-
-
[原创]2021CISCN逆向-little_evil
-
发表于: 2021-5-20 23:34 10265
-
关键:利用send来执行代码,在执行之前先将其打印出来进行分析,总共有三层,共利用了两种不同策略的反混淆,(第一层和第二层运用了相同的混淆,第三层运用了不同的混淆方法混淆了变量名,函数名等), 最后是一个VM
参考链接:
https://panda0s.top/2021/05/16/CISCN-Little-evil/
主要是跟着无名侠的wp复现的这道题目,希望将来自己也能达到这种程度
加油
题目的 elf 文件是典型的 ruby 解释器,拖入ida进行分析时发现:
是用Ruby packer打包的ruby程序,Ruby packer 会把源程序相关的打包成 squashfs 文件系统并塞进 ruby 解释器。
ruby packer 用了一个内存虚拟文件系统 enclose_io_memfs
squashfs 用 binwalk 就可以直接提取
执行完了之后有一个文件夹_little_evil.extracted,我们在其中提取出主程序,路径:
_little_evil.extracted\squashfs-root\enclose_io_memfs\local\out.rb
打开后如图
虽然有在线的ruby美化工具,但美化之后依然很难看
手搓一下反混淆
思路:
';'换成';\n'
函数的"()"换成"()\n\t"
end换成"end\n"
我们得到out2.rb
手动再处理之后的效果
这里就是一个关键点:
ruby语言的send可以执行代码
说明它send的就是代码,我们将其打印出来就可以得到它执行的代码
在send的上方加个print即可得到第二层的代码
将得到的rb的混淆过的代码另存为secondfloor.rb文件
因为和第一层是相同的混淆策略,那么继续使用第一次的脚本执行即可
处理之后:
我们继续print出send发过去的代码,同样也是在func21加一个
复制出去另存为文件thirdfloor.rb
这是与前两层截然不同的混淆,主要是变量名的反混淆,我们使用用正则表达式匹配后替换
执行完之后,原来的代码:
$var3 是跳转表,是 load 虚拟机字节码的时候生成的,可以直接 print 输出获得
这就是一种处理虚拟机的好方法
执行之后:
将上面得到的代码编译成C程序之后拖入IDA进行分析
调试分析:
查找我们输入字符串的地方
五个getchar()
在对应地方下断点逐渐调试
逻辑很简单, 就是输入5个字节,逐个字节的进行比较输入的字符串
调试查看那个我们定义的全局变量即可得到每次比较的字符
这里是前两个字符,剩下的同理进行调试即可
最后得到完整的5个字符:
M5Ya7
binwalk
-
Me little_evil
binwalk
-
Me little_evil
data
=
open
(
"E:\\SYJ\\COMPETITIONS\\2021CISCN\\little_evil\\_little_evil.extracted\\squashfs-root\\__enclose_io_memfs__\\local\\out.rb"
,
"r"
).read()
data
=
data.replace(
";"
,
";\n"
)
data
=
data.replace(
"()"
,
"()\n\t"
)
data
=
data.replace(
"end;"
,
"end;\n"
)
count
=
1
# 函数名的个数
names
=
{}
for
line
in
data.splitlines():
# 得到后面有换行符\n或\t等字符的一行
if
line.startswith(
"def"
):
# 判断一行开头是否为def
idx
=
line.find(
"("
)
# 本身函数名的后面一个位置的下标
original_name
=
line[
4
:idx]
# 得到原先的函数名
names[original_name]
=
"func"
+
str
(count)
# 创建字典并赋值
count
+
=
1
print
(names)
for
element
in
names:
data
=
data.replace(element
+
"()"
, names[element]
+
"()"
,
-
1
)
data
=
data.replace(element
+
";"
, names[element]
+
";"
,
-
1
)
open
(
"E:\\SYJ\\COMPETITIONS\\2021CISCN\\little_evil\\out2.rb"
,
"w"
).write(data)
data
=
open
(
"E:\\SYJ\\COMPETITIONS\\2021CISCN\\little_evil\\_little_evil.extracted\\squashfs-root\\__enclose_io_memfs__\\local\\out.rb"
,
"r"
).read()
data
=
data.replace(
";"
,
";\n"
)
data
=
data.replace(
"()"
,
"()\n\t"
)
data
=
data.replace(
"end;"
,
"end;\n"
)
count
=
1
# 函数名的个数
names
=
{}
for
line
in
data.splitlines():
# 得到后面有换行符\n或\t等字符的一行
if
line.startswith(
"def"
):
# 判断一行开头是否为def
idx
=
line.find(
"("
)
# 本身函数名的后面一个位置的下标
original_name
=
line[
4
:idx]
# 得到原先的函数名
names[original_name]
=
"func"
+
str
