-
-
[原创]南邮ctf逆向WxyVM
-
发表于: 2019-2-18 15:52 4146
-
用记事本打开文件，发现是ELF文件，使用ida载入文件进行分析，是64位ELF文件
直接进行字符串搜索，发现关键字符串，对关键的代码断进行分析。
push rbp .text:00000000004006E4 mov rbp, rsp .text:00000000004006E7 sub rsp, 10h .text:00000000004006EB mov edi, offset s ; "[WxyVM 0.0.1]" .text:00000000004006F0 call _puts .text:00000000004006F5 mov edi, offset aInputYourFlag ; "input your flag:" .text:00000000004006FA call _puts .text:00000000004006FF mov esi, offset byte_604B80//保存的输入的flag .text:0000000000400704 mov edi, offset format ; "%s" .text:0000000000400709 mov eax, 0 .text:000000000040070E call _scanf .text:0000000000400713 mov [rbp+var_5], 1 .text:0000000000400717 call sub_4005B6//这里会对输入的flag进行变换 .text:000000000040071C mov edi, offset byte_604B80 ; s .text:0000000000400721 call _strlen .text:0000000000400726 cmp rax, 18h//输入的flag的长度为18否则，wrong .text:000000000040072A jz short loc_400730 .text:000000000040072C mov [rbp+var_5], 0 .text:0000000000400730 .text:0000000000400730 loc_400730: ; CODE XREF: main+47↑j .text:0000000000400730 mov [rbp+var_4], 0//计数器 .text:0000000000400737 .text:0000000000400737 loc_400737: ; CODE XREF: main+81↓j .text:0000000000400737 cmp [rbp+var_4], 17h//进行循环 .text:000000000040073B jg short loc_400766//大于则退出循环 .text:000000000040073D mov eax, [rbp+var_4]//取出计数器 .text:0000000000400740 cdqe //cdqe复制eax寄存器双字的符号位(bit 31)到rax的高32位 .text:0000000000400742 movzx eax, ds:byte_604B80[rax]//取出第一个字符 .text:0000000000400749 movsx edx, al//将第一个字符放入edx .text:000000000040074C mov eax, [rbp+var_4]//取出计数器 .text:000000000040074F cdqe//符号扩展 .text:0000000000400751 mov eax, dword_601060[rax*4]//从601060处取出数据 .text:0000000000400758 cmp edx, eax //和输入的数据进行比较 .text:000000000040075A jz short loc_400760//相等则继续 .text:000000000040075C mov [rbp+var_5], 0//不相等则退出 .text:0000000000400760 .text:0000000000400760 loc_400760: ; CODE XREF: main+77↑j .text:0000000000400760 add [rbp+var_4], 1 .text:0000000000400764 jmp short loc_400737 .text:0000000000400766 ; --------------------------------------------------------------------------- .text:0000000000400766 .text:0000000000400766 loc_400766: ; CODE XREF: main+58↑j .text:0000000000400766 cmp [rbp+var_5], 0 .text:000000000040076A jz short loc_400778 .text:000000000040076C mov edi, offset aCorrect ; "correct" .text:0000000000400771 call _puts .text:0000000000400776 jmp short loc_400782 .text:0000000000400778 ; --------------------------------------------------------------------------- .text:0000000000400778 .text:0000000000400778 loc_400778: ; CODE XREF: main+87↑j .text:0000000000400778 mov edi, offset aWrong ; "wrong" .text:000000000040077D call _puts .text:0000000000400782 .text:0000000000400782 loc_400782: ; CODE XREF: main+93↑j .text:0000000000400782 mov eax, 0 .text:0000000000400787 leave .text:0000000000400788 retn .text:0000000000400788 ; } // starts at 4006E3 .text:0000000000400788 main endp .text:0000000000400788
所以经过分析可以判断变换后的flag在601060处
函数的主体还是比较简单的，现在需要对输入之后的4005b6函数进行分析
直接使用ida F5大法进行分析操作
__int64 sub_4005B6()
{
unsigned int v0; // ST04_4
__int64 result; // rax
signed int i; // [rsp+0h] [rbp-10h]
char v3; // [rsp+8h] [rbp-8h]
for ( i = 0; i <= 14999; i += 3 )
{
v0 = byte_6010C0[i];
v3 = byte_6010C0[i + 2];
result = v0;
switch ( v0 )
{
case 1u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) += v3;
break;
case 2u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) -= v3;
break;
case 3u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) ^= v3;
break;
case 4u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) *= v3;
break;
case 5u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) ^= *(&byte_604B80 + byte_6010C0[i + 2]);
break;
default:
continue;
}
}
return result;
}函数是对一个比较长的数组进行操作6010c0处的数组进行操作，一共有15000个数据，每三个为一组，v0决定进行什么操作，v2用来寻址操作，v3作为操作数
利用这个函数对已知的数据进行逆运算就能够得到最终的输入结果了。
这里要注意对已知数据进行逆向的时候计数的时候也要倒着计数，从14999~0
解题代码如下，运行环境python2.7
a='C4 34 22 b1 d3 11 97 07 db 37 c4 06 1d fc 5b ed 98 df 94 d8 b3 84 cc 08'
a=a.replace(' ','')
a=a.decode('hex')
b=[]
for i in a:
b.append(ord(i))
fp=open('D:\\data_6010c0.txt','r')
data=fp.read()
#print(data)
data=data.decode('hex')
for i in range(14997,-1,-3):
v0=ord(data[i])
v3=ord(data[i+2])
result=ord(data[i+1])
if(v0==1):
b[result]-=v3
if(v0==2):
b[result]+=v3
if(v0==3):
b[result]^=v3
if(v0==4):
b[result]=b[result]/v3
if(v0==5):
b[result]=b[result]^b[v3]
for i in b:
print(chr(i%128)),
直接进行字符串搜索，发现关键字符串，对关键的代码断进行分析。
push rbp .text:00000000004006E4 mov rbp, rsp .text:00000000004006E7 sub rsp, 10h .text:00000000004006EB mov edi, offset s ; "[WxyVM 0.0.1]" .text:00000000004006F0 call _puts .text:00000000004006F5 mov edi, offset aInputYourFlag ; "input your flag:" .text:00000000004006FA call _puts .text:00000000004006FF mov esi, offset byte_604B80//保存的输入的flag .text:0000000000400704 mov edi, offset format ; "%s" .text:0000000000400709 mov eax, 0 .text:000000000040070E call _scanf .text:0000000000400713 mov [rbp+var_5], 1 .text:0000000000400717 call sub_4005B6//这里会对输入的flag进行变换 .text:000000000040071C mov edi, offset byte_604B80 ; s .text:0000000000400721 call _strlen .text:0000000000400726 cmp rax, 18h//输入的flag的长度为18否则，wrong .text:000000000040072A jz short loc_400730 .text:000000000040072C mov [rbp+var_5], 0 .text:0000000000400730 .text:0000000000400730 loc_400730: ; CODE XREF: main+47↑j .text:0000000000400730 mov [rbp+var_4], 0//计数器 .text:0000000000400737 .text:0000000000400737 loc_400737: ; CODE XREF: main+81↓j .text:0000000000400737 cmp [rbp+var_4], 17h//进行循环 .text:000000000040073B jg short loc_400766//大于则退出循环 .text:000000000040073D mov eax, [rbp+var_4]//取出计数器 .text:0000000000400740 cdqe //cdqe复制eax寄存器双字的符号位(bit 31)到rax的高32位 .text:0000000000400742 movzx eax, ds:byte_604B80[rax]//取出第一个字符 .text:0000000000400749 movsx edx, al//将第一个字符放入edx .text:000000000040074C mov eax, [rbp+var_4]//取出计数器 .text:000000000040074F cdqe//符号扩展 .text:0000000000400751 mov eax, dword_601060[rax*4]//从601060处取出数据 .text:0000000000400758 cmp edx, eax //和输入的数据进行比较 .text:000000000040075A jz short loc_400760//相等则继续 .text:000000000040075C mov [rbp+var_5], 0//不相等则退出 .text:0000000000400760 .text:0000000000400760 loc_400760: ; CODE XREF: main+77↑j .text:0000000000400760 add [rbp+var_4], 1 .text:0000000000400764 jmp short loc_400737 .text:0000000000400766 ; --------------------------------------------------------------------------- .text:0000000000400766 .text:0000000000400766 loc_400766: ; CODE XREF: main+58↑j .text:0000000000400766 cmp [rbp+var_5], 0 .text:000000000040076A jz short loc_400778 .text:000000000040076C mov edi, offset aCorrect ; "correct" .text:0000000000400771 call _puts .text:0000000000400776 jmp short loc_400782 .text:0000000000400778 ; --------------------------------------------------------------------------- .text:0000000000400778 .text:0000000000400778 loc_400778: ; CODE XREF: main+87↑j .text:0000000000400778 mov edi, offset aWrong ; "wrong" .text:000000000040077D call _puts .text:0000000000400782 .text:0000000000400782 loc_400782: ; CODE XREF: main+93↑j .text:0000000000400782 mov eax, 0 .text:0000000000400787 leave .text:0000000000400788 retn .text:0000000000400788 ; } // starts at 4006E3 .text:0000000000400788 main endp .text:0000000000400788
