TFCCTF 2025 wp

博主： Xherlock
发布时间：2025 年 08 月 31 日
5 次浏览
暂无评论
67561字数
分类： CTF

# TFCCTF 2025 wp

6th差一名线下，题目还不错

## OXIDIZED INTENTIONS

借着这道题学习了很多apk解包、打包、签名的知识

arm的so所以必须要真机

首先分析java层可知做了个广播接收seed值（intent.getStringExtra("seed")）

~~~java
package com.example.oxidized_intentions;

import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.util.Log;
import android.widget.Toast;
import kotlin.Metadata;
import kotlin.jvm.internal.Intrinsics;

/* compiled from: TicketReceiver.kt */
@Metadata(d1 = {"\u0000 \n\u0002\u0018\u0002\n\u0002\u0018\u0002\n\u0002\b\u0003\n\u0002\u0010\u0002\n\u0000\n\u0002\u0018\u0002\n\u0000\n\u0002\u0018\u0002\n\u0002\b\u0002\b\u0007\u0018\u0000 \n2\u00020\u0001:\u0001\nB\u0007¢\u0006\u0004\b\u0002\u0010\u0003J\u0018\u0010\u0004\u001a\u00020\u00052\u0006\u0010\u0006\u001a\u00020\u00072\u0006\u0010\b\u001a\u00020\tH\u0016¨\u0006\u000b"}, d2 = {"Lcom/example/oxidized_intentions/TicketReceiver;", "Landroid/content/BroadcastReceiver;", "<init>", "()V", "onReceive", "", "context", "Landroid/content/Context;", "intent", "Landroid/content/Intent;", "Companion", "app_release"}, k = 1, mv = {2, 0, 0}, xi = 48)
/* loaded from: classes2.dex */
public final class TicketReceiver extends BroadcastReceiver {
    public static final int $stable = 0;
    public static final String ACTION_FLAGGED = "com.example.oxidized_intentions.FLAGGED";
    public static final String EXTRA_FLAG = "flag";
    private static final String PART_J = "oxidized-";

@Override // android.content.BroadcastReceiver
    public void onReceive(Context context, Intent intent) {
        Intrinsics.checkNotNullParameter(context, "context");
        Intrinsics.checkNotNullParameter(intent, "intent");
        String stringExtra = intent.getStringExtra("seed");
        if (stringExtra == null) {
            return;
        }
        Log.d("OXI", "Got broadcast, seed=" + stringExtra);
        String str = stringExtra;
        int i = 0;
        for (int i2 = 0; i2 < str.length(); i2++) {
            i ^= str.charAt(i2);
        }
        String flag = Native.getFlag(context, stringExtra, PART_J, i & 255);
        Toast.makeText(context, flag, 1).show();
        Log.d("OXI", "FLAG=" + flag);
        Intent intent2 = new Intent(ACTION_FLAGGED);
        intent2.setPackage(context.getPackageName());
        intent2.putExtra(EXTRA_FLAG, flag);
        context.sendBroadcast(intent2);
    }
}

package com.example.oxidized_intentions;

import android.content.Context;
import kotlin.Metadata;
import kotlin.jvm.JvmStatic;

/* compiled from: Native.kt */
@Metadata(d1 = {"\u0000&\n\u0002\u0018\u0002\n\u0002\u0010\u0000\n\u0002\b\u0003\n\u0002\u0010\u0002\n\u0000\n\u0002\u0010\u000e\n\u0000\n\u0002\u0018\u0002\n\u0002\b\u0003\n\u0002\u0010\b\n\u0000\bÇ\u0002\u0018\u00002\u00020\u0001B\t\b\u0002¢\u0006\u0004\b\u0002\u0010\u0003J\b\u0010\u0004\u001a\u00020\u0005H\u0007J)\u0010\u0006\u001a\u00020\u00072\u0006\u0010\b\u001a\u00020\t2\u0006\u0010\n\u001a\u00020\u00072\u0006\u0010\u000b\u001a\u00020\u00072\u0006\u0010\f\u001a\u00020\rH\u0087 ¨\u0006\u000e"}, d2 = {"Lcom/example/oxidized_intentions/Native;", "", "<init>", "()V", "initAtLaunch", "", "getFlag", "", "ctx", "Landroid/content/Context;", "seed", "part", "check", "", "app_release"}, k = 1, mv = {2, 0, 0}, xi = 48)
/* loaded from: classes2.dex */
public final class Native {
    public static final int $stable = 0;
    public static final Native INSTANCE = new Native();

@JvmStatic
    public static final native String getFlag(Context ctx, String seed, String part, int check);

@JvmStatic
    public static final void initAtLaunch() {
    }

private Native() {
    }

static {
        System.loadLibrary("oxi");
    }
}
~~~

分析native层getFlag函数可知，里面实现了很复杂的seed生成随机数操作，比较字符串fe2o3rust

~~~c
if ( v76 != 9 || (v13 = s1, v14 = memcmp(s1, aFe2o3rust, 9uLL), (_DWORD)v14) )
  {
    *(_QWORD *)&v89 = &v74;
    *((_QWORD *)&v89 + 1) = sub_115DC;
    sub_475C4();
    *(_QWORD *)&v90 = v15;
    *((_QWORD *)&v90 + 1) = v16;
    v99 = &off_4FBE0;
    v100 = 3LL;
    v101 = &v89;
    v102 = 2uLL;
    v17 = sub_473F8(v81);
~~~

后面还有一个逐位异或验证哈希值，由此可知seed值应该为fe2o3rust

尝试adb安装apk到真机，然后广播seed值

~~~
adb shell am broadcast -n com.example.oxidized_intentions/.TicketReceiver --es seed "fe2o3rust"
~~~

查看log（adb logcat -s OXI）

~~~
08-29 22:37:18.146 10323 10323 D OXI     : Computing flag for seed='fe2o3rust' ...
08-29 22:37:19.149 10323 10323 D OXI     : anti_hook_check elapsed=1003ms
08-29 22:38:24.097 10323 10323 D OXI     : HACKER bit not set -> returning FAKE
08-29 22:38:24.114 10323 10323 D OXI     : FLAG=FAKE{2152411021524119}
~~~

发现`HACKER bit not set -> returning FAKE`，由此可知需要patch掉下面的if，不让他进去

~~~c
if ( HACKER != 1 )
  {
    v58 = sub_1187C(&unk_480F, 36LL);	// "HACKER bit not set -> returning FAKE"
    v94 = (__int64 *)&v87;
    v95 = sub_15B00;
    *(_QWORD *)&v87 = v76 ^ 0x2152411021524110LL;
    v101 = 0LL;
    v102 = 0x10uLL;
    v99 = (char **)(&dword_0 + 2);
    *(_QWORD *)&v103 = 0x800000020LL;
    sub_47354(v58);
    sub_113E4(v83, &v89);
    v45 = sub_474D4(&v89);
    if ( (unsigned __int8)v89 != 15 )
    {
      v68 = sub_472C8(v45);
      v69 = sub_472E4(v68);
      sub_472F8(v69);
    }
    goto LABEL_38;
  }
~~~

直接nop掉跳转即可

![image-20250829235120600.png](http://xherlock.top/usr/uploads/2025/08/926559383.png)

然后apply patches

接下来需要做的是把新的so重新打包回去，这里需要借助apktool

~~~
apktool d app-release.apk -o app-src
~~~

然后替换新的so，此外还需要修改AndroidManifest.xml里extractNativeLibs的值为true

直接替换apk里的so会报错adb: failed to install app.apk: Failure [INSTALL_FAILED_INVALID_APK: Failed to extract native libraries, res=-2]，因为可能进行了deflate压缩，就算选择了store依然报错

