[12];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[12] = temp[0];
temp[0] = szInput[13];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[13] = temp[0];
temp[0] = szInput[14];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[14] = temp[0];
temp[0] = szInput[15];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[15] = temp[0];
temp[0] = szInput[16];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[16] = temp[0];
temp[0] = szInput[17];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[17] = temp[0];
temp[0] = szInput[18];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[18] = temp[0];
temp[0] = szInput[19];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[19] = temp[0];
temp[0] = szInput[20];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[20] = temp[0];
temp[0] = szInput[21];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[21] = temp[0];
temp[0] = szInput[22];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[22] = temp[0];
temp[0] = szInput[23];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[23] = temp[0];
temp[0] = szInput[24];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[24] = temp[0];
temp[0] = szInput[25];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[25] = temp[0];
temp[0] = szInput[26];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[26] = temp[0];
temp[0] = szInput[27];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[27] = temp[0];
temp[0] = szInput[28];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[28] = temp[0];
temp[0] = szInput[29];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[29] = temp[0];
temp[0] = szInput[30];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[30] = temp[0];
temp[0] = szInput[31];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[31] = temp[0];
temp[0] = szInput[32];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[32] = temp[0];
temp[0] = szInput[33];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[33] = temp[0];
temp[0] = szInput[34];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[34] = temp[0];
temp[0] = szInput[35];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[35] = temp[0];
temp[0] = szInput[36];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[36] = temp[0];
temp[0] = szInput[37];
temp[0] ^= temp[1];
temp[0] += temp[2];
szInput[37] = temp[0];
for i in range(38):s.add(szInput[i]==enc[i])
print(s.check())
if s.check()==sat:m=s.model()inp=[BitVec(f'{i}',64) for i in range(38)] for i in inp:print(chr(m[i].as_long()),end='')#sat#flag{da0ebe1b745be6628241fd39b8005322}crackMe
多次调试后发现密文，密文提取
SM4脚本：https://ppppz.net/2022/02/03/SM4-P-Z/
再直接AES解密就行
// chb.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//#include <stdio.h>
#include <string.h>
#include "SM4.h"
int main()
{unsigned char key[16] ={0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F };unsigned char output[16] ={ 0x6C, 0xC6, 0xC0, 0x55, 0xBE, 0xF5, 0xDF, 0x8D, 0xAD, 0x40, 0x90, 0xF6, 0x3B, 0xF0, 0xC4, 0xA4 };Context ctx;int i;SetKeyDec(&ctx, key);CryptEBC(&ctx, 0, 16, output, output);for (i = 0; i < 16; i++)printf("0x%x,", output[i]);return 0;}key=[0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F]
enc=[0x1d,0x95,0x3d,0x55,0x1c,0xa,0x27,0xeb,0xe0,0xe2,0x81,0xab,0xc1,0x43,0x32,0x29]from Crypto.Cipher import AESaes = AES.new(bytes(key),AES.MODE_ECB) #创建一个aes对象
den_text = aes.decrypt(bytes(enc)) # 解密密文
print(den_text)import hashlib
s='8c1a2110398ff814'
print(hashlib.md5(s.encode()).hexdigest())find_the_way
有别与数组迷宫题，RE首先放这题，感觉很简单但当时没做出来。
输入从环境里面拿的，这里记得附加就行
这里Map的一个单元是在堆里面的
我们可以解释为一个结构体
typedef long long QWORD;
struct tagMap {QWORD m_QPre_address; QWORD m_QNext_address;QWORD m_QNext_address2;char szarray[8];QWORD Unuse;QWORD Unuse2;};
根据判断
后面的 Unuse，Unuse2到不是很重要
主要是看
QWORD m_QPre_address; //上一个地址 a QWORD m_QNext_address; //下一个地址 dQWORD m_QNext_address2;//下一个地址2 t// szarray 前3个 代表有没有路 1为有路，0为无路szarray[0];szarray[1];szarray[2];szarray[3];
把堆全copy下来，写递归解就行