(count)
# 创建字典并赋值
count
+
=
1
print
(names)
for
element
in
names:
data
=
data.replace(element
+
"()"
, names[element]
+
"()"
,
-
1
)
data
=
data.replace(element
+
";"
, names[element]
+
";"
,
-
1
)
open
(
"E:\\SYJ\\COMPETITIONS\\2021CISCN\\little_evil\\out2.rb"
,
"w"
).write(data)
$l1Il
=
"";
$l1lI
=
"";
def
func1()
$lI1lll
=
$lI1lll|
7
;
end;
def
func2()
$lI1lll
=
10
;
end;
def
func3()
$lI1lll
=
$lI1lll|
4
;
end;
def
func4()
$lI1lll
=
$lI1lll
+
3
;
end;
def
func5()
$lI1lll
=
$lI1lll
%
3
;
end;
def
func6()
$lI1lll
=
$lI1lll|
3
;
end;
def
func7()
$lI1lll
=
$lI1lll
*
8
;
end;
def
func8()
$lI1lll
=
$lI1lll
-
3
;
end;
def
func9()
$lI1lll
=
$lI1lll
%
1
;
end;
def
func10()
$lI1lll
=
$lI1lll&
10
;
end;
def
func11()
$lI1lll
=
$lI1lll
-
4
;
end;
def
func12()
$lI1lll
=
$lI1lll
%
2
;
end;
def
func13()
$lI1lll
=
$lI1lll|
1
;
end;
def
l1func5()
$lI1lll
=
$lI1lll|
5
;
end;
def
func15()
$lI1lll
=
$lI1lll
%
10
;
end;
def
func16()
$l1Il
=
$l1Il
+
$lI1lll.
chr
;
end;
def
func17()
$lI1lll
=
$lI1lll
*
9
;
end;
def
func18()
$lI1lll
=
$lI1lll
-
8
;
end;
def
func19()
$lI1lll
=
$lI1lll
+
5
;
end;
def
func20()
$lI1lll
=
$lI1lll&
9
;
end;
def
func21()
send($l1Il[
0
,
4
], $l1Il[
4
,$l1Il.length]);
end;
func2;
func4;
func7;
func8;
func16;
func2;
func3;
func17;
func18;
func16;
func2;
func17;
func3;
func4;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func3;
func15;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func8;
func7;
l1func5;
func16;
func2;
func3;
func19;
func19;
func1;
func4;
func16;
func2;
func3;
func19;
func19;
func1;
func4;
func16;
func2;
func8;
func7;
func4;
func16;
func2;
func3;
func15;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func7;
func8;
func11;
func16;
func2;
func7;
func8;
func11;
func16;
func2;
func8;
func7;
l1func5;
func16;
func2;
func3;
func19;
func19;
func1;
func4;
func16;
func2;
func3;
func19;
func19;
func1;
.......
$l1Il
=
"";
$l1lI
=
"";
def
func1()
$lI1lll
=
$lI1lll|
7
;
end;
def
func2()
$lI1lll
=
10
;
end;
def
func3()
$lI1lll
=
$lI1lll|
4
;
end;
def
func4()
$lI1lll
=
$lI1lll
+
3
;
end;
def
func5()
$lI1lll
=
$lI1lll
%
3
;
end;
def
func6()
$lI1lll
=
$lI1lll|
3
;
end;
def
func7()
$lI1lll
=
$lI1lll
*
8
;
end;
def
func8()
$lI1lll
=
$lI1lll
-
3
;
end;
def
func9()
$lI1lll
=
$lI1lll
%
1
;
end;
def
func10()
$lI1lll
=
$lI1lll&
10
;
end;
def
func11()
$lI1lll
=
$lI1lll
-
4
;
end;
def
func12()
$lI1lll
=
$lI1lll
%
2
;
end;
def
func13()
$lI1lll
=
$lI1lll|
1
;
end;
def
l1func5()
$lI1lll
=
$lI1lll|
5
;
end;
def
func15()
$lI1lll
=
$lI1lll
%
10
;
end;
def
func16()
$l1Il
=
$l1Il
+
$lI1lll.