所以经过分析可以判断变换后的flag在601060处
函数的主体还是比较简单的，现在需要对输入之后的4005b6函数进行分析
直接使用ida F5大法进行分析操作
__int64 sub_4005B6()
{
unsigned int v0; // ST04_4
__int64 result; // rax
signed int i; // [rsp+0h] [rbp-10h]
char v3; // [rsp+8h] [rbp-8h]
for ( i = 0; i <= 14999; i += 3 )
{
v0 = byte_6010C0[i];
v3 = byte_6010C0[i + 2];
result = v0;
switch ( v0 )
{
case 1u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) += v3;
break;
case 2u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) -= v3;
break;
case 3u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) ^= v3;
break;
case 4u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) *= v3;
break;
case 5u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) ^= *(&byte_604B80 + byte_6010C0[i + 2]);
break;
default:
continue;
}
}
return result;
}函数是对一个比较长的数组进行操作6010c0处的数组进行操作，一共有15000个数据，每三个为一组，v0决定进行什么操作，v2用来寻址操作，v3作为操作数
利用这个函数对已知的数据进行逆运算就能够得到最终的输入结果了。
这里要注意对已知数据进行逆向的时候计数的时候也要倒着计数，从14999~0
解题代码如下，运行环境python2.7
a='C4 34 22 b1 d3 11 97 07 db 37 c4 06 1d fc 5b ed 98 df 94 d8 b3 84 cc 08'
a=a.replace(' ','')
a=a.decode('hex')
b=[]
for i in a:
b.append(ord(i))
fp=open('D:\\data_6010c0.txt','r')
data=fp.read()
#print(data)
data=data.decode('hex')
for i in range(14997,-1,-3):
v0=ord(data[i])
v3=ord(data[i+2])
result=ord(data[i+1])
if(v0==1):
b[result]-=v3
if(v0==2):
b[result]+=v3
if(v0==3):
b[result]^=v3
if(v0==4):
b[result]=b[result]/v3
if(v0==5):
b[result]=b[result]^b[v3]
for i in b:
print(chr(i%128)),
push rbp .text:00000000004006E4 mov rbp, rsp .text:00000000004006E7 sub rsp, 10h .text:00000000004006EB mov edi, offset s ; "[WxyVM 0.0.1]" .text:00000000004006F0 call _puts .text:00000000004006F5 mov edi, offset aInputYourFlag ; "input your flag:" .text:00000000004006FA call _puts .text:00000000004006FF mov esi, offset byte_604B80//保存的输入的flag .text:0000000000400704 mov edi, offset format ; "%s" .text:0000000000400709 mov eax, 0 .text:000000000040070E call _scanf .text:0000000000400713 mov [rbp+var_5], 1 .text:0000000000400717 call sub_4005B6//这里会对输入的flag进行变换 .text:000000000040071C mov edi, offset byte_604B80 ; s .text:0000000000400721 call _strlen .text:0000000000400726 cmp rax, 18h//输入的flag的长度为18否则，wrong .text:000000000040072A jz short loc_400730 .text:000000000040072C mov [rbp+var_5], 0 .text:0000000000400730 .text:0000000000400730 loc_400730: ; CODE XREF: main+47↑j .text:0000000000400730 mov [rbp+var_4], 0//计数器 .text:0000000000400737 .text:0000000000400737 loc_400737: ; CODE XREF: main+81↓j .text:0000000000400737 cmp [rbp+var_4], 17h//进行循环 .text:000000000040073B jg short loc_400766//大于则退出循环 .text:000000000040073D mov eax, [rbp+var_4]//取出计数器 .text:0000000000400740 cdqe //cdqe复制eax寄存器双字的符号位(bit 31)到rax的高32位 .text:0000000000400742 movzx eax, ds:byte_604B80[rax]//取出第一个字符 .text:0000000000400749 movsx edx, al//将第一个字符放入edx .text:000000000040074C mov eax, [rbp+var_4]//取出计数器 .text:000000000040074F cdqe//符号扩展 .text:0000000000400751 mov eax, dword_601060[rax*4]//从601060处取出数据 .text:0000000000400758 cmp edx, eax //和输入的数据进行比较 .text:000000000040075A jz short loc_400760//相等则继续 .text:000000000040075C mov [rbp+var_5], 0//不相等则退出 .text:0000000000400760 .text:0000000000400760 loc_400760: ; CODE XREF: main+77↑j .text:0000000000400760 add [rbp+var_4], 1 .text:0000000000400764 jmp short loc_400737 .text:0000000000400766 ; --------------------------------------------------------------------------- .text:0000000000400766 .text:0000000000400766 loc_400766: ; CODE XREF: main+58↑j .text:0000000000400766 cmp [rbp+var_5], 0 .text:000000000040076A jz short loc_400778 .text:000000000040076C mov edi, offset aCorrect ; "correct" .text:0000000000400771 call _puts .text:0000000000400776 jmp short loc_400782 .text:0000000000400778 ; --------------------------------------------------------------------------- .text:0000000000400778 .text:0000000000400778 loc_400778: ; CODE XREF: main+87↑j .text:0000000000400778 mov edi, offset aWrong ; "wrong" .text:000000000040077D call _puts .text:0000000000400782 .text:0000000000400782 loc_400782: ; CODE XREF: main+93↑j .text:0000000000400782 mov eax, 0 .text:0000000000400787 leave .text:0000000000400788 retn .text:0000000000400788 ; } // starts at 4006E3 .text:0000000000400788 main endp .text:0000000000400788
所以经过分析可以判断变换后的flag在601060处
函数的主体还是比较简单的，现在需要对输入之后的4005b6函数进行分析
直接使用ida F5大法进行分析操作
__int64 sub_4005B6()
{
unsigned int v0; // ST04_4
__int64 result; // rax
signed int i; // [rsp+0h] [rbp-10h]
char v3; // [rsp+8h] [rbp-8h]
for ( i = 0; i <= 14999; i += 3 )
{
v0 = byte_6010C0[i];
v3 = byte_6010C0[i + 2];
result = v0;
switch ( v0 )
{
case 1u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) += v3;
break;
case 2u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) -= v3;
break;
case 3u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) ^= v3;
break;
case 4u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) *= v3;
break;
case 5u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) ^= *(&byte_604B80 + byte_6010C0[i + 2]);
break;
default:
continue;
}
}
return result;
}函数是对一个比较长的数组进行操作6010c0处的数组进行操作，一共有15000个数据，每三个为一组，v0决定进行什么操作，v2用来寻址操作，v3作为操作数
利用这个函数对已知的数据进行逆运算就能够得到最终的输入结果了。
这里要注意对已知数据进行逆向的时候计数的时候也要倒着计数，从14999~0
解题代码如下，运行环境python2.7
a='C4 34 22 b1 d3 11 97 07 db 37 c4 06 1d fc 5b ed 98 df 94 d8 b3 84 cc 08'
a=a.replace(' ','')
a=a.decode('hex')
b=[]
for i in a:
b.append(ord(i))
fp=open('D:\\data_6010c0.txt','r')
data=fp.read()
#print(data)
data=data.decode('hex')
for i in range(14997,-1,-3):
v0=ord(data[i])
v3=ord(data[i+2])
result=ord(data[i+1])
if(v0==1):
b[result]-=v3
if(v0==2):
b[result]+=v3
if(v0==3):
b[result]^=v3
if(v0==4):
b[result]=b[result]/v3
if(v0==5):
b[result]=b[result]^b[v3]
for i in b:
print(chr(i%128)),
__int64 sub_4005B6()
{
unsigned int v0; // ST04_4
__int64 result; // rax
signed int i; // [rsp+0h] [rbp-10h]
char v3; // [rsp+8h] [rbp-8h]
for ( i = 0; i <= 14999; i += 3 )
{
v0 = byte_6010C0[i];
v3 = byte_6010C0[i + 2];
result = v0;
switch ( v0 )
{
case 1u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) += v3;
break;
case 2u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) -= v3;
break;
case 3u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) ^= v3;
break;
case 4u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) *= v3;
break;
case 5u:
result = byte_6010C0[i + 1];
*(&byte_604B80 + result) ^= *(&byte_604B80 + byte_6010C0[i + 2]);
break;
default:
continue;
}
}
return result;
}函数是对一个比较长的数组进行操作6010c0处的数组进行操作，一共有15000个数据，每三个为一组，v0决定进行什么操作，v2用来寻址操作，v3作为操作数
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
赞赏
|
|
|---|---|
|
|
WxyVM2#include <stdio.h>