接着apktool打包

~~~
apktool b app-src -o app-unsigned.apk
~~~

此时得到apk没有签名没法安装的，会报错adb: failed to install app-unsigned.apk: Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES: Failed to collect certificates from /data/app/vmdl1700332527.tmp/base.apk: Attempt to get length of null array]

此时需要先生成key

~~~
keytool -genkey -v -keystore test.jks -keyalg RSA -keysize 2048 -validity 10000 -alias testkey
~~~

然后找到android sdk下的apksigner.bat

~~~
F:\android\build-tools\35.0.1\apksigner.bat sign --ks test.jks --ks-key-alias testkey --out app-signed.apk app-unsigned.apk
~~~

然后就可以安装

~~~
adb install -r app-signed.apk
~~~

再次执行上面的广播命令，结束后，点看apk去log里即可看到flag

~~~
08-30 00:00:03.162 12473 12473 D OXI     : Got broadcast, seed=fe2o3rust
08-30 00:00:03.166 12473 12473 D OXI     : Required seed is: fe2o3rust
08-30 00:00:03.166 12473 12473 D OXI     : Computing flag for seed='fe2o3rust' ...
08-30 00:00:04.187 12473 12473 D OXI     : anti_hook_check elapsed=1020ms
08-30 00:01:09.162 12473 12473 D OXI     : FLAG=TFCCTF{167e3ce3c65387c6e981c31c39ac7839}
~~~