chr
;
end;
def
func17()
$lI1lll
=
$lI1lll
*
9
;
end;
def
func18()
$lI1lll
=
$lI1lll
-
8
;
end;
def
func19()
$lI1lll
=
$lI1lll
+
5
;
end;
def
func20()
$lI1lll
=
$lI1lll&
9
;
end;
def
func21()
send($l1Il[
0
,
4
], $l1Il[
4
,$l1Il.length]);
end;
func2;
func4;
func7;
func8;
func16;
func2;
func3;
func17;
func18;
func16;
func2;
func17;
func3;
func4;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func3;
func15;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func8;
func7;
l1func5;
func16;
func2;
func3;
func19;
func19;
func1;
func4;
func16;
func2;
func3;
func19;
func19;
func1;
func4;
func16;
func2;
func8;
func7;
func4;
func16;
func2;
func3;
func15;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func1;
func8;
func17;
func16;
func2;
func7;
func8;
func11;
func16;
func2;
func7;
func8;
func11;
func16;
func2;
func8;
func7;
l1func5;
func16;
func2;
func3;
func19;
func19;
func1;
func4;
func16;
func2;
func3;
func19;
func19;
func1;
.......
def
func21()
send($l1Il[
0
,
4
], $l1Il[
4
,$l1Il.length]);
end;
def
func21()
send($l1Il[
0
,
4
], $l1Il[
4
,$l1Il.length]);
end;
def
func21()
print
$l1Il[
4
,$l1Il.length]
send($l1Il[
0
,
4
], $l1Il[
4
,$l1Il.length]);
end;
def
func21()
print
$l1Il[
4
,$l1Il.length]
send($l1Il[
0
,
4
], $l1Il[
4
,$l1Il.length]);
end;
data
=
open
(
"E:\\SYJ\\COMPETITIONS\\2021CISCN\\little_evil\\secondfloor.rb"
,
"r"
).read()
data
=
data.replace(
";"
,
";\n"
)
data
=
data.replace(
"()"
,
"()\n\t"
)
data
=
data.replace(
"end;"
,
"end;\n"
)
count
=
1
# 函数名的个数
names
=
{}
for
line
in
data.splitlines():
# 得到后面有换行符\n或\t等字符的一行
if
line.startswith(
"def"
):
# 判断一行开头是否为def
idx
=
line.find(
"("
)
# 本身函数名的后面一个位置的下标
original_name
=
line[
4
:idx]
# 得到原先的函数名
names[original_name]
=
"func"
+
str
(count)
# 创建字典并赋值
count
+
=
1
print
(names)
for
element
in
names:
data
=
data.replace(element
+
"()"
, names[element]
+
"()"
,
-
1
)
data
=
data.replace(element
+
";"
, names[element]
+
";"
,
-
1
)
open
(
"E:\\SYJ\\COMPETITIONS\\2021CISCN\\little_evil\\secondfloor2.rb"
,
"w"
).write(data)
data
=
open
(
"E:\\SYJ\\COMPETITIONS\\2021CISCN\\little_evil\\secondfloor.rb"
,
"r"
).read()
data
=
data.replace(
";"
,
";\n"
)
data
=
data.replace(
"()"
,
"()\n\t"
)
data
=
data.replace(
"end;"
,
"end;\n"
)
count
=
1
# 函数名的个数
names
=
{}
for
line
in
data.splitlines():
# 得到后面有换行符\n或\t等字符的一行
if