#include <string.h>
int Flag[25]={0xffffffC0,0xffffff85,0xffffffF9,0x6C,0xffffffE2,0x14,0xffffffBB,0xffffffe4,0xd,0x59,0x1c,0x23,0xffffff88,0x6e,0xffffff9b,0xffffffca,0xffffffba,0x5c,0x37,0xffffffff,0x48,0xffffffd8,0x1f,0xffffffab,0xffffffa5};
//char Flag[25]={0};
int main(){
char v4; // [rsp+Bh] [rbp-5h]
signed int i; // [rsp+Ch] [rbp-4h]
/*
puts("[WxyVM 0.0.2]");
puts("input your flag:");
scanf("%s", Flag);
v4 = 1;
if ( strlen(Flag) != 25 ){
v4 = 0;
}*/
Flag[9] -= 7;
Flag[17] -= 0x45;
Flag[0] ^= 0x5Eu;
Flag[2] ^= 0xBu;
Flag[2] -= 10;
Flag[11] ^= 0x6Bu;
Flag[6] -= 76;
Flag[12] -= 121;
Flag[17] ^= 0xFu;
Flag[13] -= 75;
Flag[18] ^= 0xBu;
Flag[0] ^= 0x7Eu;
Flag[20] += 105;
Flag[23] -= 26;
Flag[8] -= 26;
Flag[9] -= 96;
Flag[13] ^= 0x52u;
Flag[18] -= 116;
Flag[2] -= 27;
Flag[21] += 8;
Flag[20] -= 72;
Flag[1] -= 89;
Flag[18] += 26;
Flag[16] += 110;
Flag[12] -= 81;
Flag[2] ^= 3u;
Flag[3] ^= 0x55u;
Flag[11] ^= 0x4Fu;
Flag[11] ^= 0x2Bu;
Flag[0] ^= 0x35u;
Flag[19] += 56;
Flag[1] += 49;
Flag[5] ^= 0x2Fu;
Flag[10] += 102;
Flag[10] += 43;
Flag[6] += 121;
Flag[16] ^= 0x62u;
Flag[14] += 87;
Flag[7] ^= 0x48u;
Flag[19] ^= 0x1Au;
Flag[10] -= 47;
Flag[4] += 118;
Flag[20] -= 82;
Flag[9] += 46;
Flag[3] ^= 0x6Bu;
Flag[11] += 59;
Flag[4] ^= 0x28u;
Flag[11] -= 71;
Flag[10] -= 100;
Flag[18] ^= 0x29u;
Flag[16] ^= 0x10u;
Flag[13] ^= 0x44u;
Flag[12] ^= 0x22u;
Flag[3] ^= 0x4Fu;
Flag[16] ^= 0x50u;
Flag[21] += 8;
Flag[20] += 16;
Flag[2] += 112;
Flag[9] ^= 0x5Bu;
Flag[12] -= 96;
Flag[5] += 117;
Flag[7] += 66;
Flag[9] += 21;
Flag[14] += 33;
Flag[10] -= 69;
Flag[7] -= 108;
Flag[12] ^= 0x10u;
Flag[21] -= 104;
Flag[10] -= 36;
Flag[16] ^= 0x23u;
Flag[1] -= 63;
Flag[11] ^= 0x62u;
Flag[17] -= 2;
Flag[11] -= 77;
Flag[18] ^= 0x3Du;
Flag[24] += 47;
Flag[2] += 75;
Flag[8] -= 71;
Flag[18] += 94;
Flag[3] ^= 0x41u;
Flag[4] ^= 0x17u;
Flag[22] ^= 0x5Au;
Flag[16] -= 31;
Flag[5] -= 24;
Flag[8] += 116;
Flag[2] += 101;
Flag[11] += 109;
Flag[1] += 19;
Flag[19] += 118;
Flag[10] += 28;
Flag[15] ^= 0x5Fu;
Flag[16] += 54;
Flag[23] ^= 0x2Cu;
Flag[12] -= 127;
Flag[3] += 47;
Flag[19] += 51;
Flag[9] ^= 0x35u;
Flag[9] += 41;
Flag[13] -= 18;
Flag[8] -= 42;
Flag[8] -= 127;
Flag[7] ^= 0x5Bu;
Flag[10] += 26;
Flag[24] -= 62;
Flag[6] ^= 0x55u;
Flag[22] ^= 4u;
Flag[4] ^= 0x3Cu;
Flag[6] += 33;
Flag[14] ^= 0x2Du;
Flag[2] ^= 0x61u;
Flag[15] += 95;
Flag[7] += 55;
Flag[20] -= 27;
Flag[2] ^= 0x4Fu;
Flag[17] += 98;
Flag[9] += 24;
Flag[3] += 4;
Flag[6] ^= 0x49u;
Flag[20] -= 74;
Flag[6] ^= 0x37u;
Flag[20] += 117;
Flag[1] += 66;
Flag[2] += 51;
Flag[0] -= 64;
Flag[16] ^= 0x18u;
Flag[21] += 8;
Flag[13] ^= 0x51u;
Flag[3] -= 50;
Flag[24] += 38;
Flag[22] += 80;
Flag[12] += 104;
Flag[21] ^= 0x37u;
Flag[4] -= 56;
Flag[0] -= 28;
Flag[4] -= 95;
Flag[6] -= 38;
Flag[1] += 59;
Flag[22] += 88;
Flag[3] -= 127;
Flag[6] ^= 0x42u;
Flag[5] += 88;
Flag[15] -= 21;
Flag[0] ^= 0x6Au;
Flag[17] -= 48;
Flag[22] -= 125;
Flag[6] ^= 3u;
Flag[6] -= 31;
Flag[17] ^= 0x36u;
Flag[0] -= 39;
Flag[0] += 6;
Flag[5] += 39;
Flag[0] += 16;
Flag[0] ^= 0x48u;
Flag[15] += 65;
Flag[15] += 39;
Flag[21] += 88;
Flag[0] += 60;
Flag[3] ^= 2u;
Flag[21] += 96;
Flag[19] += 8;
Flag[4] -= 100;
Flag[13] += 56;
Flag[23] ^= 0x5Cu;
Flag[18] += 19;
Flag[6] ^= 0x21u;
Flag[6] -= 35;
Flag[17] += 121;
Flag[13] += 26;
Flag[20] += 108;
Flag[1] -= 83;
Flag[6] -= 76;
Flag[8] ^= 0x29u;
Flag[3] ^= 0x57u;
Flag[1] -= 80;
Flag[10] += 53;
Flag[15] ^= 0x42u;
Flag[7] -= 22;
Flag[13] += 100;
Flag[9] += 70;
Flag[5] -= 21;
Flag[16] += 10;
Flag[3] += 89;
Flag[12] ^= 0x34u;
Flag[0] ^= 0x21u;
Flag[14] ^= 0x54u;
Flag[6] ^= 0x32u;
Flag[18] -= 70;
Flag[3] -= 53;
Flag[8] -= 95;
Flag[9] += 82;
Flag[16] += 10;
Flag[9] -= 100;
Flag[24] += 113;
Flag[14] += 119;
Flag[2] ^= 0x80u;
Flag[15] -= 20;
Flag[9] -= 28;
Flag[17] -= 36;
Flag[9] += 67;
Flag[13] -= 9;
Flag[10] += 32;
Flag[1] -= 53;
Flag[9] ^= 4u;
Flag[21] += 109;
Flag[21] ^= 0x24u;
Flag[13] -= 68;
Flag[16] += 59;
Flag[18] -= 28;
Flag[2] ^= 0x47u;
Flag[7] -= 24;
Flag[16] ^= 0x68u;
Flag[6] ^= 0x67u;
Flag[16] -= 12;
Flag[13] += 75;
Flag[14] ^= 0x3Au;
Flag[24] += 89;
Flag[9] -= 114;
Flag[13] ^= 0x74u;
Flag[9] ^= 0x4Cu;
Flag[17] += 70;
Flag[21] ^= 0x27u;
Flag[15] += 109;
Flag[16] += 42;
Flag[10] += 33;
Flag[16] += 5;
Flag[3] += 23;
Flag[2] ^= 0x2Eu;
Flag[15] ^= 0x42u;
Flag[18] += 88;
Flag[1] -= 29;
Flag[22] += 93;
Flag[22] ^= 0x28u;
Flag[23] -= 12;
Flag[1] -= 122;
Flag[4] ^= 0xAu;
Flag[6] -= 84;
Flag[17] -= 14;
Flag[1] -= 22;
Flag[24] += 114;
Flag[17] -= 14;
Flag[17] += 102;
Flag[13] += 22;
Flag[12] += 17;
Flag[4] ^= 0x7Bu;
Flag[5] += 91;
Flag[22] ^= 0xDu;
Flag[10] += 87;
Flag[14] ^= 0x5Au;
Flag[13] ^= 0x33u;
Flag[12] ^= 0xEu;
Flag[19] += 96;
Flag[18] ^= 0x77u;
Flag[17] += 50;
Flag[11] += 32;
Flag[17] -= 5;
Flag[6] += 109;
Flag[16] ^= 0x73u;
Flag[3] ^= 0x44u;
Flag[18] += 45;
Flag[10] ^= 0x26u;
Flag[2] += 93;
Flag[6] += 121;
Flag[8] -= 88;
Flag[10] -= 51;
Flag[23] ^= 0xAu;
Flag[0] -= -128;
Flag[18] += 117;
Flag[1] += 19;
Flag[15] -= 90;
Flag[24] ^= 6u;
Flag[18] ^= 0x53u;
Flag[14] += 61;
Flag[3] += 69;
Flag[0] ^= 0x59u;
Flag[6] += 44;
Flag[10] += 20;
Flag[13] ^= 0x77u;
Flag[9] -= 43;
Flag[21] -= 20;
Flag[21] ^= 0x80u;
Flag[23] ^= 0x2Bu;
Flag[22] -= 76;
Flag[4] += 111;
Flag[21] += 120;
Flag[19] += 60;
Flag[14] ^= 0x65u;
Flag[0] += 21;
Flag[22] -= 73;
Flag[3] -= 89;
Flag[21] ^= 0x55u;
Flag[7] ^= 0x5Bu;
Flag[12] += 87;
Flag[10] ^= 0x6Cu;
Flag[5] -= 86;
Flag[5] ^= 0x34u;
Flag[15] -= 103;
Flag[10] ^= 0x4Cu;
Flag[5] ^= 0x57u;
Flag[20] ^= 0x5Bu;
Flag[23] -= 37;
Flag[22] ^= 0x31u;
Flag[1] -= 22;
Flag[3] -= 84;
Flag[20] ^= 0x58u;
Flag[21] -= 126;
Flag[11] += 69;
Flag[5] ^= 0x7Bu;
Flag[6] ^= 0x20u;
Flag[2] -= 82;
Flag[9] ^= 0x6Bu;
Flag[6] += 46;
Flag[0] += 48;
Flag[7] += 28;
Flag[7] -= 58;
Flag[6] -= 62;
Flag[6] += 80;
Flag[0] -= 93;
Flag[6] ^= 0x70u;
Flag[17] -= 109;
Flag[19] += 85;
Flag[13] -= 118;
--Flag[20];
Flag[21] -= 86;
Flag[6] ^= 0x36u;
Flag[8] -= 77;
Flag[13] ^= 0x80u;
Flag[0] -= 46;
Flag[16] ^= 0x47u;
Flag[19] -= 34;
Flag[15] += 53;
Flag[22] -= 92;
Flag[8] -= 51;
Flag[15] -= 104;
Flag[13] ^= 0x57u;
Flag[20] -= 66;
Flag[9] ^= 0x1Du;
Flag[1] ^= 0x41u;
Flag[19] -= 105;
Flag[9] ^= 0x66u;
Flag[0] -= 15;
Flag[23] -= 30;
Flag[0] ^= 0x6Fu;
Flag[1] += 69;
Flag[7] += 104;
Flag[8] -= 103;
Flag[14] -= 93;
Flag[22] ^= 0x29u;
Flag[21] += 115;
Flag[22] -= 108;
Flag[0] ^= 0x3Cu;
Flag[15] += 18;
Flag[19] += 116;
Flag[9] -= 126;
Flag[0] -= 113;
Flag[1] -= 107;
Flag[13] ^= 0x64u;
Flag[21] -= 16;
Flag[11] += 83;
Flag[23] ^= 0x24u;
Flag[2] ^= 0x47u;
Flag[7] ^= 0x64u;
Flag[24] -= 39;
Flag[1] -= 53;
Flag[6] ^= 0x38u;
Flag[15] ^= 0x58u;
Flag[12] += 108;
Flag[21] -= 85;
Flag[13] ^= 0xBu;
Flag[17] -= 13;
Flag[19] -= 95;
Flag[15] -= 98;
Flag[13] ^= 0x68u;
Flag[3] ^= 0x2Cu;
Flag[19] ^= 0x18u;
Flag[5] -= 15;
Flag[13] -= 68;
Flag[19] ^= 0x60u;
Flag[13] ^= 0x66u;
Flag[1] += 11;
Flag[17] -= 105;
Flag[0] -= 94;
Flag[16] ^= 0x59u;
Flag[1] ^= 0x6Bu;