## SCRATCHING MACHINE

很复杂的积木语言题scratch，碰到这种直接用工具https://github.com/BirdLogics/sb3topy即可

转成python直接喂给ai写脚本

~~~python
import math
import time

import engine
from engine.events import *
from engine.operators import *
from engine.types import *

@sprite('Stage')
class Stage(Target):
    """Sprite Stage"""

def __init__(self, parent=None):
        super().__init__(parent)
        if parent is not None:
            return

self._xpos = 0
        self._ypos = 0
        self._direction = 90
        self.shown = True
        self.pen = Pen(self)

self.costume = Costumes(
           0, 100, "None", [
            {
                'name': "blank",
                'path': "6194f3e71fd786b38dbc05fdbb75e882-svg-2x.png",
                'center': (2, 2),
                'scale': 2
            }
        ])

self.sounds = Sounds(
            100, [

])

self.sprite.layer = 0

@sprite('main')
class Spritemain(Target):
    """Sprite main"""

def __init__(self, parent=None):
        super().__init__(parent)
        if parent is not None:
            return

self._xpos = 0
        self._ypos = 0
        self._direction = 90
        self.shown = True
        self.pen = Pen(self)

self.costume = Costumes(
           0, 100, "all around", [
            {
                'name': "blank",
                'path': "6194f3e71fd786b38dbc05fdbb75e882-svg-2x.png",
                'center': (2, 2),
                'scale': 2
            }
        ])

self.sounds = Sounds(
            100, [

])

self.var_omegalolusB4 = 0
        self.var_omegalolusB3 = 59
        self.var_omegalolusC2 = 4
        self.var_omegalolusT5 = 0
        self.var_omegalolusR1 = 15
        self.var_notsussusx5 = 1
        self.var_notsussusx8 = 2
        self.var_notsussusj1 = 13
        self.var_notsussusx1 = 3
        self.var_notsussusj2 = 0
        self.var_notsussusx4 = 7
        self.var_notsussusx7 = 10
        self.var_notsussusx6 = 1
        self.var_notsussusx3 = 2
        self.var_notsussusx2 = 5
        self.var_notsussusx9 = 3
        self.var_sussusC3 = 4
        self.var_sussusJ4 = 47
        self.var_sussusG9 = 15
        self.var_sussusB2 = 255
        self.var_sussusH0 = 255
        self.var_sussusJ5 = 0
        self.var_sussusF8 = 240
        self.var_sussusA1 = 8
        self.var_sussusE7 = 4080
        self.var_sussusD6 = 255
        self.var_pocusyz = 256
        self.var_pocuscr = 0
        self.var_pocuswb = 0
        self.var_pocustmp = 0
        self.var_pocuswa = 1
        self.var_pocuslll = 42
        self.var_pocusxq = 255
        self.var_pocusllll = 0
        self.var_pocuscs = 0
        self.var_abracadabraJ5 = 37
        self.var_abracadabraY4 = 4080
        self.var_abracadabraQ3 = 1
        self.var_abracadabraJ6 = 0
        self.var_abracadabraX1 = 255
        self.var_abracadabraZ2 = 4
        self.var_abobusC3 = 8
        self.var_abobusJ4 = 31
        self.var_abobusJ5 = 0
        self.var_abobusB2 = 8
        self.var_abobusA1 = 255
        self.var_abobusT6 = 0
        self.var_hocusr3 = 1
        self.var_hocusp1 = 240
        self.var_hocusjx = 0
        self.var_hocusu6 = 0
        self.var_hocuss4 = 1
        self.var_hocusjz = 0
        self.var_hocustm = 0
        self.var_hocust5 = 15
        self.var_hocusq2 = 256
        self.var_cacausj1 = 83
        self.var_cacausqX = 256
        self.var_cacausrY = 1
        self.var_cacausj2 = 0
        self.var_cacaustmp = 0
        self.var_cacaustV = 0
        self.var_cacausuU = 0
        self.var_cacauspZ = 113
        self.var_cacaussW = 1
        self.var_theonek2 = 0
        self.var_theonek1 = 77
        self.var_theonev1 = 0
        self.var_theonetmp = 0
        self.var_theonev2 = 3
        self.var_18 = 113
        self.var_sussusreturn = 255
        self.var_13 = 0
        self.var_6 = 3
        self.var_hocusreturn = 240
        self.var_abracadabrareturn = 4080
        self.var_20 = 0
        self.var_26 = 0
        self.var_1 = 7
        self.var_23 = 255
        self.var_5 = 2
        self.var_3 = 1
        self.var_9 = 240
        self.var_25 = 0
        self.var_7 = 255
        self.var_21 = 0
        self.var_theonereturn = 3
        self.var_12 = 3
        self.var_abobusreturn = 255
        self.var_test1 = 5
        self.var_22 = 0
        self.var_4 = 10
        self.var_2 = 1
        self.var_8 = 4080
        self.var_24 = 0
        self.var_17 = 0
        self.var_11 = 255
        self.var_pocusreturn = 255
        self.var_15 = 0
        self.var_test2 = 2
        self.var_19 = 0
        self.var_27 = 3
        self.var_omegalolusreturn = 15
        self.var_notsussusreturn = 3
        self.var_watdat = 217
        self.var_16 = 0
        self.var_i = 141
        self.var_10 = 15
        self.var_14 = 0
        self.var_cacausreturn = 113

self.list_verysussy = List(
            [69, 1, 72, 113, 44, 70, 142, 0]
        )
        self.list_cacamaca = List(
            [17, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 44, 30, 4, 30, 188, 142, 85, 54, 77, 46, 212, 151, 22, 149, 190, 68, 143, 14, 165, 95, 28, 189, 158, 100, 87, 252, 143, 117, 206, 133, 38, 101, 159, 4, 31, 140, 135, 36, 63, 124, 55, 68, 127, 133, 30, 101, 6, 181, 158, 100, 15, 196, 62, 69, 230, 165, 142, 29, 231, 252, 191, 180, 215, 76, 182, 197, 190, 5, 238, 40, 0, 1, 69, 0, 2, 1, 37, 3, 2, 1, 3, 2, 35, 4, 3, 28, 4, 3, 37, 5, 4, 28, 5, 4, 37, 6, 3, 3, 6, 1, 35, 7, 6, 12, 4, 7, 39, 3, 4, 1, 2, 1, 25, 2, 69, 148, 0, 2, 1, 37, 3, 2, 1, 3, 2, 35, 4, 3, 1, 3, 69, 35, 5, 3, 41, 4, 5, 141, 1, 2, 1, 25, 2, 69, 191, 38]
        )

self.sprite.layer = 1

@warp
    async def my_omegalolusan(self, util, arg_a, arg_n):
        self.var_omegalolusR1 = arg_a
        self.var_omegalolusC2 = 0
        self.var_omegalolusB3 = 59
        self.var_omegalolusB4 = (self.var_omegalolusB3 - self.var_omegalolusB3)
        self.var_omegalolusT5 = self.var_omegalolusB4
        while not not lt(self.var_omegalolusC2, arg_n):
            if gt(self.var_omegalolusB4, 0):
                self.var_omegalolusT5 = ((self.var_omegalolusT5 + self.var_omegalolusB4) - self.var_omegalolusB4)
            self.var_omegalolusR1 = (math.floor(div(self.var_omegalolusR1, (2 + self.var_omegalolusB4))) + self.var_omegalolusB4)
            self.var_omegalolusC2 = ((self.var_omegalolusC2 + 1) + self.var_omegalolusB4)
            self.var_omegalolusB4 = (self.var_omegalolusB4 * self.var_omegalolusT5)
        self.var_omegalolusreturn = (tonum(self.var_omegalolusR1) + self.var_omegalolusB4)

@warp
    async def my_notsussusanw(self, util, arg_a, arg_n, arg_w):
        self.var_notsussusx1 = arg_w
        self.var_notsussusx2 = arg_a
        self.var_notsussusx3 = arg_n
        self.var_notsussusj1 = 13
        self.var_notsussusj2 = (self.var_notsussusj1 - self.var_notsussusj1)
        self.var_notsussusx3 = ((tonum(self.var_notsussusx3) + self.var_notsussusj2) % (tonum(self.var_notsussusx1) + self.var_notsussusj2))
        await self.my_abobusw(util, (tonum(self.var_notsussusx1) + self.var_notsussusj2))
        self.var_1 = self.var_abobusreturn
        self.var_notsussusx4 = self.var_1
        await self.my_omegalolusan(util, (tonum(self.var_notsussusx2) + self.var_notsussusj2), (tonum(self.var_notsussusx3) + self.var_notsussusj2))
        self.var_2 = self.var_omegalolusreturn
        self.var_notsussusx5 = self.var_2
        if gt(self.var_notsussusj2, 0):
            self.var_notsussusx1 = ((tonum(self.var_notsussusx1) + self.var_notsussusj2) - self.var_notsussusj2)
        await self.my_hocusab(util, (self.var_notsussusx5 + self.var_notsussusj2), (self.var_notsussusx4 - self.var_notsussusj2))
        self.var_3 = self.var_hocusreturn
        self.var_notsussusx6 = self.var_3
        await self.my_abracadabraan(util, (tonum(self.var_notsussusx2) + self.var_notsussusj2), ((tonum(self.var_notsussusx1) - self.var_notsussusj2) - (tonum(self.var_notsussusx3) + self.var_notsussusj2)))
        self.var_4 = self.var_abracadabrareturn
        self.var_notsussusx7 = self.var_4
        await self.my_hocusab(util, (self.var_notsussusx7 + self.var_notsussusj2), (self.var_notsussusx4 + self.var_notsussusj2))
        self.var_5 = self.var_hocusreturn
        self.var_notsussusx8 = self.var_5
        await self.my_pocusab(util, (self.var_notsussusx6 + self.var_notsussusj2), (self.var_notsussusx8 - self.var_notsussusj2))
        self.var_6 = self.var_pocusreturn
        self.var_notsussusx9 = self.var_6
        self.var_notsussusj2 = (self.var_notsussusj2 * self.var_notsussusx9)
        self.var_notsussusreturn = (self.var_notsussusx9 + self.var_notsussusj2)

@warp
    async def my_sussusanw(self, util, arg_a, arg_n, arg_w):
        self.var_sussusA1 = arg_w
        self.var_sussusB2 = arg_a
        self.var_sussusC3 = arg_n
        self.var_sussusJ4 = 47
        self.var_sussusJ5 = (self.var_sussusJ4 - self.var_sussusJ4)
        self.var_sussusC3 = ((tonum(self.var_sussusC3) + self.var_sussusJ5) % (tonum(self.var_sussusA1) + self.var_sussusJ5))
        await self.my_abobusw(util, (tonum(self.var_sussusA1) + self.var_sussusJ5))
        self.var_7 = self.var_abobusreturn
        self.var_sussusD6 = self.var_7
        await self.my_abracadabraan(util, (tonum(self.var_sussusB2) + self.var_sussusJ5), (tonum(self.var_sussusC3) + self.var_sussusJ5))
        self.var_8 = self.var_abracadabrareturn
        self.var_sussusE7 = self.var_8
        await self.my_hocusab(util, (self.var_sussusE7 + self.var_sussusJ5), (self.var_sussusD6 - self.var_sussusJ5))
        self.var_9 = self.var_hocusreturn
        self.var_sussusF8 = self.var_9
        await self.my_omegalolusan(util, (tonum(self.var_sussusB2) + self.var_sussusJ5), ((tonum(self.var_sussusA1) - self.var_sussusJ5) - (tonum(self.var_sussusC3) + self.var_sussusJ5)))
        self.var_10 = self.var_omegalolusreturn
        self.var_sussusG9 = self.var_10
        await self.my_pocusab(util, (self.var_sussusF8 + self.var_sussusJ5), (self.var_sussusG9 + self.var_sussusJ5))
        self.var_11 = self.var_pocusreturn
        self.var_sussusH0 = self.var_11
        if gt(self.var_sussusJ5, 0):
            self.var_sussusJ5 = ((self.var_sussusJ5 + self.var_sussusJ5) - self.var_sussusJ5)
        self.var_sussusreturn = (self.var_sussusH0 + self.var_sussusJ5)

@warp
    async def my_pocusab(self, util, arg_a, arg_b):
        self.var_pocusxq = 0
        self.var_pocusyz = 1
        self.var_pocuswa = 0
        self.var_pocuswb = 0
        self.var_pocuscr = arg_a
        self.var_pocuscs = arg_b
        self.var_pocuslll = 42
        self.var_pocusllll = (self.var_pocuslll - self.var_pocuslll)
        self.var_pocustmp = self.var_pocusllll
        while not (not gt(self.var_pocuscr, 0) and not gt(self.var_pocuscs, 0)):
            self.var_pocuswa = ((tonum(self.var_pocuscr) % 2) + self.var_pocusllll)
            self.var_pocuswb = (tonum(self.var_pocuscs) % 2)
            if (eq(self.var_pocuswa, 1) or eq(self.var_pocuswb, 1)):
                self.var_pocusxq = ((self.var_pocusxq + self.var_pocusyz) + self.var_pocusllll)
            if gt(self.var_pocusllll, 0):
                self.var_pocustmp = ((self.var_pocustmp + self.var_pocusllll) - self.var_pocusllll)
            self.var_pocuscr = (math.floor(div(self.var_pocuscr, 2)) + self.var_pocusllll)
            self.var_pocuscs = math.floor(div(self.var_pocuscs, 2))
            self.var_pocusyz = ((self.var_pocusyz * 2) - self.var_pocusllll)
            self.var_pocusllll = (self.var_pocusllll * self.var_pocustmp)
        self.var_pocusreturn = (self.var_pocusxq + self.var_pocusllll)

@warp
    async def my_abracadabraan(self, util, arg_a, arg_n):
        self.var_abracadabraX1 = arg_a
        self.var_abracadabraZ2 = 0
        self.var_abracadabraQ3 = 1
        self.var_abracadabraY4 = self.var_abracadabraX1
        self.var_abracadabraJ5 = 37
        self.var_abracadabraJ6 = (self.var_abracadabraJ5 - self.var_abracadabraJ5)
        while not not lt(self.var_abracadabraZ2, arg_n):
            self.var_abracadabraY4 = (tonum(self.var_abracadabraY4) * (2 + self.var_abracadabraJ6))
            self.var_abracadabraZ2 = ((self.var_abracadabraZ2 + self.var_abracadabraQ3) - self.var_abracadabraJ6)
            self.var_abracadabraJ6 = (self.var_abracadabraJ6 * self.var_abracadabraJ6)
        self.var_abracadabrareturn = (tonum(self.var_abracadabraY4) + self.var_abracadabraJ6)

@warp
    async def my_abobusw(self, util, arg_w):
        self.var_abobusA1 = 1
        self.var_abobusB2 = 0
        self.var_abobusC3 = arg_w
        self.var_abobusJ4 = 31
        self.var_abobusJ5 = (self.var_abobusJ4 - self.var_abobusJ4)
        self.var_abobusT6 = self.var_abobusJ5
        while not not lt(self.var_abobusB2, self.var_abobusC3):
            self.var_abobusA1 = (self.var_abobusA1 * (2 + self.var_abobusJ5))