Num_map=[0x000055CD7A81DF10, 0x000055CD7A81DF40, 0x000055CD7A81DFD0, 0x000055CD7A81E0C0, 0x000055CD7A81E210, 0x000055CD7A81E3C0, 0x000055CD7A81E5D0, 0x000055CD7A81E840, 0x000055CD7A81EB10, 0x000055CD7A81EE40, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x0000000000000000, 0x000055CD7A81DF70, 0x0000000000000101, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81DF70, 0x000055CD7A81E000, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81DF40, 0x000055CD7A81DFA0, 0x000055CD7A81DF10, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81DF70, 0x0000000000000000, 0x000055CD7A81E060, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81E000, 0x000055CD7A81E0F0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81DFD0, 0x000055CD7A81E030, 0x000055CD7A81DF40, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E000, 0x000055CD7A81E060, 0x000055CD7A81E150, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E030, 0x000055CD7A81E090, 0x000055CD7A81DFA0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E060, 0x0000000000000000, 0x000055CD7A81E1B0, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81E0F0, 0x000055CD7A81E240, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E0C0, 0x000055CD7A81E120, 0x000055CD7A81DFD0, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E0F0, 0x000055CD7A81E150, 0x000055CD7A81E2A0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E120, 0x000055CD7A81E180, 0x000055CD7A81E030, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E150, 0x000055CD7A81E1B0, 0x000055CD7A81E300, 0x0000000000010001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E180, 0x000055CD7A81E1E0, 0x000055CD7A81E090, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E1B0, 0x0000000000000000, 0x000055CD7A81E360, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81E240, 0x000055CD7A81E3F0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E210, 0x000055CD7A81E270, 0x000055CD7A81E0C0, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E240, 0x000055CD7A81E2A0, 0x000055CD7A81E450, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E270, 0x000055CD7A81E2D0, 0x000055CD7A81E120, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E2A0, 0x000055CD7A81E300, 0x000055CD7A81E4B0, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E2D0, 0x000055CD7A81E330, 0x000055CD7A81E180, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E300, 0x000055CD7A81E360, 0x000055CD7A81E510, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E330, 0x000055CD7A81E390, 0x000055CD7A81E1E0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E360, 0x0000000000000000, 0x000055CD7A81E570, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81E3F0, 0x000055CD7A81E600, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E3C0, 0x000055CD7A81E420, 0x000055CD7A81E210, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E3F0, 0x000055CD7A81E450, 0x000055CD7A81E660, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E420, 0x000055CD7A81E480, 0x000055CD7A81E270, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E450, 0x000055CD7A81E4B0, 0x000055CD7A81E6C0, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E480, 0x000055CD7A81E4E0, 0x000055CD7A81E2D0, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E4B0, 0x000055CD7A81E510, 0x000055CD7A81E720, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E4E0, 0x000055CD7A81E540, 0x000055CD7A81E330, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E510, 0x000055CD7A81E570, 0x000055CD7A81E780, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E540, 0x000055CD7A81E5A0, 0x000055CD7A81E390, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E570, 0x0000000000000000, 0x000055CD7A81E7E0, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81E600, 0x000055CD7A81E870, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E5D0, 0x000055CD7A81E630, 0x000055CD7A81E3C0, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E600, 0x000055CD7A81E660, 0x000055CD7A81E8D0, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E630, 0x000055CD7A81E690, 