Flag[13] ^= 0x67u;
Flag[4] += 74;
Flag[0] -= 4;
Flag[6] -= 74;
Flag[7] += 57;
Flag[1] += 106;
Flag[4] += 11;
Flag[18] -= 92;
Flag[12] += 111;
Flag[24] -= 102;
Flag[4] ^= 0xAu;
Flag[20] += 110;
Flag[3] += 20;
Flag[18] += 124;
Flag[23] += 72;
Flag[18] ^= 0x12u;
Flag[14] ^= 0x32u;
Flag[0] += 3;
Flag[3] -= 39;
Flag[23] ^= 8u;
Flag[4] += 7;
Flag[9] += 62;
Flag[23] ^= 0x43u;
Flag[19] ^= 0x67u;
Flag[10] -= 103;
Flag[18] ^= 0xEu;
Flag[24] += 41;
Flag[1] += 112;
Flag[1] += 75;
Flag[13] += 4;
Flag[20] += 37;
Flag[1] ^= 0xDu;
Flag[12] += 86;
Flag[4] -= 42;
Flag[23] ^= 0x74u;
Flag[21] ^= 0x65u;
Flag[24] -= 2;
Flag[3] -= 27;
Flag[24] -= 84;
Flag[12] -= 79;
Flag[5] -= 98;
--Flag[6];
Flag[11] ^= 1u;
Flag[8] += 121;
Flag[2] += 70;
Flag[8] ^= 0x20u;
Flag[4] ^= 0x22u;
Flag[24] ^= 0x44u;
Flag[18] += 122;
Flag[20] ^= 0x38u;
Flag[24] -= 113;
Flag[0] -= 111;
Flag[13] ^= 0x58u;
Flag[20] -= 33;
Flag[3] -= 43;
Flag[22] -= 2;
Flag[23] ^= 0x4Cu;
Flag[22] -= 56;
Flag[20] -= 12;
Flag[9] ^= 0x5Du;
Flag[13] ^= 0x57u;
Flag[0] -= 111;
Flag[6] -= 114;
Flag[15] -= 48;
Flag[23] -= 50;
Flag[0] ^= 0x5Du;
Flag[21] += 13;
Flag[2] -= 75;
Flag[10] -= 73;
Flag[7] ^= 0x77u;
Flag[16] += 17;
Flag[14] ^= 0x5Au;
Flag[14] ^= 0x1Fu;
Flag[7] += 25;
Flag[17] -= 35;
Flag[18] ^= 0x75u;
Flag[16] += 71;
Flag[9] -= 76;
Flag[22] -= 56;
Flag[10] ^= 0x41u;
Flag[18] -= 53;
Flag[3] -= 88;
Flag[1] += 60;
Flag[4] -= 125;
Flag[0] += 119;
Flag[3] ^= 0x66u;
Flag[16] += 28;
Flag[1] -= 62;
Flag[2] -= 60;
Flag[21] ^= 0x40u;
Flag[23] -= 66;
Flag[8] -= 15;
Flag[22] -= 14;
Flag[6] -= 45;
Flag[5] ^= 0xDu;
Flag[13] += 70;
Flag[4] ^= 0x57u;
Flag[2] -= 10;
Flag[13] -= 8;
Flag[1] += 78;
Flag[15] ^= 0x12u;
Flag[5] += 20;
Flag[22] ^= 0x15u;
Flag[1] ^= 0x6Au;
Flag[20] ^= 0x75u;
Flag[22] -= 84;
Flag[2] -= 92;
Flag[15] += 98;
Flag[23] -= 48;
Flag[12] += 93;
Flag[4] += 102;
Flag[21] += 79;
Flag[15] ^= 0x4Du;
Flag[17] ^= 0x45u;
Flag[21] += 53;
Flag[15] -= -128;
Flag[0] ^= 0x57u;
Flag[23] -= 51;
Flag[4] -= 59;
Flag[16] -= 104;
Flag[14] += 112;
Flag[15] ^= 0x3Eu;
Flag[14] -= 116;
Flag[24] += 80;
Flag[21] ^= 0x42u;
Flag[0] += 117;
Flag[13] += 36;
Flag[20] += 124;
Flag[10] -= 21;
Flag[5] += 16;
Flag[13] += 31;
Flag[11] -= 15;
Flag[16] -= 118;
Flag[1] -= 97;
Flag[14] -= 42;
Flag[15] += 90;
Flag[9] ^= 0x23u;
Flag[20] += 73;
Flag[12] -= 8;
Flag[21] ^= 0x2Fu;
Flag[15] += 124;
Flag[17] -= 126;
Flag[17] ^= 8u;
Flag[1] += 63;
Flag[20] += 54;
--Flag[9];
Flag[2] -= 11;
Flag[16] -= 110;
Flag[12] ^= 1u;
Flag[9] ^= 0x53u;
Flag[3] -= 97;
Flag[14] -= 76;
Flag[4] ^= 0x6Au;
Flag[6] ^= 0x61u;
Flag[9] ^= 0x34u;
Flag[2] ^= 0xCu;
Flag[11] += 121;
Flag[11] += 112;
Flag[24] += 101;
Flag[10] -= 104;
Flag[20] ^= 0xCu;
Flag[9] ^= 0x6Eu;
Flag[2] ^= 0x64u;
Flag[22] ^= 0xCu;
Flag[5] += 75;
Flag[20] += 88;
Flag[17] ^= 0x16u;
Flag[4] += 72;
Flag[10] -= 112;
Flag[7] ^= 0x50u;
Flag[14] -= 31;
Flag[21] += 10;
Flag[23] -= 64;
Flag[8] -= 114;
Flag[22] ^= 0x5Fu;
Flag[12] -= 44;
Flag[3] += 37;
Flag[15] ^= 0x6Au;
Flag[14] -= 49;
Flag[6] ^= 0x7Au;
Flag[14] += 43;
Flag[8] += 33;
Flag[6] ^= 0x13u;
Flag[17] -= 4;
Flag[3] += 100;
Flag[16] += 101;
Flag[5] += 12;
Flag[21] -= 52;
Flag[9] -= 67;
Flag[18] ^= 0x35u;
Flag[23] -= 102;
Flag[18] ^= 0x3Cu;
Flag[12] -= 121;
Flag[1] ^= 0x68u;
Flag[13] ^= 0x59u;
Flag[14] ^= 0x3Cu;
Flag[13] ^= 0x32u;
Flag[17] ^= 0x71u;
Flag[15] ^= 0x63u;
Flag[8] += 10;
Flag[23] += 10;
Flag[14] ^= 0x4Du;
Flag[17] += 5;
Flag[19] -= 112;
Flag[15] -= 125;
Flag[6] ^= 7u;
Flag[2] += 87;
Flag[9] += 86;
Flag[12] ^= 0x62u;
Flag[9] += 93;
Flag[24] ^= 0x43u;
Flag[0] -= 107;
Flag[20] ^= 0x5Fu;
Flag[5] -= 40;
Flag[0] -= 67;
Flag[15] -= 49;
Flag[12] -= 97;
Flag[7] += 25;
Flag[3] -= 107;
Flag[20] -= 35;
Flag[3] += 41;
Flag[17] += 39;
Flag[4] += 65;
Flag[17] ^= 5u;
Flag[1] ^= 0x1Bu;
Flag[12] += 110;
Flag[22] += 127;
Flag[14] ^= 4u;
Flag[24] ^= 0x4Fu;
Flag[23] += 21;
Flag[3] -= 105;
Flag[12] ^= 0x39u;
Flag[3] -= 15;
Flag[10] += 115;
Flag[7] -= 87;
Flag[15] ^= 0x37u;
Flag[11] += 56;
Flag[3] += 64;
Flag[16] += 43;
Flag[17] += 106;
Flag[2] ^= 0x10u;
Flag[16] ^= 0x65u;
Flag[23] ^= 0x6Eu;
Flag[6] += 89;
Flag[22] += 33;
Flag[22] += 113;
Flag[15] += 28;
Flag[18] ^= 0x48u;
Flag[21] += 31;
Flag[21] -= 107;
Flag[8] ^= 0x13u;
Flag[16] ^= 0x74u;
Flag[19] += 4;
Flag[3] ^= 0xEu;
Flag[0] -= 67;
Flag[16] ^= 0x55u;
Flag[8] ^= 0x40u;
Flag[10] ^= 0x4Au;
Flag[16] ^= 0x16u;
Flag[9] -= 31;
Flag[11] ^= 0x3Fu;
Flag[21] += 61;
Flag[7] -= 59;
Flag[13] ^= 0x4Eu;
Flag[22] -= 41;
Flag[7] += 103;
Flag[4] -= 52;
Flag[20] -= 32;
Flag[24] -= 71;
Flag[2] ^= 0x49u;
Flag[24] -= 92;
Flag[24] ^= 0x6Bu;
Flag[6] -= 54;
Flag[14] += 94;
Flag[7] ^= 0x66u;
Flag[0] += 57;
Flag[9] -= 15;
Flag[7] -= 78;
Flag[5] += 60;
Flag[9] ^= 0x63u;
Flag[23] += 4;
Flag[17] += 99;
Flag[13] ^= 0x6Du;
Flag[20] -= 100;
Flag[12] -= 115;
Flag[9] ^= 0x77u;
Flag[16] += 107;
Flag[1] -= 50;
Flag[7] -= 12;
Flag[19] ^= 0x44u;
Flag[18] ^= 0x21u;
Flag[13] -= 117;
Flag[24] ^= 0x32u;
Flag[4] += 91;
Flag[18] -= 17;
Flag[19] += 66;
Flag[16] -= 29;
Flag[12] ^= 0x4Cu;
Flag[12] += 8;
Flag[17] ^= 0x3Du;
Flag[3] ^= 0x60u;
Flag[5] ^= 0x5Eu;
Flag[0] -= 2;
Flag[20] -= 6;
Flag[12] ^= 0x68u;
Flag[11] -= 108;
Flag[14] -= 49;
Flag[22] -= 74;
Flag[6] -= 101;
Flag[13] ^= 0x22u;
Flag[22] -= 39;
Flag[11] += 32;
Flag[9] -= 44;
Flag[19] -= 56;
Flag[5] ^= 0x36u;
Flag[0] ^= 0x51u;
Flag[21] += 125;
Flag[14] += 78;
Flag[15] -= 99;
Flag[16] -= 24;
Flag[4] ^= 0x32u;
Flag[4] ^= 0x79u;
Flag[7] += 20;
Flag[10] ^= 0x29u;
Flag[21] ^= 0x7Fu;
Flag[23] ^= 0x37u;
Flag[7] += 83;
Flag[1] ^= 0x36u;
Flag[17] ^= 0x7Au;
Flag[3] ^= 0xAu;
Flag[0] ^= 0x6Au;
Flag[20] ^= 0x43u;
Flag[23] ^= 0x70u;
Flag[20] += 73;
Flag[20] += 17;
Flag[22] -= 13;
Flag[20] -= 112;
Flag[10] ^= 0x29u;
Flag[14] ^= 0x7Bu;
Flag[2] ^= 0x76u;
Flag[0] += 105;
Flag[18] -= 76;
Flag[6] ^= 0x21u;
Flag[1] += 88;
Flag[3] ^= 0x74u;
Flag[13] += 29;
Flag[19] -= 102;
Flag[21] ^= 0x36u;
Flag[3] ^= 0x74u;
Flag[19] -= 74;
Flag[24] -= 26;
Flag[20] += 17;
Flag[5] ^= 9u;
Flag[9] += 114;
Flag[5] -= 75;
Flag[9] -= 81;
Flag[12] -= 35;
Flag[11] += 98;
Flag[1] -= 95;
Flag[4] += 68;
Flag[16] -= 92;
Flag[12] -= 60;
Flag[12] ^= 0x4Du;
Flag[8] += 111;
Flag[15] -= 96;
Flag[7] ^= 0x51u;
Flag[9] ^= 0x3Bu;
Flag[12] ^= 0x62u;
Flag[10] -= 13;
Flag[15] -= 19;
Flag[1] ^= 0xFu;
Flag[22] -= -128;
Flag[9] ^= 0x10u;
Flag[22] += 80;
Flag[2] ^= 0x16u;
Flag[17] ^= 0x76u;
Flag[13] -= 48;
Flag[16] ^= 0x53u;
Flag[18] -= 20;
Flag[11] ^= 0x73u;
Flag[5] ^= 0x70u;
Flag[2] -= 70;
Flag[4] ^= 2u;
Flag[11] -= 7;
Flag[16] -= 106;
Flag[11] += 118;
Flag[3] ^= 0x5Au;
Flag[17] ^= 0xEu;
Flag[3] ^= 0x6Eu;
Flag[19] -= 35;
Flag[9] += 43;
Flag[24] += 44;
Flag[18] ^= 0x49u;
Flag[21] += 9;
Flag[5] ^= 0x6Fu;
Flag[9] ^= 0x27u;
Flag[23] -= 38;
Flag[9] -= 23;
Flag[9] ^= 0x14u;
Flag[11] += 78;
Flag[20] ^= 0x43u;
Flag[9] += 114;
Flag[5] += 74;
Flag[12] += 13;
Flag[18] -= 94;
Flag[9] += 12;
Flag[19] -= 95;
Flag[5] ^= 0x4Cu;
Flag[1] -= 8;
Flag[7] ^= 5u;