            if gt(self.var_abobusJ5, 0):
                self.var_abobusT6 = ((self.var_abobusT6 + self.var_abobusJ5) - self.var_abobusJ5)
            self.var_abobusB2 = ((self.var_abobusB2 + 1) + self.var_abobusJ5)
            self.var_abobusJ5 = (self.var_abobusJ5 * self.var_abobusT6)
        self.var_abobusA1 = ((self.var_abobusA1 - 1) - self.var_abobusJ5)
        self.var_abobusreturn = (self.var_abobusA1 + self.var_abobusJ5)

@warp
    async def my_hocusab(self, util, arg_a, arg_b):
        self.var_hocusp1 = 0
        self.var_hocusq2 = 1
        self.var_hocusr3 = 0
        self.var_hocuss4 = 0
        self.var_hocust5 = arg_a
        self.var_hocusu6 = arg_b
        self.var_hocusjx = 23
        self.var_hocusjz = (self.var_hocusjx - self.var_hocusjx)
        self.var_hocustm = self.var_hocusjz
        while not (not gt(self.var_hocust5, 0) or not gt(self.var_hocusu6, 0)):
            self.var_hocusr3 = ((tonum(self.var_hocust5) % 2) + self.var_hocusjz)
            self.var_hocuss4 = (tonum(self.var_hocusu6) % 2)
            if (eq(self.var_hocusr3, 1) and eq(self.var_hocuss4, 1)):
                self.var_hocusp1 = ((self.var_hocusp1 + self.var_hocusq2) + self.var_hocusjz)
            if gt(self.var_hocusjz, 0):
                self.var_hocustm = ((self.var_hocustm + self.var_hocusjz) - self.var_hocusjz)
            self.var_hocust5 = (math.floor(div(self.var_hocust5, 2)) + self.var_hocusjz)
            self.var_hocusu6 = math.floor(div(self.var_hocusu6, 2))
            self.var_hocusq2 = ((self.var_hocusq2 * 2) - self.var_hocusjz)
            self.var_hocusjx = (self.var_hocusjx * self.var_hocusjz)
        self.var_hocusreturn = (self.var_hocusp1 + self.var_hocusjz)

@warp
    async def my_cacausab(self, util, arg_a, arg_b):
        self.var_cacauspZ = 0
        self.var_cacausqX = 1
        self.var_cacausrY = 0
        self.var_cacaussW = 0
        self.var_cacaustV = arg_a
        self.var_cacausuU = arg_b
        self.var_cacausj1 = 83
        self.var_cacausj2 = (self.var_cacausj1 - self.var_cacausj1)
        self.var_cacaustmp = self.var_cacausj2
        while not (not gt(self.var_cacaustV, 0) and not gt(self.var_cacausuU, 0)):
            self.var_cacausrY = ((tonum(self.var_cacaustV) % 2) + self.var_cacausj2)
            self.var_cacaussW = (tonum(self.var_cacausuU) % 2)
            if ((eq(self.var_cacausrY, 1) and eq(self.var_cacaussW, 0)) or (eq(self.var_cacausrY, 0) and eq(self.var_cacaussW, 1))):
                self.var_cacauspZ = ((self.var_cacauspZ + self.var_cacausqX) + self.var_cacausj2)
            if gt(self.var_cacausj2, 0):
                self.var_cacaustmp = ((self.var_cacaustmp + self.var_cacausj2) - self.var_cacausj2)
            self.var_cacaustV = (math.floor(div(self.var_cacaustV, 2)) + self.var_cacausj2)
            self.var_cacausuU = math.floor(div(self.var_cacausuU, 2))
            self.var_cacausqX = ((self.var_cacausqX * 2) - self.var_cacausj2)
            self.var_cacausj2 = (self.var_cacausj2 * self.var_cacaustmp)
        self.var_cacausreturn = (self.var_cacauspZ + self.var_cacausj2)

@warp
    async def my_theonea(self, util, arg_a):
        self.var_theonev1 = arg_a
        self.var_theonev2 = 0
        self.var_theonek1 = 77
        self.var_theonek2 = (self.var_theonek1 - self.var_theonek1)
        self.var_theonetmp = self.var_theonek2
        while not not gt(self.var_theonev1, 0):
            if gt(self.var_theonek2, 0):
                self.var_theonetmp = ((self.var_theonetmp + self.var_theonek2) - self.var_theonek2)
            self.var_theonev2 = ((self.var_theonev2 + 1) + self.var_theonek2)
            self.var_theonev1 = (math.floor(div(self.var_theonev1, 2)) + self.var_theonek2)
            self.var_theonek2 = (self.var_theonek2 * self.var_theonetmp)
        self.var_theonereturn = (self.var_theonev2 + self.var_theonek2)

@on_green_flag
    async def green_flag(self, util):
        for _ in range(8):
            self.list_verysussy.append(0)

await self.yield_()
        self.list_cacamaca.append(17)
        self.list_cacamaca.append(142)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(255)
        self.list_cacamaca.append(44)
        self.list_cacamaca.append(30)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(30)
        self.list_cacamaca.append(188)
        self.list_cacamaca.append(142)
        self.list_cacamaca.append(85)
        self.list_cacamaca.append(54)
        self.list_cacamaca.append(77)
        self.list_cacamaca.append(46)
        self.list_cacamaca.append(212)
        self.list_cacamaca.append(151)
        self.list_cacamaca.append(22)
        self.list_cacamaca.append(149)
        self.list_cacamaca.append(190)
        self.list_cacamaca.append(68)
        self.list_cacamaca.append(143)
        self.list_cacamaca.append(14)
        self.list_cacamaca.append(165)
        self.list_cacamaca.append(95)
        self.list_cacamaca.append(28)
        self.list_cacamaca.append(189)
        self.list_cacamaca.append(158)
        self.list_cacamaca.append(100)
        self.list_cacamaca.append(87)
        self.list_cacamaca.append(252)
        self.list_cacamaca.append(143)
        self.list_cacamaca.append(117)
        self.list_cacamaca.append(206)
        self.list_cacamaca.append(133)
        self.list_cacamaca.append(38)
        self.list_cacamaca.append(101)
        self.list_cacamaca.append(159)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(31)
        self.list_cacamaca.append(140)
        self.list_cacamaca.append(135)
        self.list_cacamaca.append(36)
        self.list_cacamaca.append(63)
        self.list_cacamaca.append(124)
        self.list_cacamaca.append(55)
        self.list_cacamaca.append(68)
        self.list_cacamaca.append(127)
        self.list_cacamaca.append(133)
        self.list_cacamaca.append(30)
        self.list_cacamaca.append(101)
        self.list_cacamaca.append(6)
        self.list_cacamaca.append(181)
        self.list_cacamaca.append(158)
        self.list_cacamaca.append(100)
        self.list_cacamaca.append(15)
        self.list_cacamaca.append(196)
        self.list_cacamaca.append(62)
        self.list_cacamaca.append(69)
        self.list_cacamaca.append(230)
        self.list_cacamaca.append(165)
        self.list_cacamaca.append(142)
        self.list_cacamaca.append(29)
        self.list_cacamaca.append(231)
        self.list_cacamaca.append(252)
        self.list_cacamaca.append(191)
        self.list_cacamaca.append(180)
        self.list_cacamaca.append(215)
        self.list_cacamaca.append(76)
        self.list_cacamaca.append(182)
        self.list_cacamaca.append(197)
        self.list_cacamaca.append(190)
        self.list_cacamaca.append(5)
        self.list_cacamaca.append(238)
        self.list_cacamaca.append(40)
        self.list_cacamaca.append(0)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(69)
        self.list_cacamaca.append(0)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(37)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(35)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(28)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(37)
        self.list_cacamaca.append(5)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(28)
        self.list_cacamaca.append(5)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(37)
        self.list_cacamaca.append(6)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(6)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(35)
        self.list_cacamaca.append(7)
        self.list_cacamaca.append(6)
        self.list_cacamaca.append(12)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(7)
        self.list_cacamaca.append(39)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(25)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(69)
        self.list_cacamaca.append(148)
        self.list_cacamaca.append(0)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(37)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(35)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(69)
        self.list_cacamaca.append(35)
        self.list_cacamaca.append(5)
        self.list_cacamaca.append(3)
        self.list_cacamaca.append(41)
        self.list_cacamaca.append(4)
        self.list_cacamaca.append(5)
        self.list_cacamaca.append(141)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(1)
        self.list_cacamaca.append(25)
        self.list_cacamaca.append(2)
        self.list_cacamaca.append(69)
        self.list_cacamaca.append(191)
        self.list_cacamaca.append(38)
        self.var_watdat = len(self.list_cacamaca)
        self.var_i = 1
        self.var_test1 = 5
        self.var_test2 = 2
        await self.my_theonea(util, self.var_test1)
        self.var_27 = self.var_theonereturn
        await self.my_notsussusanw(util, self.var_test1, self.var_test2, self.var_27)
        self.var_12 = self.var_notsussusreturn
        pass # looks_say(str(self.var_12))
        while not gt(self.var_i, self.var_watdat):
            if eq(self.list_cacamaca[toint(self.var_i)], 0):
                self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.list_cacamaca[toint((self.var_i + 2))]
                self.var_i = (self.var_i + 2)
            else:
                if eq(self.list_cacamaca[toint(self.var_i)], 1):
                    self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = (tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])]) + tonum(self.list_cacamaca[toint((self.var_i + 2))]))
                    self.var_i = (self.var_i + 2)
                else:
                    if eq(self.list_cacamaca[toint(self.var_i)], 2):
                        self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = (tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])]) + tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]))
                        self.var_i = (self.var_i + 2)
                    else:
                        if eq(self.list_cacamaca[toint(self.var_i)], 3):
                            self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = (tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])]) - tonum(self.list_cacamaca[toint((self.var_i + 2))]))
                            self.var_i = (self.var_i + 2)
                        else:
                            if eq(self.list_cacamaca[toint(self.var_i)], 4):
                                self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = (tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])]) - tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]))
                                self.var_i = (self.var_i + 2)
                            else:
                                if eq(self.list_cacamaca[toint(self.var_i)], 5):
                                    self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = (tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])]) * tonum(self.list_cacamaca[toint((self.var_i + 2))]))
                                    self.var_i = (self.var_i + 2)
                                else:
                                    if eq(self.list_cacamaca[toint(self.var_i)], 6):
                                        self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = (tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])]) * tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]))
                                        self.var_i = (self.var_i + 2)
                                    else:
                                        if eq(self.list_cacamaca[toint(self.var_i)], 7):
                                            await self.my_hocusab(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))])
                                            self.var_13 = self.var_hocusreturn
                                            self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_13
                                            self.var_i = (self.var_i + 2)
                                        else:
                                            if eq(self.list_cacamaca[toint(self.var_i)], 8):
                                                await self.my_hocusab(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])])
                                                self.var_14 = self.var_hocusreturn
                                                self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_14
                                                self.var_i = (self.var_i + 2)
                                            else:
                                                if eq(self.list_cacamaca[toint(self.var_i)], 9):
                                                    await self.my_pocusab(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))])