0x000055CD7A81E420, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E660, 0x000055CD7A81E6C0, 0x000055CD7A81E930, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E690, 0x000055CD7A81E6F0, 0x000055CD7A81E480, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E6C0, 0x000055CD7A81E720, 0x000055CD7A81E990, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E6F0, 0x000055CD7A81E750, 0x000055CD7A81E4E0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E720, 0x000055CD7A81E780, 0x000055CD7A81E9F0, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E750, 0x000055CD7A81E7B0, 0x000055CD7A81E540, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E780, 0x000055CD7A81E7E0, 0x000055CD7A81EA50, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E7B0, 0x000055CD7A81E810, 0x000055CD7A81E5A0, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E7E0, 0x0000000000000000, 0x000055CD7A81EAB0, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81E870, 0x000055CD7A81EB40, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E840, 0x000055CD7A81E8A0, 0x000055CD7A81E5D0, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E870, 0x000055CD7A81E8D0, 0x000055CD7A81EBA0, 0x0000000000000101, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E8A0, 0x000055CD7A81E900, 0x000055CD7A81E630, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E8D0, 0x000055CD7A81E930, 0x000055CD7A81EC00, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E900, 0x000055CD7A81E960, 0x000055CD7A81E690, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E930, 0x000055CD7A81E990, 0x000055CD7A81EC60, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E960, 0x000055CD7A81E9C0, 0x000055CD7A81E6F0, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E990, 0x000055CD7A81E9F0, 0x000055CD7A81ECC0, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E9C0, 0x000055CD7A81EA20, 0x000055CD7A81E750, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81E9F0, 0x000055CD7A81EA50, 0x000055CD7A81ED20, 0x0000000000000101, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EA20, 0x000055CD7A81EA80, 0x000055CD7A81E7B0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EA50, 0x000055CD7A81EAB0, 0x000055CD7A81ED80, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EA80, 0x000055CD7A81EAE0, 0x000055CD7A81E810, 0x0000000000010001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EAB0, 0x0000000000000000, 0x000055CD7A81EDE0, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81EB40, 0x000055CD7A81EE70, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EB10, 0x000055CD7A81EB70, 0x000055CD7A81E840, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EB40, 0x000055CD7A81EBA0, 0x000055CD7A81EED0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EB70, 0x000055CD7A81EBD0, 0x000055CD7A81E8A0, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EBA0, 0x000055CD7A81EC00, 0x000055CD7A81EF30, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EBD0, 0x000055CD7A81EC30, 0x000055CD7A81E900, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EC00, 0x000055CD7A81EC60, 0x000055CD7A81EF90, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EC30, 0x000055CD7A81EC90, 0x000055CD7A81E960, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EC60, 0x000055CD7A81ECC0, 0x000055CD7A81EFF0, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EC90, 0x000055CD7A81ECF0, 0x000055CD7A81E9C0, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81ECC0, 0x000055CD7A81ED20, 0x000055CD7A81F050, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81ECF0, 0x000055CD7A81ED50, 0x000055CD7A81EA20, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81ED20, 0x000055CD7A81ED80, 0x000055CD7A81F0B0, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81ED50, 0x000055CD7A81EDB0, 0x000055CD7A81EA80, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81ED80, 0x000055CD7A81EDE0, 0x000055CD7A81F110, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EDB0, 0x000055CD7A81EE10, 0x000055CD7A81EAE0, 0x0000000000000100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EDE0, 