Flag[1] -= 13;
Flag[6] ^= 0x26u;
Flag[9] -= 46;
Flag[24] += 116;
Flag[20] -= 122;
Flag[20] += 22;
Flag[20] ^= 0x3Bu;
Flag[8] -= 17;
Flag[21] ^= 0xAu;
Flag[24] ^= 0x4Au;
Flag[4] += 9;
Flag[21] += 88;
Flag[9] += 78;
Flag[9] -= 126;
Flag[18] -= 6;
Flag[0] -= 119;
Flag[5] ^= 0x74u;
Flag[24] += 28;
Flag[24] -= 16;
Flag[2] += 120;
Flag[2] ^= 0x1Bu;
Flag[4] ^= 0x20u;
Flag[24] += 5;
Flag[1] += 61;
Flag[20] ^= 0x5Fu;
Flag[19] -= 100;
Flag[23] += 118;
Flag[19] += 72;
Flag[13] += 84;
Flag[16] -= 41;
Flag[2] ^= 0x46u;
Flag[11] ^= 0x3Du;
Flag[14] -= 6;
Flag[5] ^= 0x19u;
Flag[23] ^= 0x28u;
Flag[22] -= 27;
Flag[8] ^= 0x43u;
Flag[9] -= 86;
Flag[1] -= 66;
Flag[17] -= 84;
Flag[3] -= 114;
Flag[4] += 106;
Flag[12] ^= 0x78u;
Flag[16] += 11;
Flag[3] ^= 0x10u;
Flag[7] += 96;
Flag[15] += 98;
Flag[22] ^= 0x42u;
Flag[6] ^= 0x79u;
Flag[1] ^= 0x49u;
Flag[1] += 32;
Flag[21] ^= 0x78u;
Flag[19] ^= 0x27u;
Flag[1] -= 3;
Flag[22] += 107;
Flag[19] += 32;
Flag[5] += 23;
Flag[9] += 106;
Flag[5] += 3;
Flag[6] -= 4;
Flag[11] ^= 0x10u;
Flag[8] ^= 0x74u;
Flag[4] -= 55;
Flag[20] += 106;
Flag[4] += 47;
Flag[23] ^= 0x2Bu;
Flag[5] += 114;
Flag[13] ^= 0x54u;
--Flag[20];
Flag[13] -= 112;
Flag[16] ^= 0x5Fu;
Flag[0] -= 41;
Flag[17] ^= 0xDu;
Flag[0] ^= 0x20u;
Flag[5] += 6;
Flag[20] += 56;
Flag[24] ^= 0x62u;
Flag[18] += 64;
Flag[12] ^= 0x65u;
Flag[3] += 19;
Flag[5] ^= 0x26u;
Flag[18] -= 92;
Flag[22] ^= 9u;
Flag[2] += 21;
Flag[10] -= 68;
Flag[6] += 35;
Flag[22] += 93;
Flag[3] ^= 0x54u;
Flag[1] -= 32;
Flag[8] -= 124;
Flag[11] += 63;
Flag[13] ^= 0x75u;
Flag[5] -= 12;
Flag[7] ^= 0x17u;
Flag[13] += 41;
Flag[19] += 99;
Flag[10] -= 78;
Flag[0] -= 123;
Flag[15] += 23;
Flag[7] -= 9;
++Flag[22];
Flag[21] += 60;
Flag[24] ^= 0x5Fu;
Flag[11] += 64;
Flag[6] ^= 0x4Du;
Flag[1] ^= 0x64u;
Flag[15] += 33;
Flag[16] ^= 0x33u;
Flag[24] += 78;
Flag[8] -= 103;
Flag[11] ^= 0xBu;
Flag[5] ^= 3u;
Flag[3] += 67;
Flag[12] -= 28;
Flag[11] ^= 0x65u;
Flag[12] -= 68;
Flag[11] ^= 0x67u;
Flag[12] += 74;
Flag[10] ^= 0x23u;
Flag[17] += 114;
Flag[18] -= 56;
Flag[0] -= 121;
Flag[14] -= 9;
Flag[1] += 29;
Flag[11] += 2;
Flag[5] ^= 0x55u;
Flag[18] ^= 0x66u;
Flag[14] ^= 0x30u;
Flag[11] -= 22;
Flag[19] ^= 0x5Eu;
Flag[21] += 91;
Flag[14] -= 58;
Flag[10] ^= 0x5Bu;
Flag[13] ^= 0x1Au;
Flag[15] -= 88;
Flag[15] += 104;
Flag[16] -= 63;
Flag[11] ^= 1u;
Flag[12] += 33;
Flag[24] ^= 0x1Eu;
Flag[16] -= 55;
Flag[14] ^= 0x5Eu;
Flag[7] -= 84;
Flag[19] -= -128;
Flag[24] -= 32;
Flag[11] += 100;
Flag[0] ^= 0x10u;
Flag[17] -= 14;
Flag[21] -= 33;
Flag[2] += 40;
Flag[13] += 9;
Flag[16] += 21;
Flag[13] ^= 0x6Du;
Flag[17] -= 64;
Flag[21] += 89;
Flag[16] -= 18;
Flag[16] -= 75;
Flag[19] += 36;
Flag[11] += 72;
Flag[19] ^= 5u;
--Flag[13];
Flag[7] ^= 0x7Fu;
Flag[0] += 37;
Flag[10] -= 31;
Flag[10] ^= 0x70u;
Flag[13] -= 41;
Flag[0] ^= 0x23u;
Flag[8] += 106;
Flag[1] += 108;
Flag[23] ^= 0x1Eu;
Flag[15] ^= 0xAu;
Flag[7] -= 43;
Flag[7] += 19;
Flag[6] ^= 0x27u;
Flag[21] ^= 2u;
Flag[15] -= 9;
Flag[0] ^= 0x7Au;
Flag[8] += 22;
Flag[2] ^= 0x6Fu;
Flag[22] ^= 0x10u;
Flag[5] ^= 0x66u;
Flag[12] -= 89;
Flag[11] -= 112;
Flag[13] -= 60;
Flag[23] ^= 0x14u;
Flag[5] += 5;
Flag[10] ^= 0x4Eu;
Flag[5] += 112;
Flag[0] += 86;
Flag[10] += 41;
Flag[21] += 28;
Flag[13] ^= 0x44u;
Flag[6] -= 20;
Flag[7] -= 101;
Flag[6] -= 102;
Flag[6] ^= 0x4Eu;
Flag[20] += 87;
Flag[6] += 24;
Flag[10] ^= 0xDu;
Flag[14] ^= 0x44u;
Flag[6] += 61;
Flag[15] ^= 0x4Fu;
Flag[24] += 47;
Flag[10] -= 113;
Flag[16] ^= 0x1Au;
Flag[23] ^= 0x2Cu;
Flag[22] -= -128;
Flag[1] -= -128;
Flag[1] += 47;
Flag[2] -= 127;
Flag[4] += 35;
Flag[11] ^= 0x6Eu;
Flag[2] -= 26;
Flag[4] += 83;
Flag[3] += 117;
Flag[4] -= 61;
Flag[9] -= 36;
Flag[13] ^= 0x22u;
Flag[1] -= 18;
Flag[15] -= 102;
Flag[18] ^= 0x31u;
Flag[22] -= 62;
Flag[2] -= 8;
Flag[18] -= 17;
Flag[1] += 123;
Flag[24] += 101;
Flag[20] -= 10;
Flag[0] += 96;
Flag[19] -= 114;
Flag[22] ^= 0x55u;
Flag[1] -= 78;
Flag[23] -= 22;
Flag[14] += 11;
Flag[19] ^= 0x62u;
Flag[21] -= 26;
Flag[23] ^= 0x56u;
Flag[11] ^= 0x7Cu;
Flag[16] += 93;
Flag[4] -= -128;
Flag[8] ^= 0x77u;
Flag[7] += 35;
Flag[9] -= 57;
Flag[21] += 94;
Flag[18] ^= 0x57u;
Flag[11] ^= 0x23u;
Flag[7] += 108;
Flag[8] += 6;
Flag[8] -= 79;
Flag[12] ^= 0x64u;
Flag[3] -= 58;
Flag[16] -= 3;
--Flag[11];
Flag[0] += 104;
Flag[16] += 14;
Flag[22] += 38;
Flag[1] ^= 0x65u;
Flag[11] += 64;
Flag[23] ^= 0x5Du;
Flag[24] ^= 0x58u;
Flag[5] -= 117;
Flag[8] += 65;
Flag[4] += 118;
Flag[13] ^= 0x6Au;
Flag[21] ^= 0x53u;
Flag[5] -= 83;
Flag[1] ^= 0x4Eu;
Flag[20] -= 71;
Flag[14] -= 21;
Flag[23] ^= 0x10u;
Flag[10] -= 57;
Flag[1] ^= 4u;
Flag[23] -= 25;
Flag[18] -= 74;
Flag[23] += 70;
Flag[8] ^= 0x70u;
Flag[24] -= 26;
Flag[5] -= 22;
Flag[15] += 33;
Flag[15] ^= 0x24u;
Flag[11] += 64;
Flag[2] ^= 0x6Au;
Flag[20] ^= 0x5Fu;
Flag[10] ^= 0x60u;
Flag[1] += 121;
Flag[8] += 48;
Flag[24] ^= 0x19u;
Flag[7] -= 71;
Flag[10] += 54;
Flag[21] -= 76;
Flag[13] += 72;
Flag[10] -= 12;
Flag[2] += 81;
Flag[2] += 66;
Flag[2] ^= 0x50u;
Flag[11] += 97;
Flag[6] += 48;
Flag[17] ^= 0x22u;
Flag[16] ^= 0x51u;
Flag[20] -= 16;
Flag[7] -= 30;
Flag[20] ^= 0x55u;
Flag[10] += 116;
Flag[16] -= 14;
Flag[14] -= 12;
Flag[12] ^= 0x7Du;
Flag[14] ^= 0x44u;
Flag[0] ^= 0x3Bu;
Flag[22] ^= 0x3Cu;
Flag[19] ^= 0x2Eu;
Flag[9] ^= 0x5Eu;
Flag[15] ^= 0x2Fu;
Flag[22] += 109;
Flag[16] ^= 0x6Eu;
Flag[22] += 23;
Flag[17] -= 96;
Flag[13] ^= 0x7Du;
Flag[4] -= 26;
Flag[6] ^= 0x74u;
Flag[9] += 53;
Flag[0] += 25;
Flag[15] ^= 0x66u;
Flag[4] += 74;
Flag[20] += 113;
Flag[23] -= 19;
Flag[6] ^= 0x6Au;
Flag[23] ^= 0x24u;
Flag[8] ^= 0x7Au;
Flag[13] += 32;
Flag[11] -= 109;
Flag[19] ^= 0x51u;
Flag[6] ^= 0x5Du;
Flag[15] += 86;
Flag[13] -= 102;
Flag[15] ^= 0x75u;
Flag[22] += 125;
Flag[21] += 17;
Flag[16] ^= 1u;
Flag[24] ^= 0x66u;
Flag[3] ^= 0x35u;
Flag[18] += 91;
Flag[1] -= 122;
Flag[0] ^= 0x43u;
Flag[7] += 82;
Flag[23] += 10;
Flag[4] ^= 0x1Cu;
Flag[14] ^= 0x5Au;
Flag[1] += 82;
Flag[20] += 38;
Flag[19] += 80;
Flag[7] ^= 0x7Au;
Flag[2] ^= 0x19u;
Flag[16] ^= 0x74u;
Flag[21] ^= 0x6Cu;
Flag[15] -= 104;
Flag[19] += 40;
Flag[0] ^= 0x12u;
Flag[19] += 57;
Flag[6] += 114;
Flag[11] ^= 0x21u;
Flag[2] -= 53;
Flag[3] -= 11;
Flag[21] += 27;
Flag[16] += 5;
Flag[9] += 112;
Flag[13] += 119;
Flag[4] ^= 0x3Bu;
Flag[1] -= 113;
Flag[3] ^= 0x2Du;
Flag[15] ^= 0x77u;
Flag[11] += 18;
Flag[5] -= 127;
Flag[9] -= 48;
Flag[9] += 81;
Flag[3] -= 106;
Flag[21] += 28;
Flag[19] += 36;
Flag[10] -= 81;
Flag[16] -= 36;
Flag[15] -= 100;
Flag[9] += 17;
Flag[20] -= 79;
Flag[4] += 28;
Flag[9] -= 34;
Flag[0] ^= 0x64u;
Flag[1] -= 50;
Flag[4] += 39;
Flag[7] += 42;
Flag[3] -= 102;
Flag[16] -= 121;
Flag[14] -= 20;
Flag[16] ^= 0x31u;
Flag[19] += 82;
Flag[3] -= 104;
Flag[23] += 12;
Flag[12] += 18;
Flag[7] += 31;
Flag[4] += 42;
Flag[6] -= 81;
Flag[18] -= 44;
Flag[4] ^= 0x36u;
Flag[15] ^= 0x6Cu;
Flag[16] ^= 0x78u;
Flag[1] += 68;
Flag[6] ^= 0x7Fu;
Flag[0] ^= 0x54u;
Flag[24] -= 105;
Flag[3] ^= 0x57u;
Flag[1] ^= 0x4Fu;
Flag[18] ^= 0x12u;
Flag[6] -= 100;