line.startswith(
"def"
):
# 判断一行开头是否为def
idx
=
line.find(
"("
)
# 本身函数名的后面一个位置的下标
original_name
=
line[
4
:idx]
# 得到原先的函数名
names[original_name]
=
"func"
+
str
(count)
# 创建字典并赋值
count
+
=
1
print
(names)
for
element
in
names:
data
=
data.replace(element
+
"()"
, names[element]
+
"()"
,
-
1
)
data
=
data.replace(element
+
";"
, names[element]
+
";"
,
-
1
)
open
(
"E:\\SYJ\\COMPETITIONS\\2021CISCN\\little_evil\\secondfloor2.rb"
,
"w"
).write(data)
$llll
=
"";
$llII
=
"";
def
func1()
$l1lI1l
=
$l1lI1l|
7
;
end;
def
func2()
$l1lI1l
=
$l1lI1l
%
7
;
end;
def
func3()
$l1lI1l
=
$l1lI1l
/
4
;
end;
def
func4()
$l1lI1l
=
$l1lI1l
-
3
;
end;
def
func5()
$l1lI1l
=
$l1lI1l|
10
;
end;
def
func6()
$l1lI1l
=
10
;
end;
def
func7()
$l1lI1l
=
$l1lI1l&
7
;
end;
def
func8()
$l1lI1l
=
$l1lI1l
%
8
;
end;
def
func9()
$l1lI1l
=
$l1lI1l|
8
;
end;
def
func10()
$l1lI1l
=
$l1lI1l^
6
;
end;
def
func11()
$l1lI1l
=
$l1lI1l|
1
;
end;
def
func12()
$l1lI1l
=
$l1lI1l|
3
;
end;
def
func13()
$l1lI1l
=
$l1lI1l
+
6
;
end;
def
func14()
$l1lI1l
=
$l1lI1l
*
4
;
end;
def
func15()
$l1lI1l
=
$l1lI1l
*
5
;
end;
def
func16()
$l1lI1l
=
$l1lI1l^
7
;
end;
def
func17()
$l1lI1l
=
$l1lI1l^
4
;
end;
def
func18()
$l1lI1l
=
$l1lI1l
%
5
;
end;
def
func19()
$l1lI1l
=
$l1lI1l
+
9
;
end;
def
func20()
$llll
=
$llll
+
$l1lI1l.
chr
;
end;
def
func21()
send($llll[
0
,
4
], $llll[
4
,$llll.length]);
end;
func6;
func19;
func15;
func13;
func20;
func6;
func1;
func19;
func15;
func1;
func4;
func4;
func4;
......
$llll
=
"";
$llII
=
"";
def
func1()
$l1lI1l
=
$l1lI1l|
7
;
end;
def
func2()
$l1lI1l
=
$l1lI1l
%
7
;
end;
def
func3()
$l1lI1l
=
$l1lI1l
/
4
;
end;
def
func4()
$l1lI1l
=
$l1lI1l
-
3
;
end;
def
func5()
$l1lI1l
=
$l1lI1l|
10
;
end;
def
func6()
$l1lI1l
=
10
;
end;
def
func7()
$l1lI1l
=
$l1lI1l&
7
;
end;
def
func8()
$l1lI1l
=
$l1lI1l
%
8
;
end;
def
func9()
$l1lI1l
=
$l1lI1l|
8
;
end;
def
func10()
$l1lI1l
=
$l1lI1l^
6
;
end;
def
func11()
$l1lI1l
=
$l1lI1l|
1
;
end;
def
func12()
$l1lI1l
=
$l1lI1l|
3
;
end;
def
func13()
$l1lI1l
=
$l1lI1l
+
6
;
end;
def
func14()
$l1lI1l
=
$l1lI1l
*
4
;
end;
def
func15()
$l1lI1l
=
$l1lI1l
*
5
;
end;
def
func16()
$l1lI1l
=
$l1lI1l^
7
;
end;
def
func17()
$l1lI1l
=
$l1lI1l^
4
;
end;
def
func18()
$l1lI1l
=
$l1lI1l
%
5
;
end;
def
func19()
$l1lI1l
=
$l1lI1l
+
9
;
end;
def
func20()
$llll
=
$llll
+
$l1lI1l.