                                                    self.var_15 = self.var_pocusreturn
                                                    self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_15
                                                    self.var_i = (self.var_i + 2)
                                                else:
                                                    if eq(self.list_cacamaca[toint(self.var_i)], 10):
                                                        await self.my_pocusab(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])])
                                                        self.var_16 = self.var_pocusreturn
                                                        self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_16
                                                        self.var_i = (self.var_i + 2)
                                                    else:
                                                        if eq(self.list_cacamaca[toint(self.var_i)], 11):
                                                            await self.my_cacausab(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))])
                                                            self.var_17 = self.var_cacausreturn
                                                            self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_17
                                                            self.var_i = (self.var_i + 2)
                                                        else:
                                                            if eq(self.list_cacamaca[toint(self.var_i)], 12):
                                                                await self.my_cacausab(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])])
                                                                self.var_18 = self.var_cacausreturn
                                                                self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_18
                                                                self.var_i = (self.var_i + 2)
                                                            else:
                                                                if eq(self.list_cacamaca[toint(self.var_i)], 13):
                                                                    await self.my_abracadabraan(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))])
                                                                    self.var_19 = self.var_abracadabrareturn
                                                                    self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_19
                                                                    self.var_i = (self.var_i + 2)
                                                                else:
                                                                    if eq(self.list_cacamaca[toint(self.var_i)], 14):
                                                                        await self.my_abracadabraan(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])])
                                                                        self.var_20 = self.var_abracadabrareturn
                                                                        self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_20
                                                                        self.var_i = (self.var_i + 2)
                                                                    else:
                                                                        if eq(self.list_cacamaca[toint(self.var_i)], 15):
                                                                            await self.my_omegalolusan(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))])
                                                                            self.var_21 = self.var_omegalolusreturn
                                                                            self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_21
                                                                            self.var_i = (self.var_i + 2)
                                                                        else:
                                                                            if eq(self.list_cacamaca[toint(self.var_i)], 16):
                                                                                await self.my_omegalolusan(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])])
                                                                                self.var_22 = self.var_omegalolusreturn
                                                                                self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_22
                                                                                self.var_i = (self.var_i + 2)
                                                                            else:
                                                                                if eq(self.list_cacamaca[toint(self.var_i)], 17):
                                                                                    self.var_i = (tonum(self.list_cacamaca[toint((self.var_i + 1))]) - 1)
                                                                                else:
                                                                                    if eq(self.list_cacamaca[toint(self.var_i)], 18):
                                                                                        if gt(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                            self.list_verysussy[8] = 1
                                                                                        if eq(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                            self.list_verysussy[8] = 0
                                                                                        if lt(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                            self.list_verysussy[8] = -1
                                                                                        self.var_i = (self.var_i + 2)
                                                                                    else:
                                                                                        if eq(self.list_cacamaca[toint(self.var_i)], 19):
                                                                                            if gt(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]):
                                                                                                self.list_verysussy[8] = 1
                                                                                            if eq(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]):
                                                                                                self.list_verysussy[8] = 0
                                                                                            if lt(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]):
                                                                                                self.list_verysussy[8] = -1
                                                                                            self.var_i = (self.var_i + 2)
                                                                                        else:
                                                                                            if eq(self.list_cacamaca[toint(self.var_i)], 20):
                                                                                                if eq(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                                    self.var_i = (tonum(self.list_cacamaca[toint((self.var_i + 3))]) - 4)
                                                                                                self.var_i = (self.var_i + 3)
                                                                                            else:
                                                                                                if eq(self.list_cacamaca[toint(self.var_i)], 21):
                                                                                                    if not eq(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                                        self.var_i = (tonum(self.list_cacamaca[toint((self.var_i + 3))]) - 4)
                                                                                                    self.var_i = (self.var_i + 3)
                                                                                                else:
                                                                                                    if eq(self.list_cacamaca[toint(self.var_i)], 22):
                                                                                                        if gt(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                                            self.var_i = (tonum(self.list_cacamaca[toint((self.var_i + 3))]) - 4)
                                                                                                        self.var_i = (self.var_i + 3)
                                                                                                    else:
                                                                                                        if eq(self.list_cacamaca[toint(self.var_i)], 23):
                                                                                                            if lt(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                                                self.var_i = (tonum(self.list_cacamaca[toint((self.var_i + 3))]) - 4)
                                                                                                            self.var_i = (self.var_i + 3)
                                                                                                        else:
                                                                                                            if eq(self.list_cacamaca[toint(self.var_i)], 24):
                                                                                                                if not lt(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                                                    self.var_i = (tonum(self.list_cacamaca[toint((self.var_i + 3))]) - 4)
                                                                                                                self.var_i = (self.var_i + 3)
                                                                                                            else:
                                                                                                                if eq(self.list_cacamaca[toint(self.var_i)], 25):
                                                                                                                    if not gt(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))]):
                                                                                                                        self.var_i = (tonum(self.list_cacamaca[toint((self.var_i + 3))]) - 4)
                                                                                                                    self.var_i = (self.var_i + 3)
                                                                                                                else:
                                                                                                                    if eq(self.list_cacamaca[toint(self.var_i)], 26):
                                                                                                                        self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = (tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])]) % tonum(self.list_cacamaca[toint((self.var_i + 2))]))
                                                                                                                        self.var_i = (self.var_i + 2)
                                                                                                                    else:
                                                                                                                        if eq(self.list_cacamaca[toint(self.var_i)], 27):
                                                                                                                            self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = (tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])]) % tonum(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]))