Flag[8] -= 22;
Flag[2] += 120;
Flag[4] += 115;
Flag[17] ^= 0x2Bu;
Flag[11] -= 47;
Flag[10] ^= 0x4Du;
Flag[4] -= 43;
Flag[3] ^= 0x69u;
Flag[6] ^= 0xEu;
Flag[2] -= 28;
Flag[2] -= 106;
Flag[20] ^= 0x26u;
Flag[11] ^= 8u;
Flag[22] ^= 0x39u;
Flag[17] -= 48;
Flag[22] += 95;
Flag[11] -= 95;
Flag[21] ^= 0x58u;
Flag[8] -= 4;
Flag[11] ^= 0x36u;
Flag[15] += 110;
Flag[1] += 90;
Flag[7] += 65;
Flag[12] += 93;
Flag[13] ^= 0x1Fu;
Flag[15] -= 89;
Flag[17] ^= 0x75u;
Flag[21] -= 72;
Flag[23] ^= 0x57u;
Flag[16] += 60;
Flag[9] -= 13;
Flag[14] ^= 0x25u;
Flag[3] ^= 0x42u;
Flag[5] -= 30;
Flag[11] ^= 0x2Cu;
Flag[2] += 56;
Flag[15] += 114;
Flag[21] -= 111;
Flag[19] -= 2;
Flag[14] -= 12;
Flag[5] -= 28;
Flag[9] ^= 0x40u;
Flag[11] += 111;
Flag[7] += 82;
Flag[8] ^= 0x3Eu;
Flag[22] -= 83;
Flag[12] += 67;
Flag[12] ^= 0x16u;
Flag[6] ^= 0x57u;
Flag[19] -= 37;
Flag[7] ^= 0x72u;
Flag[20] -= 35;
Flag[11] ^= 0x79u;
Flag[5] -= 19;
Flag[12] += 18;
Flag[14] ^= 0x35u;
Flag[8] ^= 0x6Bu;
Flag[3] ^= 0xFu;
Flag[15] ^= 0x57u;
Flag[7] -= 24;
Flag[5] ^= 0x3Eu;
Flag[20] -= 108;
Flag[10] += 42;
Flag[2] += 43;
Flag[19] ^= 0x59u;
Flag[11] -= 43;
--Flag[19];
Flag[21] ^= 5u;
Flag[16] ^= 0xEu;
Flag[10] -= 93;
Flag[13] -= 45;
Flag[7] ^= 0x58u;
Flag[22] += 54;
Flag[17] ^= 0x27u;
Flag[17] += 100;
Flag[2] ^= 0x47u;
Flag[5] ^= 7u;
Flag[6] -= 76;
Flag[12] ^= 0x4Au;
Flag[6] ^= 0x16u;
Flag[22] += 86;
Flag[19] -= 6;
Flag[11] ^= 0x44u;
Flag[21] ^= 0x12u;
Flag[13] -= 115;
Flag[20] -= 70;
Flag[21] -= 41;
Flag[21] ^= 0x4Fu;
Flag[10] -= 120;
Flag[24] += 107;
Flag[17] ^= 0x4Cu;
Flag[19] -= 26;
Flag[4] ^= 0x71u;
Flag[4] -= 45;
Flag[4] += 38;
Flag[3] -= 28;
Flag[4] -= 122;
Flag[12] += 82;
Flag[24] ^= 0x2Eu;
Flag[16] ^= 0x42u;
Flag[20] ^= 0x65u;
Flag[21] ^= 0x6Bu;
Flag[23] -= 89;
Flag[22] ^= 0xFu;
Flag[6] ^= 4u;
Flag[22] ^= 0x4Du;
Flag[20] -= 52;
Flag[0] += 45;
Flag[11] -= 59;
Flag[7] -= 13;
Flag[14] ^= 0x3Bu;
Flag[17] ^= 0x7Bu;
Flag[22] ^= 0x2Au;
Flag[22] += 77;
Flag[24] ^= 0x58u;
Flag[19] ^= 0x21u;
Flag[12] += 41;
Flag[19] += 114;
Flag[20] -= 23;
Flag[15] -= 46;
--Flag[18];
Flag[21] -= 71;
Flag[12] -= 35;
Flag[21] -= 32;
Flag[19] += 19;
Flag[9] -= 67;
Flag[8] += 124;
Flag[4] += 53;
Flag[21] -= 60;
Flag[7] += 85;
Flag[3] -= 13;
Flag[1] += 36;
Flag[13] ^= 0x5Du;
Flag[15] ^= 0x6Du;
Flag[12] += 41;
Flag[0] += 36;
Flag[18] -= 51;
Flag[15] += 99;
Flag[20] += 60;
Flag[16] ^= 0x37u;
Flag[21] ^= 0x76u;
Flag[4] ^= 0x27u;
Flag[18] += 11;
Flag[1] ^= 0x2Fu;
Flag[12] -= 73;
Flag[4] ^= 0x18u;
Flag[3] ^= 0x3Eu;
Flag[8] -= 74;
Flag[12] += 27;
Flag[15] += 40;
Flag[13] ^= 0x59u;
Flag[12] -= 50;
Flag[2] += 8;
Flag[8] ^= 0x74u;
Flag[17] += 110;
Flag[2] += 20;
Flag[5] -= 14;
Flag[10] += 79;
Flag[12] ^= 0x72u;
Flag[5] += 95;
Flag[21] ^= 0x6Au;
Flag[22] -= 47;
Flag[13] += 72;
Flag[4] ^= 0x3Au;
Flag[14] += 88;
Flag[4] -= 78;
Flag[9] += 113;
Flag[8] ^= 0x63u;
Flag[12] -= 27;
Flag[13] ^= 0x3Du;
Flag[1] += 68;
Flag[6] += 48;
Flag[24] ^= 0x17u;
Flag[0] -= 127;
Flag[18] -= 78;
Flag[5] ^= 0x75u;
Flag[4] += 94;
Flag[18] += 9;
Flag[4] += 74;
Flag[18] ^= 0x19u;
Flag[15] ^= 0x31u;
Flag[3] += 126;
Flag[13] -= 113;
Flag[20] ^= 0x2Eu;
Flag[23] ^= 0x5Fu;
Flag[15] -= 89;
Flag[22] -= 68;
Flag[9] ^= 0x70u;
Flag[11] -= 39;
Flag[13] ^= 0xCu;
Flag[2] += 77;
Flag[12] += 18;
Flag[4] += 55;
Flag[17] += 105;
Flag[18] += 53;
Flag[4] ^= 0x78u;
Flag[22] += 91;
Flag[22] ^= 0x54u;
Flag[7] -= 118;
Flag[14] ^= 0x78u;
Flag[15] += 86;
Flag[23] += 68;
Flag[0] -= 16;
Flag[12] += 101;
Flag[1] += 20;
Flag[19] ^= 0x17u;
Flag[15] ^= 0x77u;
Flag[8] -= 49;
Flag[20] -= 55;
Flag[12] ^= 0x61u;
Flag[18] -= 49;
Flag[11] -= 67;
Flag[4] -= 55;
Flag[4] += 14;
Flag[23] += 29;
Flag[19] ^= 0x48u;
Flag[17] += 4;
Flag[20] += 107;
Flag[14] += 29;
Flag[5] += 38;
Flag[22] -= 30;
Flag[14] ^= 0x14u;
Flag[22] -= 69;
Flag[15] -= 120;
Flag[9] -= 5;
Flag[3] ^= 6u;
Flag[22] += 39;
Flag[13] += 47;
Flag[9] ^= 0x6Cu;
Flag[18] += 111;
Flag[4] -= 94;
Flag[8] -= 93;
Flag[20] += 56;
Flag[22] ^= 0x6Bu;
Flag[21] ^= 0x6Bu;
Flag[6] -= 73;
Flag[12] ^= 0x26u;
Flag[10] ^= 0x3Au;
Flag[11] += 11;
Flag[17] -= 60;
Flag[22] += 92;
Flag[12] += 71;
Flag[8] ^= 0x68u;
Flag[15] += 112;
Flag[24] += 72;
Flag[13] -= 116;
Flag[1] ^= 0x3Cu;
Flag[13] -= 86;
Flag[12] ^= 0x23u;
Flag[3] += 7;
Flag[16] ^= 0x56u;
Flag[19] ^= 0x7Fu;
Flag[18] ^= 0x3Du;
Flag[3] += 21;
Flag[22] ^= 0x38u;
Flag[21] += 95;
Flag[22] -= 25;
Flag[23] += 114;
Flag[8] ^= 0x50u;
Flag[1] -= 26;
Flag[20] -= 65;
Flag[19] ^= 0x7Eu;
Flag[24] -= 102;
Flag[16] += 12;
Flag[8] += 27;
Flag[1] ^= 0x77u;
Flag[3] += 107;
Flag[2] -= 31;
Flag[3] -= 22;
Flag[6] -= 62;
Flag[13] -= 72;
Flag[14] -= 115;
Flag[13] ^= 0x6Bu;
Flag[10] += 87;
Flag[20] += 71;
Flag[2] ^= 0x34u;
Flag[18] ^= 0x68u;
Flag[7] ^= 0x7Eu;
Flag[18] ^= 1u;
Flag[5] ^= 0x45u;
Flag[15] += 19;
Flag[18] -= 88;
Flag[4] -= 86;
Flag[17] ^= 0x55u;
Flag[9] ^= 0x3Eu;
Flag[17] -= 4;
Flag[24] += 79;
Flag[0] -= 17;
Flag[4] += 56;
Flag[8] += 88;
Flag[6] ^= 0x6Du;
Flag[14] -= 58;
Flag[5] ^= 0x75u;
Flag[7] ^= 0x13u;
Flag[10] -= 38;
Flag[10] += 13;
Flag[7] ^= 0x3Du;
Flag[20] -= 77;
Flag[13] -= 55;
Flag[19] ^= 0x39u;
Flag[14] += 60;
Flag[11] ^= 0x3Bu;
Flag[21] ^= 0xBu;
Flag[14] ^= 0x29u;
Flag[17] -= 95;
Flag[0] += 118;
Flag[16] -= 107;
Flag[9] += 25;
Flag[12] ^= 0x4Au;
Flag[3] -= 28;
Flag[4] ^= 0x6Cu;
Flag[15] += 97;
Flag[10] += 126;
Flag[8] -= 54;
Flag[22] ^= 0x6Au;
Flag[19] -= 52;
Flag[23] -= 56;
Flag[22] ^= 0x2Fu;
Flag[10] -= 17;
Flag[19] ^= 0x50u;
Flag[24] ^= 0x10u;
Flag[18] ^= 0x71u;
Flag[11] ^= 5u;
Flag[19] += 124;
Flag[5] += 12;
Flag[17] += 62;
Flag[5] ^= 0x5Bu;
Flag[16] ^= 7u;
Flag[14] += 6;
Flag[9] ^= 0x34u;
Flag[21] += 14;
Flag[22] += 108;
Flag[20] -= 105;
Flag[0] -= -128;
Flag[23] ^= 0xEu;
Flag[6] += 88;
Flag[22] += 78;
Flag[23] ^= 0x70u;
Flag[5] += 11;
Flag[19] ^= 0x80u;
Flag[15] += 25;
Flag[2] += 125;
Flag[10] ^= 8u;
Flag[20] += 18;
Flag[13] -= 51;
Flag[7] += 62;
Flag[9] -= 10;
Flag[1] ^= 0xEu;
Flag[9] -= 61;
Flag[1] += 21;
Flag[21] += 37;
Flag[12] ^= 0x3Du;
Flag[2] -= 111;
Flag[1] -= 70;
Flag[12] += 47;
Flag[18] ^= 0x72u;
Flag[0] ^= 0x53u;
Flag[17] -= 22;
Flag[3] += 123;
Flag[13] -= 36;
Flag[12] += 108;
Flag[21] += 122;
Flag[17] ^= 0x3Au;
Flag[24] -= 102;
Flag[8] ^= 0x28u;
Flag[6] += 13;
Flag[24] += 19;
Flag[19] ^= 0x15u;
Flag[4] ^= 0x17u;
Flag[1] += 126;
Flag[16] += 36;
Flag[7] -= 61;
Flag[5] += 67;
Flag[15] += 41;
Flag[21] += 109;
Flag[4] -= 14;
Flag[19] -= 126;
Flag[24] -= 115;
Flag[21] ^= 0x7Au;
Flag[5] -= 100;
Flag[18] -= 48;
Flag[11] -= 53;
Flag[3] += 103;
Flag[7] -= 122;
Flag[11] ^= 0x48u;
Flag[20] ^= 0x38u;
Flag[7] ^= 0x6Au;
Flag[1] -= 18;
Flag[4] += 24;
Flag[13] -= 47;
Flag[7] -= 16;
Flag[23] ^= 0x23u;
Flag[15] -= 24;
Flag[11] -= 120;
Flag[2] ^= 0x3Cu;
Flag[13] ^= 0x77u;
Flag[1] ^= 0x4Eu;
Flag[11] ^= 0x2Bu;
Flag[5] -= 117;
Flag[3] += 99;
Flag[13] ^= 0x3Bu;
Flag[14] -= 69;
Flag[4] += 49;
Flag[15] -= 93;
Flag[13] ^= 0x16u;
Flag[15] += 20;
Flag[6] ^= 0x75u;
Flag[24] ^= 0x2Fu;