chr
;
end;
def
func21()
send($llll[
0
,
4
], $llll[
4
,$llll.length]);
end;
func6;
func19;
func15;
func13;
func20;
func6;
func1;
func19;
func15;
func1;
func4;
func4;
func4;
......
def
func21()
print
$llll[
4
,$llll.length]
send($llll[
0
,
4
], $llll[
4
,$llll.length]);
def
func21()
print
$llll[
4
,$llll.length]
send($llll[
0
,
4
], $llll[
4
,$llll.length]);
import
re
data
=
open
(
"thirdfloor.rb"
,
"r"
).read()
target
=
'1'
for
i
in
re.findall(r
"\$_[^_]"
, data, re.M | re.S):
if
i[
-
1
] !
=
"="
:
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @_
target
=
'2'
for
i
in
re.findall(r
"@_[^_]"
, data, re.M | re.S):
if
i[
-
1
] !
=
"="
:
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $-_ => -1
target
=
'-1'
for
i
in
re.findall(r
"\$-_[^_]"
, data, re.M | re.S):
if
i[
-
1
] !
=
"="
:
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $__ -> proc1
target
=
'$proc1'
for
i
in
re.findall(r
"\$__[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @__
target
=
'@proc2'
for
i
in
re.findall(r
"@__[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $_____
target
=
'$proc3'
for
i
in
re.findall(r
"\$_____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @_____
target
=
'@proc4'
for
i
in
re.findall(r
"@_____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $______
target
=
'$proc5'
for
i
in
re.findall(r
"\$______[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @______
target
=
'@proc6'
for
i
in
re.findall(r
"@______[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
target
=
'@varX'
for
i
in
re.findall(r
"@___[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $_______
target
=
'$proc7'
for
i
in
re.findall(r
"\$_______[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $___
target
=
'$arr1'
for
i
in
re.findall(r
"\$___[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $____
target
=
'$var3'
for
i
in
re.findall(r
"\$____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @____
target
=
'@var4'
for
i
in
re.findall(r
"@____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# [^_]____[^_]
target
=
'var5'
for
i
in
re.findall(r
"[^_]____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
# [^_]___[^_]
target
=
'var6'
for
i
in
re.findall(r
"[^_]___[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
# ______
target
=
'var7'
for
i
in
re.findall(r
"[^_]______[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
# _____
target
=
'var8'
for
i
in
re.findall(r
"[^_]_____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
data
=
data.replace(
";"
,
";\n"
,
-
1
)
try
:
open
(
"thirdfloor2.rb"
,
"w"
).write(data)
except
Exception as e:
print
(e)
import
re
data
=
open
(
"thirdfloor.rb"
,
"r"
).read()
target
=
'1'
for
i
in
re.findall(r
"\$_[^_]"
, data, re.M | re.S):
if
i[
-
1
] !
=
"="
:
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @_
target
=
'2'
for
i
in
re.findall(r
"@_[^_]"
, data, re.M | re.S):
if
i[
-
1
] !
=
"="
:
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $-_ => -1
target
=
'-1'
for
i
in
re.findall(r
"\$-_[^_]"
, data, re.M | re.S):
if
i[
-
1
] !
=
"="
:
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $__ -> proc1
target
=
'$proc1'
for
i
in
re.findall(r
"\$__[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @__
target
=
'@proc2'
for
i
in
re.findall(r
"@__[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $_____
target
=
'$proc3'
for
i
in
re.findall(r
"\$_____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @_____
target
=
'@proc4'
for
i
in
re.findall(r
"@_____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $______
target
=
'$proc5'
for
i
in
re.findall(r
"\$______[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @______
target
=
'@proc6'
for
i
in
re.findall(r
"@______[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
target
=
'@varX'
for
i
in
re.findall(r
"@___[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $_______
target
=
'$proc7'
for
i
in
re.findall(r
"\$_______[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $___
target
=
'$arr1'
for
i
in
re.findall(r
"\$___[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# $____
target
=
'$var3'
for
i
in
re.findall(r
"\$____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# @____
target
=
'@var4'
for
i
in
re.findall(r
"@____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, target
+
i[
-
1
])
# [^_]____[^_]
target
=
'var5'
for
i
in
re.findall(r
"[^_]____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
# [^_]___[^_]
target
=
'var6'
for
i
in
re.findall(r
"[^_]___[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
# ______
target
=
'var7'
for
i
in
re.findall(r
"[^_]______[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
# _____
target
=
'var8'
for
i
in
re.findall(r
"[^_]_____[^_]"
, data, re.M | re.S):
print
(i)
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
data
=
data.replace(i, i[
0
]
+
target
+
i[
-
1
])
data
=
data.replace(
";"
,
";\n"
,
-
1
)
try
:
open
(
"thirdfloor2.rb"
,
"w"
).write(data)
except
Exception as e:
print
(e)
begin $_
=
$$
/
$$;
@_
=
1
+
1
;
$
-
_
=
1
-
2
;
$proc1
=
-
>_{_
=
=
[]||_
=
=
''?$.:
1
+
$proc1[_[
1.