                                                                                                                            self.var_i = (self.var_i + 2)
                                                                                                                        else:
                                                                                                                            if eq(self.list_cacamaca[toint(self.var_i)], 28):
                                                                                                                                await self.my_sussusanw(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))], 8)
                                                                                                                                self.var_23 = self.var_sussusreturn
                                                                                                                                self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_23
                                                                                                                                self.var_i = (self.var_i + 2)
                                                                                                                            else:
                                                                                                                                if eq(self.list_cacamaca[toint(self.var_i)], 29):
                                                                                                                                    await self.my_sussusanw(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])], 8)
                                                                                                                                    self.var_24 = self.var_sussusreturn
                                                                                                                                    self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_24
                                                                                                                                    self.var_i = (self.var_i + 2)
                                                                                                                                else:
                                                                                                                                    if eq(self.list_cacamaca[toint(self.var_i)], 30):
                                                                                                                                        await self.my_notsussusanw(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_cacamaca[toint((self.var_i + 2))], 8)
                                                                                                                                        self.var_25 = self.var_notsussusreturn
                                                                                                                                        self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_25
                                                                                                                                        self.var_i = (self.var_i + 2)
                                                                                                                                    else:
                                                                                                                                        if eq(self.list_cacamaca[toint(self.var_i)], 31):
                                                                                                                                            await self.my_notsussusanw(util, self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])], 8)
                                                                                                                                            self.var_26 = self.var_notsussusreturn
                                                                                                                                            self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.var_26
                                                                                                                                            self.var_i = (self.var_i + 2)
                                                                                                                                        else:
                                                                                                                                            if eq(self.list_cacamaca[toint(self.var_i)], 32):
                                                                                                                                                self.list_cacamaca[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.list_cacamaca[toint((self.var_i + 2))]
                                                                                                                                                self.var_i = (self.var_i + 2)
                                                                                                                                            else:
                                                                                                                                                if eq(self.list_cacamaca[toint(self.var_i)], 33):
                                                                                                                                                    self.list_cacamaca[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]
                                                                                                                                                    self.var_i = (self.var_i + 2)
                                                                                                                                                else:
                                                                                                                                                    if eq(self.list_cacamaca[toint(self.var_i)], 34):
                                                                                                                                                        self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.list_cacamaca[toint(self.list_cacamaca[toint((self.var_i + 2))])]
                                                                                                                                                        self.var_i = (self.var_i + 2)
                                                                                                                                                    else:
                                                                                                                                                        if eq(self.list_cacamaca[toint(self.var_i)], 35):
                                                                                                                                                            self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.list_cacamaca[toint(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])])]
                                                                                                                                                            self.var_i = (self.var_i + 2)
                                                                                                                                                        else:
                                                                                                                                                            if eq(self.list_cacamaca[toint(self.var_i)], 36):
                                                                                                                                                                self.var_i = self.var_i
                                                                                                                                                            else:
                                                                                                                                                                if eq(self.list_cacamaca[toint(self.var_i)], 37):
                                                                                                                                                                    self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])] = self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]
                                                                                                                                                                    self.var_i = (self.var_i + 2)
                                                                                                                                                                else:
                                                                                                                                                                    if eq(self.list_cacamaca[toint(self.var_i)], 38):
                                                                                                                                                                        pass # looks_say("Good")
                                                                                                                                                                        return None
                                                                                                                                                                    else:
                                                                                                                                                                        if eq(self.list_cacamaca[toint(self.var_i)], 39):
                                                                                                                                                                            self.list_cacamaca[toint(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])])] = self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]
                                                                                                                                                                            self.var_i = (self.var_i + 2)
                                                                                                                                                                        else:
                                                                                                                                                                            if eq(self.list_cacamaca[toint(self.var_i)], 40):
                                                                                                                                                                                pass # looks_say("Bad")
                                                                                                                                                                                return None
                                                                                                                                                                            else:
                                                                                                                                                                                if eq(self.list_cacamaca[toint(self.var_i)], 41):
                                                                                                                                                                                    if not eq(self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 1))])], self.list_verysussy[toint(self.list_cacamaca[toint((self.var_i + 2))])]):
                                                                                                                                                                                        self.var_i = (tonum(self.list_cacamaca[toint((self.var_i + 3))]) - 4)
                                                                                                                                                                                    self.var_i = (self.var_i + 3)
            self.var_i = (self.var_i + 1)

await self.yield_()

if __name__ == '__main__':
    engine.start_program()

~~~

ai给出脚本

~~~python
# 从原始代码中复制的 cacamaca 列表
cacamaca = [
    17, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 142, 113, 44, 30, 4, 30, 188, 142, 85, 54, 77, 46, 212, 151, 22, 149, 190, 68, 143, 14, 165, 95, 28, 189, 158, 100, 87, 252, 143, 117, 206, 133, 38, 101, 159, 4, 31, 140, 135, 36, 63, 124, 55, 68, 127, 133, 30, 101, 6, 181, 158, 100, 15, 196, 62, 69, 230, 165, 142, 29, 231, 252, 191, 180, 215, 76, 182, 197, 190, 5, 238, 40, 0, 1, 69, 0, 2, 1, 37, 3, 2, 1, 3, 2, 35, 4, 3, 28, 4, 3, 37, 5, 4, 28, 5, 4, 37, 6, 3, 3, 6, 1, 35, 7, 6, 12, 4, 7, 39, 3, 4, 1, 2, 1, 25, 2, 69, 148, 0, 2, 1, 37, 3, 2, 1, 3, 2, 35, 4, 3, 1, 3, 69, 35, 5, 3, 41, 4, 5, 141, 1, 2, 1, 25, 2, 69, 191, 38
]

def ror(n, bits, width=8):
    """8位循环右移函数"""
    mask = (1 << width) - 1
    return ((n >> bits) | (n << (width - bits))) & mask

# 密钥是 mem[2] (即 cacamaca[1])
key = cacamaca[1]

# 数据块 D 是从 cacamaca 索引 72 开始的 69 个字节
# D_i 对应 cacamaca[i+71]
data_block = cacamaca[72:72 + 69]

# 用于存储 Flag 的列表
flag_bytes = [0] * 69

# --- 开始逆向计算 ---

# 计算 Flag 的第一个字节 (O_3)
# O_3 = ROR(D_3 ^ O_2, 3)
xor_val_0 = data_block[0] ^ key
flag_bytes[0] = ror(xor_val_0, 3)

# 循环计算 Flag 的剩余字节
# O_{i+2} = ROR(D_{i+2} ^ D_{i+1}, 3)
for i in range(len(data_block) - 1):
    xor_val_i = data_block[i+1] ^ data_block[i]
    flag_bytes[i+1] = ror(xor_val_i, 3)

# 将字节转换为字符串
flag = "".join(map(chr, flag_bytes))

print("获取到的 Flag 是:")
print(flag)
~~~

## MCCRAB2

wasm逆向，根目录python起一个http（python -m http.server 8888），然后127.0.0.1:8888打开即可使用index.html，同时还可以调试wasm代码

首先还是wasm2c编译出来，得到可执行文件ida反编译更好分析

~~~
wasm2c wasm_oscn_bg.wasm -o out.c
gcc -c out.c -o out.o
~~~

根据题目给的lib.rs可知核心加密比较逻辑都在check_flag、encrypt等里面

得到o文件后ida分析找check_flag等函数，结合wat代码可以发现data 1049113位置处有特殊字符串`C3FAE3F2EFF4BFC6C70D91C1F1A8F2DAFAFEACE5FFF7C712D6EAF1EFBA818AFEEFEBA2D1F70FD6EBE3F9AECDCAE4B7EBEDDCFB129DE8BCD9F4DCE9B0D6F7C9D8F01DDFcheia_osc_plugenc`

在c代码中发现比较点，可以看到后面有wrong、correct

![image-20250831204433873.png](http://xherlock.top/usr/uploads/2025/08/3440246482.png)

回到浏览器里源代码wasm搜1049113（此时已经转为了wat代码，还是可以读的）下断点

![image-20250831204544121.png](http://xherlock.top/usr/uploads/2025/08/726883149.png)

输入框输入6个a结果发现没有断下来，说明压根没有到比较点（下断点在encrypt等同样发现没有被调用）

~~~
                local.get $var2
                i32.load offset=36
                i32.const 134
                i32.eq
                if
                  local.get $var2
                  i32.load offset=32
                  local.set $var4
                  i32.const 0
                  local.set $var0
                  i32.const 134
                  local.set $var1
                  i32.const 1049113
~~~

从1049113往上找发现一处if比较，可以在local.get $var2下断点发现此时可以断下来，说明我们没有进到这个if

![image-20250831204916565.png](http://xherlock.top/usr/uploads/2025/08/312059347.png)

调试发现比较12和134，12正好是我们输入的6个a的16进制长度；134同样也是`C3FAE3F2EFF4BFC6C70D91C1F1A8F2DAFAFEACE5FFF7C712D6EAF1EFBA818AFEEFEBA2D1F70FD6EBE3F9AECDCAE4B7EBEDDCFB129DE8BCD9F4DCE9B0D6F7C9D8F01DDF`

因此可知输入应该是67位，直接怼a*67进去看比较点

点击下图里的内存可以查看值

![image-20250831205633852.png](http://xherlock.top/usr/uploads/2025/08/3600511265.png)

调试到下图时候看到给了一个比较大的地址，查看内存发现正好是输入加密完的结果

![image-20250831205740645.png](http://xherlock.top/usr/uploads/2025/08/3103879494.png)

结合前面obf_key长度14（`cheia_osc_plug`，check_flag开头有一组while循环14次，按模3结果处理了key），观察发现这个组16进制值出现了循环，因此直接猜测只做了简单的异或，我们要做的只需要提取出来异或的值即可

~~~python
xor = list(bytes.fromhex("e1cfc4e8f9fdedc9f91bc3ffe0fd"))
xor = [i^97 for i in xor]
print(xor)
cmp = list(bytes.fromhex("C3FAE3F2EFF4BFC6C70D91C1F1A8F2DAFAFEACE5FFF7C712D6EAF1EFBA818AFEEFEBA2D1F70FD6EBE3F9AECDCAE4B7EBEDDCFB129DE8BCD9F4DCE9B0D6F7C9D8F01DDF"))
for i in range(len(cmp)):
    print(chr(cmp[i]^xor[i%len(xor)]), end="")
~~~

得到flag

~~~
[128, 174, 165, 137, 152, 156, 140, 168, 152, 122, 162, 158, 129, 156]
CTF{wh3n_w3_p4rt_w4ys__https://www.youtube.com/watch?v=EtrL9NkEphg}
~~~

具体实现算法可以看p3师傅的脚本

~~~python
def T(ch, pos):
    if pos % 3 == 1:
        return ch
    elif pos % 3 == 2:
        return ch.lower()
    else:
        return ch.upper()

def transform_key_once(key):
    transformed = []
    for i, ch in enumerate(key):
        transformed.append(T(ch, i))
    return "".join(transformed)

def decrypt_flag(enc_hex, key):
    bs = bytes.fromhex(enc_hex)
    tkey = transform_key_once(key)

out = []
    for i, b in enumerate(bs):
        kch = tkey[i % len(tkey)]
        k = (ord(kch) + 57) & 0xFF
        out.append(chr(b ^ k))

return "".join(out)

enc = "C3FAE3F2EFF4BFC6C70D91C1F1A8F2DAFAFEACE5FFF7C712D6EAF1EFBA818AFEEFEBA2D1F70FD6EBE3F9AECDCAE4B7EBEDDCFB129DE8BCD9F4DCE9B0D6F7C9D8F01DDF"
key = "gulp_cso_aiehc"

flag = decrypt_flag(enc, key)
print(flag)
~~~

最后修改：2025 年 08 月 31 日

如果觉得我的文章对你有用，请随意赞赏

发表评论取消回复
使用cookie技术保留您的个人信息以便您下次快速评论，继续评论表示您已同意该条款

评论 *

私密评论

名称 *

🎲

邮箱 *

地址

Reverse（十一）
浏览次数: 10722
Reverse（十三）
浏览次数: 3717
Win11新机鼓捣记录
浏览次数: 2810
js逆向爬虫1
浏览次数: 2129
欢迎使用 Typecho
浏览次数: 2027

mars
博主你好，请问怎么知道的alloc函数属于Buffer下的方法...
lj
该评论仅登录用户及评论双方可见
Mr.Guan
:@(赞一个)
Typecho
欢迎加入 Typecho 大家族

实训第九天
浏览次数: 674
信息安全概论
浏览次数: 562
Vue（二）
浏览次数: 1069
CH2 虚拟机中分析恶意代码
浏览次数: 613
CSS4
浏览次数: 729

TFCCTF 2025 wp

Xherlock • 2025 年 08 月 31 日

# TFCCTF 2025 wp

6th差一名线下，题目还不错

## OXIDIZED INTENTIONS

借着这道题学习了很多apk解包、打包、签名的知识

arm的so所以必须要真机

首先分析java层可知做了个广播接收seed值（intent.getStringExtra("seed")）

~~~java
package com.example.oxidized_intentions;

package com.example.oxidized_intentions;

import android.content.Context;
import kotlin.Metadata;
import kotlin.jvm.JvmStatic;

@JvmStatic
    public static final native String getFlag(Context ctx, String seed, String part, int check);

@JvmStatic
    public static final void initAtLaunch() {
    }

private Native() {
    }

static {
        System.loadLibrary("oxi");
    }
}
~~~

分析native层getFlag函数可知，里面实现了很复杂的seed生成随机数操作，比较字符串fe2o3rust

后面还有一个逐位异或验证哈希值，由此可知seed值应该为fe2o3rust

尝试adb安装apk到真机，然后广播seed值

~~~
adb shell am broadcast -n com.example.oxidized_intentions/.TicketReceiver --es seed "fe2o3rust"
~~~

查看log（adb logcat -s OXI）

发现`HACKER bit not set -> returning FAKE`，由此可知需要patch掉下面的if，不让他进去

直接nop掉跳转即可

![image-20250829235120600.png](http://xherlock.top/usr/uploads/2025/08/926559383.png)

然后apply patches

接下来需要做的是把新的so重新打包回去，这里需要借助apktool

~~~
apktool d app-release.apk -o app-src
~~~

然后替换新的so，此外还需要修改AndroidManifest.xml里extractNativeLibs的值为true

接着apktool打包

~~~
apktool b app-src -o app-unsigned.apk
~~~

此时需要先生成key

~~~
keytool -genkey -v -keystore test.jks -keyalg RSA -keysize 2048 -validity 10000 -alias testkey
~~~

然后找到android sdk下的apksigner.bat

~~~
F:\android\build-tools\35.0.1\apksigner.bat sign --ks test.jks --ks-key-alias testkey --out app-signed.apk app-unsigned.apk
~~~

然后就可以安装

~~~
adb install -r app-signed.apk
~~~

再次执行上面的广播命令，结束后，点看apk去log里即可看到flag

## SCRATCHING MACHINE

很复杂的积木语言题scratch，碰到这种直接用工具https://github.com/BirdLogics/sb3topy即可

转成python直接喂给ai写脚本

~~~python
import math
import time

import engine
from engine.events import *
from engine.operators import *
from engine.types import *

@sprite('Stage')
class Stage(Target):
    """Sprite Stage"""

def __init__(self, parent=None):
        super().__init__(parent)
        if parent is not None:
            return

self._xpos = 0
        self._ypos = 0
        self._direction = 90
        self.shown = True
        self.pen = Pen(self)

self.sounds = Sounds(
            100, [

])

self.sprite.layer = 0

@sprite('main')
class Spritemain(Target):
    """Sprite main"""

def __init__(self, parent=None):
        super().__init__(parent)
        if parent is not None:
            return

self._xpos = 0
        self._ypos = 0
        self._direction = 90
        self.shown = True
        self.pen = Pen(self)

self.sounds = Sounds(
            100, [

])

self.sprite.layer = 1

@on_green_flag
    async def green_flag(self, util):
        for _ in range(8):
            self.list_verysussy.append(0)

await self.yield_()

if __name__ == '__main__':
    engine.start_program()

~~~

ai给出脚本

def ror(n, bits, width=8):
    """8位循环右移函数"""
    mask = (1 << width) - 1
    return ((n >> bits) | (n << (width - bits))) & mask

# 密钥是 mem[2] (即 cacamaca[1])
key = cacamaca[1]

# 数据块 D 是从 cacamaca 索引 72 开始的 69 个字节
# D_i 对应 cacamaca[i+71]
data_block = cacamaca[72:72 + 69]

# 用于存储 Flag 的列表
flag_bytes = [0] * 69

# --- 开始逆向计算 ---

# 计算 Flag 的第一个字节 (O_3)
# O_3 = ROR(D_3 ^ O_2, 3)
xor_val_0 = data_block[0] ^ key
flag_bytes[0] = ror(xor_val_0, 3)

# 循环计算 Flag 的剩余字节
# O_{i+2} = ROR(D_{i+2} ^ D_{i+1}, 3)
for i in range(len(data_block) - 1):
    xor_val_i = data_block[i+1] ^ data_block[i]
    flag_bytes[i+1] = ror(xor_val_i, 3)

# 将字节转换为字符串
flag = "".join(map(chr, flag_bytes))

print("获取到的 Flag 是:")
print(flag)
~~~

## MCCRAB2

wasm逆向，根目录python起一个http（python -m http.server 8888），然后127.0.0.1:8888打开即可使用index.html，同时还可以调试wasm代码

首先还是wasm2c编译出来，得到可执行文件ida反编译更好分析

~~~
wasm2c wasm_oscn_bg.wasm -o out.c
gcc -c out.c -o out.o
~~~

根据题目给的lib.rs可知核心加密比较逻辑都在check_flag、encrypt等里面

在c代码中发现比较点，可以看到后面有wrong、correct

![image-20250831204433873.png](http://xherlock.top/usr/uploads/2025/08/3440246482.png)

回到浏览器里源代码wasm搜1049113（此时已经转为了wat代码，还是可以读的）下断点

![image-20250831204544121.png](http://xherlock.top/usr/uploads/2025/08/726883149.png)

输入框输入6个a结果发现没有断下来，说明压根没有到比较点（下断点在encrypt等同样发现没有被调用）

从1049113往上找发现一处if比较，可以在local.get $var2下断点发现此时可以断下来，说明我们没有进到这个if

![image-20250831204916565.png](http://xherlock.top/usr/uploads/2025/08/312059347.png)

因此可知输入应该是67位，直接怼a*67进去看比较点

点击下图里的内存可以查看值

![image-20250831205633852.png](http://xherlock.top/usr/uploads/2025/08/3600511265.png)

调试到下图时候看到给了一个比较大的地址，查看内存发现正好是输入加密完的结果

![image-20250831205740645.png](http://xherlock.top/usr/uploads/2025/08/3103879494.png)

得到flag

~~~
[128, 174, 165, 137, 152, 156, 140, 168, 152, 122, 162, 158, 129, 156]
CTF{wh3n_w3_p4rt_w4ys__https://www.youtube.com/watch?v=EtrL9NkEphg}
~~~

具体实现算法可以看p3师傅的脚本

~~~python
def T(ch, pos):
    if pos % 3 == 1:
        return ch
    elif pos % 3 == 2:
        return ch.lower()
    else:
        return ch.upper()

def transform_key_once(key):
    transformed = []
    for i, ch in enumerate(key):
        transformed.append(T(ch, i))
    return "".join(transformed)

def decrypt_flag(enc_hex, key):
    bs = bytes.fromhex(enc_hex)
    tkey = transform_key_once(key)

out = []
    for i, b in enumerate(bs):
        kch = tkey[i % len(tkey)]
        k = (ord(kch) + 57) & 0xFF
        out.append(chr(b ^ k))

return "".join(out)

enc = "C3FAE3F2EFF4BFC6C70D91C1F1A8F2DAFAFEACE5FFF7C712D6EAF1EFBA818AFEEFEBA2D1F70FD6EBE3F9AECDCAE4B7EBEDDCFB129DE8BCD9F4DCE9B0D6F7C9D8F01DDF"
key = "gulp_cso_aiehc"

flag = decrypt_flag(enc, key)
print(flag)
~~~

发表评论 取消回复 使用cookie技术保留您的个人信息以便您下次快速评论，继续评论表示您已同意该条款

TFCCTF 2025 wp

发表评论取消回复
使用cookie技术保留您的个人信息以便您下次快速评论，继续评论表示您已同意该条款