Flag[12] -= 70;
Flag[7] += 115;
Flag[13] ^= 0x4Au;
Flag[13] += 53;
Flag[18] ^= 0x54u;
Flag[3] += 120;
Flag[14] -= 77;
Flag[1] += 4;
Flag[19] -= 125;
Flag[0] += 122;
Flag[14] ^= 0x72u;
Flag[22] -= 123;
Flag[16] -= 23;
Flag[2] -= 27;
Flag[16] -= 90;
Flag[5] += 35;
Flag[19] ^= 0xFu;
Flag[15] -= 67;
Flag[2] ^= 0x27u;
Flag[16] += 101;
Flag[16] -= 8;
Flag[14] -= 119;
Flag[16] -= 91;
Flag[9] += 61;
Flag[3] ^= 0x44u;
Flag[17] += 125;
Flag[2] -= 45;
Flag[14] -= 42;
Flag[17] += 98;
Flag[2] ^= 5u;
Flag[24] ^= 0x3Bu;
Flag[4] += 97;
Flag[24] ^= 0x69u;
Flag[11] += 59;
Flag[22] += 121;
Flag[22] ^= 2u;
Flag[16] ^= 0x1Eu;
Flag[8] += 13;
Flag[8] += 121;
Flag[23] ^= 0x71u;
Flag[7] ^= 0x59u;
Flag[11] += 5;
Flag[20] -= 105;
Flag[4] ^= 0x50u;
Flag[3] -= 94;
Flag[2] += 51;
Flag[10] += 57;
Flag[3] += 60;
Flag[13] -= 78;
Flag[6] -= 42;
Flag[4] += 91;
Flag[17] ^= 0x61u;
Flag[13] += 26;
Flag[11] += 86;
Flag[17] ^= 0x69u;
Flag[2] += 119;
Flag[10] += 5;
Flag[23] ^= 0x58u;
Flag[18] += 46;
Flag[24] += 123;
Flag[1] ^= 0x3Cu;
Flag[20] ^= 0x79u;
Flag[1] += 124;
Flag[0] -= 116;
Flag[6] -= 46;
Flag[7] += 94;
Flag[21] -= 106;
Flag[21] ^= 0x42u;
Flag[13] -= 87;
Flag[23] ^= 0x1Bu;
Flag[4] += 20;
Flag[15] -= 45;
Flag[0] += 7;
Flag[3] -= 84;
Flag[14] -= 41;
Flag[7] -= 76;
Flag[21] += 106;
Flag[18] += 11;
Flag[7] ^= 0x6Cu;
Flag[12] ^= 0xBu;
Flag[24] ^= 0x5Cu;
Flag[9] ^= 0x3Du;
Flag[11] -= 89;
Flag[21] += 6;
Flag[17] ^= 0x63u;
Flag[7] -= 99;
Flag[0] ^= 0xFu;
Flag[6] -= 119;
Flag[17] += 121;
Flag[13] += 38;
Flag[5] ^= 0x25u;
Flag[18] ^= 0x45u;
Flag[0] ^= 6u;
Flag[4] -= 31;
Flag[11] -= 74;
Flag[20] += 60;
Flag[20] ^= 0x20u;
Flag[0] -= 90;
Flag[11] += 15;
Flag[0] -= 49;
Flag[9] += 56;
Flag[7] -= 5;
Flag[6] += 97;
Flag[17] ^= 0x60u;
Flag[14] += 90;
Flag[21] ^= 0x5Du;
Flag[18] -= 3;
Flag[7] -= 24;
Flag[8] ^= 0x77u;
Flag[11] ^= 0x24u;
Flag[18] -= 86;
Flag[8] += 113;
Flag[5] -= 79;
Flag[22] -= 29;
Flag[8] += 88;
Flag[9] += 28;
Flag[4] -= 61;
Flag[13] -= 9;
Flag[4] ^= 0x5Au;
Flag[18] -= 74;
Flag[15] ^= 0x6Du;
Flag[13] -= 68;
Flag[9] += 35;
Flag[1] -= 88;
Flag[3] -= 94;
Flag[0] += 112;
Flag[12] += 57;
Flag[20] ^= 6u;
Flag[16] += 29;
Flag[7] += 70;
Flag[18] -= 114;
Flag[20] -= 78;
Flag[21] -= 57;
Flag[20] += 89;
Flag[18] ^= 0x52u;
Flag[16] ^= 8u;
Flag[6] ^= 0x38u;
Flag[2] += 117;
Flag[11] ^= 0x1Au;
Flag[20] -= 25;
Flag[20] ^= 0x34u;
Flag[17] ^= 0x25u;
Flag[4] -= 9;
Flag[13] -= 116;
Flag[22] -= 4;
Flag[10] ^= 0x51u;
Flag[9] -= 114;
Flag[6] += 34;
Flag[9] ^= 0x5Fu;
Flag[13] ^= 0x6Au;
Flag[12] += 116;
Flag[15] ^= 0x1Cu;
Flag[4] ^= 0x30u;
Flag[0] += 13;
Flag[4] ^= 1u;
Flag[15] += 89;
Flag[10] ^= 0x65u;
Flag[20] ^= 0x76u;
Flag[5] ^= 6u;
Flag[19] -= 49;
Flag[6] ^= 0x68u;
Flag[1] += 33;
Flag[24] ^= 9u;
Flag[17] += 28;
Flag[20] -= 126;
Flag[9] += 15;
Flag[22] -= 2;
Flag[2] += 97;
Flag[7] += 33;
Flag[8] -= 22;
Flag[17] += 4;
Flag[22] += 72;
Flag[5] += 68;
Flag[5] ^= 0x44u;
Flag[20] ^= 0x53u;
Flag[6] -= 80;
Flag[2] ^= 0x60u;
Flag[11] += 63;
Flag[10] ^= 0x48u;
Flag[21] -= 122;
Flag[15] += 48;
Flag[21] += 47;
Flag[10] += 66;
Flag[2] -= 60;
Flag[2] += 110;
Flag[11] += 51;
Flag[7] -= 19;
Flag[17] ^= 0x38u;
Flag[1] ^= 0x15u;
Flag[3] -= 57;
Flag[17] += 109;
Flag[15] -= 125;
Flag[24] -= 20;
Flag[22] -= 112;
Flag[24] -= 41;
Flag[5] += 11;
Flag[18] += 110;
Flag[14] -= 90;
Flag[9] ^= 0x4Bu;
Flag[22] += 48;
Flag[12] -= 76;
Flag[18] += 22;
Flag[13] ^= 0x49u;
Flag[7] -= 97;
Flag[2] -= 3;
Flag[20] ^= 0x21u;
Flag[13] -= 78;
Flag[15] ^= 0x2Au;
Flag[9] -= 35;
Flag[20] += 93;
Flag[6] ^= 0x44u;
Flag[0] -= 57;
Flag[10] += 89;
Flag[2] ^= 0x33u;
Flag[6] -= 61;
Flag[3] ^= 0x4Fu;
Flag[24] += 84;
Flag[19] += 58;
Flag[20] ^= 0x56u;
Flag[2] -= 70;
Flag[15] += 59;
Flag[19] -= 7;
Flag[17] ^= 0x1Cu;
++Flag[22];
Flag[15] ^= 0x65u;
Flag[9] -= 35;
Flag[0] += 100;
Flag[3] += 106;
Flag[13] += 4;
Flag[14] -= 7;
Flag[18] += 60;
Flag[7] += 25;
Flag[24] ^= 0xAu;
Flag[21] += 8;
Flag[16] += 54;
Flag[11] ^= 0x62u;
Flag[15] ^= 0x72u;
Flag[14] ^= 0x7Au;
Flag[12] += 116;
Flag[13] -= 8;
Flag[22] ^= 0x6Du;
Flag[17] += 5;
Flag[8] -= 31;
Flag[14] -= 14;
Flag[12] += 111;
Flag[12] -= 68;
Flag[14] -= 114;
Flag[17] ^= 0x60u;
Flag[0] += 124;
Flag[0] ^= 0x10u;
Flag[15] += 110;
Flag[13] ^= 0x54u;
Flag[21] -= 58;
Flag[12] ^= 0x70u;
Flag[7] ^= 0x33u;
Flag[6] ^= 0x5Au;
Flag[20] -= 25;
Flag[11] ^= 0x17u;
Flag[2] -= 81;
Flag[13] += 122;
Flag[0] ^= 0x61u;
Flag[4] -= 126;
Flag[16] += 84;
Flag[7] -= 95;
Flag[6] += 59;
Flag[14] += 45;
Flag[2] += 100;
Flag[24] ^= 0x70u;
Flag[16] -= 88;
Flag[0] += 72;
Flag[8] ^= 0x4Cu;
Flag[2] ^= 0x63u;
Flag[9] ^= 0x35u;
Flag[1] += 125;
Flag[17] ^= 5u;
Flag[6] -= 15;
Flag[5] += 61;
Flag[16] -= 39;
Flag[24] += 23;
Flag[12] += 64;
Flag[24] += 102;
Flag[15] -= 77;
Flag[4] ^= 0x4Au;
Flag[2] += 36;
Flag[9] -= 73;
Flag[23] ^= 0x33u;
Flag[0] ^= 0x62u;
Flag[2] ^= 0x62u;
Flag[20] -= 120;
Flag[2] -= 123;
Flag[9] -= 30;
Flag[11] += 73;
Flag[10] ^= 0x7Eu;
Flag[17] ^= 0x17u;
Flag[21] -= 119;
Flag[15] ^= 0x72u;
Flag[11] += 30;
Flag[1] ^= 0x2Bu;
Flag[5] ^= 0x32u;
Flag[17] += 77;
Flag[0] += 51;
Flag[23] ^= 0x78u;
Flag[23] ^= 0x2Eu;
Flag[19] -= 97;
Flag[3] -= 117;
Flag[6] ^= 0x7Du;
Flag[5] ^= 0x46u;
Flag[17] += 49;
Flag[2] ^= 0x4Du;
Flag[11] -= 31;
Flag[14] -= 127;
Flag[17] += 31;
Flag[15] ^= 0x6Eu;
Flag[16] += 12;
Flag[11] += 66;
Flag[15] ^= 0x2Du;
Flag[20] += 28;
Flag[6] ^= 0x50u;
Flag[2] ^= 0x25u;
Flag[24] -= 116;
Flag[19] ^= 0x67u;
Flag[1] ^= 0x37u;
Flag[24] -= 36;
Flag[6] -= 74;
Flag[8] ^= 0x37u;
Flag[11] += 45;
Flag[21] ^= 0x69u;
Flag[13] -= 106;
++Flag[5];
Flag[1] += 120;
Flag[12] ^= 0x2Cu;
Flag[24] += 85;
Flag[2] ^= 0x4Bu;
Flag[12] -= 54;
Flag[0] -= 38;
Flag[13] ^= 0x40u;
Flag[18] -= 86;
Flag[19] -= 17;
Flag[15] += 64;
Flag[9] -= 21;
Flag[20] -= 89;
Flag[4] -= 57;
Flag[20] += 81;
Flag[10] ^= 0x26u;
Flag[6] -= 25;
Flag[23] -= 53;
Flag[2] ^= 0x29u;
Flag[3] ^= 0x37u;
Flag[16] -= 19;
Flag[0] -= 57;
Flag[21] ^= 0x1Bu;
Flag[5] ^= 0x10u;
Flag[7] -= 40;
Flag[14] -= 47;
Flag[19] += 54;
Flag[22] -= 54;
Flag[16] -= 97;
Flag[16] -= 3;
Flag[13] += 41;
Flag[2] += 122;
Flag[1] ^= 0x33u;
Flag[12] ^= 0x16u;
Flag[9] += 125;
Flag[23] ^= 0x13u;
Flag[8] -= 63;
Flag[23] -= 109;
Flag[12] += 41;
Flag[2] -= 84;
Flag[2] -= 46;
Flag[5] ^= 0x72u;
Flag[2] -= 55;
Flag[12] ^= 0x5Eu;
Flag[12] -= 120;
Flag[12] += 126;
Flag[10] -= 55;
Flag[0] += 92;
Flag[18] += 5;
Flag[20] -= 58;
Flag[1] -= 74;
Flag[5] += 33;
Flag[6] ^= 0x3Cu;
Flag[14] ^= 0x17u;
Flag[3] -= 77;
Flag[13] -= 33;
Flag[15] += 52;
Flag[24] ^= 0x46u;
Flag[11] ^= 0x66u;
Flag[11] ^= 0xEu;
Flag[12] -= 120;
Flag[18] -= 36;
Flag[3] -= 108;
Flag[1] += 54;
Flag[0] += 118;
Flag[14] ^= 0x49u;
Flag[1] -= 31;
Flag[13] ^= 0x6Au;
Flag[11] += 44;
Flag[11] -= 38;
Flag[2] += 96;
Flag[1] -= 82;
Flag[11] ^= 0x47u;
Flag[14] -= 60;
Flag[7] += 33;
Flag[23] -= 99;
Flag[1] += 19;
Flag[24] ^= 0x31u;
Flag[9] ^= 0x4Au;
Flag[11] -= 20;
Flag[14] ^= 0x4Fu;
Flag[9] ^= 0x4Au;
Flag[17] -= 65;
Flag[0] += 114;