.
-
1
]]}
@proc2
=
-
>_,&__{_
=
=
[]?[]:[__[_[$.]]]
+
@proc2[_[
1.
.
-
1
],&__]}
$proc3
=
-
>_{@proc2[[
*
_],&
-
>__{__[$.]}]}
@proc4
=
-
>_{@proc2[[
*
_],&
-
>__{__[
-
1
]}]}
$proc5
=
-
>_{var6,var7
=
$proc3[_],@proc4[_];
var8
=
$proc1[var6];
var5
=
{};
__
=
$.;
(_
=
-
>{
var5[var7[__]]
=
var6[__];
(__
+
=
1
)
=
=
var8 ?var5:_[]})[]}
@proc6
=
-
>_,__{_
=
[
*
_]
+
[
*
__];
var5
=
$proc1[_];
var6
=
{};
__
=
$.;
(var8
=
-
>{
var6[_[__][$.]]
=
_[__][
1
];
(__
+
=
1
)
=
=
var5 ?var6:var8[]})[]}
$proc7
=
-
>_{$arr1
=
[];
@varX
=
$proc1[_];
__
=
var6
=
var5
=
$.;
$var3,@var4
=
{},[]
(var8
=
-
>{
_[var5]
=
=
'5'
?(@var4<<var5):$.
_[var5]
=
=
'6'
?($var3[@var4[
-
1
]]
=
var5;
@var4
=
@var4[$...$.
-
2
]):$.
(var5
+
=
1
)
=
=
@varX?$.:var8[]})[]
$var3
=
$var3
=
=
{}?{}:@proc6[$var3,$proc5[$var3]]
print
$var3
# 这里是跳转表,我们输出一下
(var7
=
-
>{_[__]
=
=
'0'
?($arr1[var6]||
=
$.;
$arr1[var6]
+
=
1
):_[__]
=
=
'1'
?($arr1[var6]||
=
$.;
$arr1[var6]
-
=
1
):_[__]
=
=
'2'
?($arr1[var6]||
=
$.;
$arr1[var6]
=
STDIN.getc.
ord
):_[__]
=
=
'3'
?(var6
+
=
1
):_[__]
=
=
'4'
?(var6
-
=
1
):_[__]
=
=
'5'
?(__
=
($arr1[var6]||$.)
=
=
$.?$var3[__]:__):_[__]
=
=
'6'
?(__
=
($arr1[var6]||$.)!
=
$.?$var3[__]:__):_[__]
=
=
'7'
?($><<(''<<$arr1[var6])):$.
(__
+
=
1
)
=
=
@varX?_:var7[]})[]}
$proc7[
'3351635164300000000540000000003164073000000540000003164070070000071730000000541111111131641175160343516445163530440316354031643451634235163516000000054000000000003164344354131645335163435164444516333530444403331635403164344451665163423516351600000054000000000316413443541316453351634351644445163335304444033316354031643444516651634235163516000000005400000000000316403443541316453351634351644445163335304444033316354031643444516651634235163516000000005400000000000031640344354131645335163435164444516333530444403331635403164344451665163423516351600000540000000000031643443541316453351634351644445163335304444033316354031643444516651635164453030441633544033164533516351643000000005400000000003164171111744516644'
];
rescue Exception;
end
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!