0x0000000000000000, 0x000055CD7A81F170, 0x0000000000000101, 0x0000000000000000, 0x0000000000000031, 0x0000000000000000, 0x000055CD7A81EE70, 0x0000000000000000, 0x0000000000010001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EE40, 0x000055CD7A81EEA0, 0x000055CD7A81EB10, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EE70, 0x000055CD7A81EED0, 0x0000000000000000, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EEA0, 0x000055CD7A81EF00, 0x000055CD7A81EB70, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EED0, 0x000055CD7A81EF30, 0x0000000000000000, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EF00, 0x000055CD7A81EF60, 0x000055CD7A81EBD0, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EF30, 0x000055CD7A81EF90, 0x0000000000000000, 0x0000000000010100, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EF60, 0x000055CD7A81EFC0, 0x000055CD7A81EC30, 0x0000000000000001, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EF90, 0x000055CD7A81EFF0, 0x0000000000000000, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EFC0, 0x000055CD7A81F020, 0x000055CD7A81EC90, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81EFF0, 0x000055CD7A81F050, 0x0000000000000000, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81F020, 0x000055CD7A81F080, 0x000055CD7A81ECF0, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81F050, 0x000055CD7A81F0B0, 0x0000000000000000, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81F080, 0x000055CD7A81F0E0, 0x000055CD7A81ED50, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81F0B0, 0x000055CD7A81F110, 0x0000000000000000, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81F0E0, 0x000055CD7A81F140, 0x000055CD7A81EDB0, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81F110, 0x000055CD7A81F170, 0x0000000000000000, 0x0000000000010000, 0x0000000000000000, 0x0000000000000031
,0x000055CD7A81F140, 0x000055CD7A81F1A0, 0x000055CD7A81EE10, 0x0000000000000000, 0x0000000000000000, 0x0000000000000031, 0x000055CD7A81F170, 0x0000000000000000, 0x0000000000000000, 0x0000000000010100, 0x0000000000000000, 0x000000000000DE41
]
nNowAddress=0x55CD7A81E5D0
nEndAddress=0x55CD7A81E810
nStartAddress=0x55CD7A81DEB0
def print_hex(num):sz=hex(num)[2:]if len(sz)!=16:print('0x'+'0'*(16-len(sz))+sz,end=', ')
def print_BYTE(num):sz=hex(num)[2:]if len(sz)!=16:sz='0'*(16-len(sz))+szncount=0for i in range(len(sz)-1,-1,-2):print(24+ncount,'0x'+sz[i-1]+sz[i],end=', ')ncount+=1
def GetToArray(num):sz=hex(num)[2:]if len(sz)!=16:sz='0'*(16-len(sz))+szNum_List=[]for i in range(len(sz)-1,-1,-2):Num_List.append(eval('0x'+sz[i-1]+sz[i]))return Num_Listclass Address:m_Index=0m_PreAdess=0m_NextAddress=0m_NextAddess2=0m_array=[0]*8m_unused1=0m_unused2=0def show(self):print_hex(self.m_Index)print(" ",end='')print_hex(self.m_PreAdess)print_hex(self.m_NextAddress)print_hex(self.m_NextAddess2)print(" ",end=' ')print(self.m_array,end=' ')print_hex(self.m_unused1)print_hex(self.m_unused2)print()Address_Array=[ Address() for i in range(len(Num_map)//6)]
nCount=len(Num_map)//6
Size=0
for i in range(0,len(Num_map),6):Address_Array[Size].m_Index=nStartAddress+i*8Address_Array[Size].m_PreAdess=Num_map[i]Address_Array[Size].m_NextAddress=Num_map[i+1]Address_Array[Size].m_NextAddess2=Num_map[i+2]Address_Array[Size].m_array=GetToArray(Num_map[i+3])Address_Array[Size].m_unused1=Num_map[i+4]Address_Array[Size].m_unused2=Num_map[i+5]#Address_Array[Size].show()Size+=1
def FoundFlag(flag,Def_nNowaddress):if Def_nNowaddress==nEndAddress:print(flag)returnelse :#for i in range(nCount):if Address_Array[i].m_Index==Def_nNowaddress and Address_Array[i].m_array[3]==0:Address_Array[i].m_array[3]=1if Address_Array[i].m_array[0]!=1:FoundFlag(flag+'a',Address_Array[i].m_PreAdess)if Address_Array[i].m_array[1]!=1:FoundFlag(flag+'d',Address_Array[i].m_NextAddress)if Address_Array[i].m_array[2]!=1:FoundFlag(flag+'t',Address_Array[i].m_NextAddess2)return #print(nCount/6)
flag=''
FoundFlag(flag,nNowAddress)
#dtdtdtdtddtatdddtatdtaaatatddddddddtatatdd