Flag[4] += 12;
Flag[19] += 2;
Flag[20] -= 51;
Flag[0] += 122;
Flag[8] += 7;
Flag[10] ^= 0x1Eu;
Flag[2] += 72;
Flag[14] ^= 1u;
Flag[14] += 87;
Flag[16] ^= 0x30u;
Flag[1] += 85;
Flag[20] += 28;
Flag[7] -= 25;
Flag[5] -= 18;
Flag[19] += 30;
Flag[10] ^= 0x64u;
Flag[20] ^= 0x35u;
Flag[17] += 103;
Flag[1] += 90;
Flag[24] ^= 0x3Fu;
Flag[10] += 62;
Flag[15] += 22;
Flag[10] ^= 0x22u;
Flag[5] -= 12;
Flag[22] += 51;
Flag[22] += 27;
Flag[20] ^= 0x29u;
Flag[15] ^= 0x76u;
Flag[24] -= 86;
Flag[22] -= 23;
Flag[12] -= 112;
Flag[22] ^= 0x12u;
Flag[15] -= 97;
Flag[13] ^= 0x7Eu;
Flag[15] += 31;
Flag[2] -= 38;
Flag[7] += 125;
Flag[5] ^= 0x70u;
Flag[24] += 99;
Flag[8] -= 55;
Flag[3] += 31;
Flag[24] ^= 7u;
Flag[22] ^= 4u;
Flag[18] += 57;
Flag[21] ^= 0x3Bu;
Flag[9] -= 99;
Flag[9] -= 90;
Flag[16] += 113;
Flag[24] += 82;
Flag[2] ^= 0x18u;
Flag[24] -= 23;
Flag[4] -= 80;
Flag[21] ^= 0x3Au;
Flag[24] ^= 0x6Eu;
Flag[23] += 85;
Flag[15] -= 114;
Flag[10] -= 26;
Flag[0] ^= 0x36u;
Flag[12] ^= 0x78u;
Flag[9] -= 78;
Flag[5] -= 14;
Flag[9] += 8;
Flag[10] ^= 0x6Cu;
Flag[1] ^= 0x2Eu;
Flag[6] += 57;
Flag[6] += 48;
Flag[18] -= 94;
Flag[22] += 30;
Flag[6] -= 22;
Flag[17] -= 44;
Flag[14] ^= 0x14u;
Flag[24] += 30;
Flag[21] ^= 0x5Du;
Flag[12] += 103;
Flag[16] ^= 0x7Du;
Flag[18] -= 79;
Flag[12] ^= 0x45u;
Flag[11] += 51;
Flag[4] ^= 0x59u;
Flag[7] -= 53;
Flag[13] -= 123;
Flag[6] -= 31;
Flag[11] ^= 0x1Eu;
Flag[8] -= 13;
Flag[4] += 48;
Flag[24] -= 82;
Flag[17] -= 35;
Flag[17] ^= 0x14u;
Flag[4] -= 109;
Flag[12] += 109;
Flag[18] ^= 0x46u;
Flag[3] ^= 0x12u;
Flag[23] ^= 6u;
Flag[7] -= 24;
Flag[17] -= 69;
Flag[7] -= 118;
Flag[23] ^= 0x4Bu;
Flag[5] += 7;
Flag[15] ^= 0x65u;
Flag[20] += 44;
Flag[17] -= 15;
Flag[16] += 122;
Flag[2] -= 35;
Flag[22] ^= 0xDu;
Flag[20] += 35;
Flag[17] -= 98;
Flag[13] += 54;
Flag[18] += 44;
Flag[5] += 84;
Flag[22] ^= 0x73u;
Flag[6] += 97;
Flag[13] ^= 8u;
Flag[12] += 124;
Flag[6] += 44;
Flag[23] -= 123;
Flag[1] -= 37;
Flag[14] -= 53;
Flag[7] += 83;
Flag[20] -= 70;
Flag[5] += 18;
Flag[4] += 113;
Flag[9] += 29;
Flag[8] += 44;
Flag[12] ^= 0x33u;
Flag[17] += 28;
Flag[7] += 110;
Flag[15] ^= 0x7Bu;
Flag[6] -= 38;
Flag[23] ^= 0x67u;
Flag[19] += 40;
Flag[0] ^= 0x43u;
Flag[15] -= 127;
Flag[12] += 102;
Flag[7] ^= 0x19u;
Flag[24] += 127;
Flag[15] -= 53;
Flag[2] += 112;
Flag[22] -= 79;
Flag[15] += 46;
Flag[3] ^= 0x5Du;
Flag[4] += 115;
Flag[5] ^= 0x71u;
Flag[15] += 85;
Flag[5] += 49;
Flag[9] ^= 0x30u;
Flag[24] ^= 0x66u;
Flag[1] ^= 0x4Bu;
Flag[8] ^= 0x64u;
Flag[0] ^= 0x5Cu;
Flag[3] += 106;
Flag[18] += 79;
Flag[7] += 80;
Flag[9] -= -128;
Flag[10] ^= 0x4Du;
Flag[13] += 59;
Flag[2] -= 122;
Flag[9] ^= 0x76u;
Flag[20] -= 65;
Flag[8] ^= 0x35u;
Flag[22] += 121;
Flag[1] -= 26;
Flag[21] += 31;
Flag[15] += 59;
Flag[8] ^= 0x60u;
Flag[19] -= 87;
Flag[11] ^= 0x5Fu;
Flag[4] -= 69;
Flag[2] += 36;
Flag[6] -= 96;
Flag[10] -= 109;
Flag[17] -= 16;
Flag[3] -= 102;
Flag[8] ^= 0x1Fu;
Flag[10] ^= 0xCu;
Flag[5] ^= 0x23u;
Flag[24] ^= 0x24u;
Flag[8] ^= 0x42u;
Flag[15] -= 101;
Flag[9] -= 2;
Flag[22] ^= 0x27u;
Flag[17] -= 79;
Flag[15] -= 49;
Flag[10] += 4;
Flag[9] -= 103;
Flag[8] ^= 0x55u;
Flag[3] += 37;
Flag[17] += 73;
Flag[15] -= 22;
Flag[14] += 60;
Flag[0] += 49;
Flag[16] ^= 5u;
Flag[21] += 8;
Flag[2] -= 51;
Flag[12] -= 122;
Flag[8] -= 76;
Flag[18] -= -128;
Flag[23] += 50;
Flag[11] += 56;
Flag[1] ^= 0xEu;
Flag[9] ^= 0x5Bu;
Flag[22] -= 115;
Flag[15] ^= 0x6Fu;
Flag[3] ^= 0x70u;
Flag[21] -= 73;
Flag[7] -= 127;
Flag[20] += 90;
Flag[1] += 30;
Flag[20] -= 76;
Flag[12] ^= 0x32u;
Flag[9] -= 123;
Flag[11] ^= 0x3Bu;
Flag[5] ^= 0x53u;
Flag[14] += 31;
Flag[10] -= 92;
Flag[4] += 94;
Flag[9] -= 70;
Flag[19] -= 12;
Flag[5] ^= 0x7Du;
Flag[16] += 127;
Flag[16] ^= 0x51u;
Flag[8] -= 2;
Flag[23] ^= 0xAu;
Flag[2] += 38;
Flag[8] += 61;
Flag[17] ^= 0x30u;
Flag[9] ^= 0x80u;
Flag[22] ^= 0x23u;
Flag[2] -= 103;
Flag[20] ^= 5u;
Flag[2] += 43;
Flag[17] ^= 0x79u;
Flag[19] ^= 0x4Eu;
Flag[19] ^= 0x62u;
Flag[22] ^= 0x37u;
Flag[1] ^= 0x63u;
Flag[2] -= 30;
--Flag[22];
Flag[20] -= -128;
Flag[23] += 93;
Flag[1] -= 106;
Flag[4] -= 57;
Flag[6] += 118;
Flag[12] += 53;
Flag[5] += 4;
Flag[12] -= 125;
Flag[20] += 46;
Flag[24] += 73;
Flag[20] += 106;
Flag[21] ^= 0x58u;
Flag[10] -= 30;
Flag[24] ^= 0x69u;
Flag[9] += 23;
Flag[23] -= 20;
Flag[22] -= 116;
Flag[14] -= 67;
Flag[15] -= -128;
Flag[7] -= 26;
Flag[13] ^= 0x2Cu;
Flag[6] ^= 0x41u;
Flag[15] ^= 0x4Du;
Flag[13] -= 23;
Flag[6] += 37;
Flag[24] -= -128;
Flag[8] -= 112;
Flag[7] += 126;
Flag[18] -= 65;
Flag[4] -= 48;
Flag[22] += 127;
Flag[3] ^= 0x15u;
Flag[13] += 96;
Flag[10] += 94;
Flag[18] ^= 0x40u;
Flag[20] -= 49;
Flag[0] ^= 0x22u;
Flag[5] ^= 0x20u;
Flag[22] -= 15;
Flag[16] ^= 0x79u;
Flag[16] -= 98;
Flag[18] ^= 1u;
Flag[16] -= 75;
Flag[9] -= 30;
Flag[1] += 58;
Flag[3] += 10;
Flag[17] -= 14;
Flag[12] -= 76;
Flag[10] -= 123;
Flag[1] += 103;
Flag[15] -= 64;
Flag[2] += 122;
Flag[12] += 78;
Flag[18] += 116;
Flag[4] += 31;
--Flag[10];
Flag[20] -= 15;
Flag[5] ^= 1u;
Flag[14] -= 49;
Flag[22] ^= 0x6Cu;
Flag[14] -= 119;
Flag[13] += 15;
Flag[22] ^= 0x40u;
Flag[12] -= 81;
Flag[3] ^= 0xEu;
Flag[7] -= 113;
Flag[3] -= 104;
Flag[19] -= 125;
Flag[23] -= 12;
Flag[24] ^= 0x6Au;
Flag[4] ^= 0x22u;
Flag[12] -= 74;
Flag[16] -= 85;
Flag[11] += 80;
Flag[2] -= 36;
Flag[11] ^= 0x35u;
Flag[13] -= 62;
Flag[11] -= 124;
Flag[0] -= 35;
Flag[12] ^= 0x1Cu;
Flag[7] += 16;
Flag[12] += 110;
Flag[7] += 98;
Flag[10] += 84;
Flag[5] ^= 1u;
Flag[14] += 43;
Flag[3] += 106;
Flag[6] ^= 0x25u;
Flag[22] ^= 0x7Eu;
Flag[23] ^= 8u;
Flag[9] += 36;
Flag[19] += 53;
Flag[9] += 114;
Flag[21] -= 10;
Flag[3] -= 126;
Flag[3] += 99;
Flag[1] += 105;
Flag[0] -= 39;
Flag[19] += 118;
Flag[16] += 10;
Flag[6] ^= 0x6Du;
Flag[3] -= 6;
Flag[10] ^= 0x34u;
Flag[17] -= 19;
Flag[22] -= 47;
Flag[4] -= 97;
Flag[18] ^= 0xBu;
Flag[16] -= 19;
Flag[7] ^= 0x71u;
Flag[4] -= 5;
Flag[20] ^= 0x78u;
Flag[24] ^= 0x29u;
Flag[8] ^= 0x71u;
Flag[24] -= 125;
Flag[16] ^= 0x51u;
Flag[6] -= 76;
Flag[12] ^= 0x1Du;
Flag[9] += 78;
Flag[9] -= 125;
Flag[6] -= 22;
Flag[13] += 95;
Flag[0] ^= 0x21u;
Flag[7] += 34;
Flag[6] -= 84;
Flag[18] ^= 0x49u;
Flag[2] -= 88;
Flag[19] -= 78;
Flag[23] -= 113;
Flag[21] -= 23;
Flag[18] += 61;
Flag[6] -= 102;
Flag[22] ^= 0x31u;
Flag[5] -= 119;
++Flag[19];
Flag[14] += 87;
Flag[14] -= 109;
Flag[14] ^= 0x77u;
Flag[14] -= 78;
Flag[23] ^= 0x1Bu;
Flag[0] ^= 0x3Cu;
Flag[4] += 107;
Flag[5] += 88;
Flag[4] ^= 0x48u;
Flag[13] -= 75;
Flag[11] += 5;
Flag[12] -= 3;
Flag[23] ^= 0x59u;
Flag[13] ^= 0x26u;
Flag[11] -= 123;
Flag[1] += 48;
Flag[2] += 25;
Flag[23] -= 109;
Flag[5] -= 78;
Flag[3] -= 31;
Flag[23] -= 11;
for ( i = 0; i <= 24; ++i )
{
printf("%c",Flag[i]&0xFF);//nctf{th3_vM_w1th0ut_dAta}
}
printf("\n");
return 0LL;
}
最后于 2019-2-22 14:44
被大帅锅编辑
，原因：
|
|
|
看着不像VM啊，感觉就是插了些垃圾代码！！为什么叫VM2
|
|
|
他的文章
- [原创]angr/pyvex模块学习 8672
- [原创] Valgrind VEX IR 9196
- [原创]内存映射文件-进程间共享数据 11446
- [求助]C#反编译字符串出现乱码如何解决 4059
- [原创]windows dll注入/Api钩取技术简单总结 55864
赞赏
雪币:
留言:
