[原创]处理VM的一种特殊方法和思路-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]处理VM的一种特殊方法和思路
发表于: 2021-6-24 02:04 14040
[原创]处理VM的一种特殊方法和思路

SYJ-Re
2021-6-24 02:04
14040
备注：下面是一种处理VM的方法，其实还不够完善，栈用数组来模拟的话反编译出来还是不太好看(虽然比直接撕汇编好)，如果有什么思路大家可以提出建议。
整体概述：①先拖入IDA分析，得到"指令"和opcode；②通过python得到它的汇编；③将opcode_key重编为C语法(数组模拟栈，变量模拟寄存器)；④重新将exe拖入IDA进行分析或调试
下面给两个例子：一个是基于栈的(类似python那种)，一个是用函数模拟普通指令的(有寄存器也有栈)
这道题之前讲VM的时候讲过，比较经典的一道VM
直接给一个之前的我分析这个VM的链接
https://bbs.pediy.com/thread-267670.htm
准备好"栈"，push，pop等，寄存器变量等
(根据之前得到的汇编信息来写前缀)
opcode_key变为：
脚本：
最后运行之后得到：
手动处理一些细节的地方，粘贴到前缀的后面
注：，只要编译不报错能得到exe就行，有些恢复的不是很完全，就不能完全正确运行，不过这个还勉强
 
分析逻辑后写出解题脚本即可：
这个是一个基于栈的虚拟机，比较繁杂的一道题目
main函数中先从我们输入的参数所对应的文件中读取opcode，然后做一些虚拟机的准备，之后调用一个函数VM，里面用while循环来是实现dispatch，传入了一个地址(经过后面分析，这个地址是结构体的首地址)
在结合了VM函数内那些分析之后重命名如下
结构体如下：
这里补充一句，IDA是严格按照指针的性质来反编译的，指针加减偏移的字节，根据它反编译前面的有个()里面的来具体而定
在VM函数中一些具体的取结构体中的值
主要就是用while循环来实现dispatcher，然后下方就是逐个进行分析了
仔细看注释：
可以整理得到初步的opcode_key(这个vm的指令集)：
一点也没简化过的，用来对照IDA进行理解
理解指令并简化：
运行之后得到它的汇编
如下：
手动处理一些细节的地方，粘贴到前缀的后面：
然后可得到exe
分析技巧，观察一下会发现都是push push，然后pop pop之后进行运算这种，大脑里面想像一个栈，跟着看就行
最后写出解题脚本
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void push(int stack[], int* rsp, int data)
{

    *rsp = *rsp + 1;

    stack[*rsp] = data;
}
 
int pop(int stack[], int* rsp)
{

    int ret = stack[*rsp];

    stack[*rsp] = 0;

    *rsp = *rsp-1;

    return ret;
}
 
int main()
{

    int rsp = -1;

    int stack[10] = {0};

    int e_flag;

    int i=0;

    int reg0, reg1, reg2, reg3;

    char* string[5] = {"right", "wrong", "puts", "plz input:", "hacker"};

    char input[0x30];

return 0;
}
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void push(int stack[], int* rsp, int data)
{

    *rsp = *rsp + 1;

    stack[*rsp] = data;
}
 
int pop(int stack[], int* rsp)
{

    int ret = stack[*rsp];

    stack[*rsp] = 0;

    *rsp = *rsp-1;

    return ret;
}
 
int main()
{

    int rsp = -1;

    int stack[10] = {0};

    int e_flag;

    int i=0;

    int reg0, reg1, reg2, reg3;

    char* string[5] = {"right", "wrong", "puts", "plz input:", "hacker"};

    char input[0x30];

return 0;
}

opcode_key = {

    0: 'nop',

    1: 'reg{}={};',

    2: 'push(stack, &rsp, {});',

    3: 'push(stack, &rsp, reg{});',

    4: 'reg{}=pop(stack, &rsp);',

    5:  'printf("%s",string[reg3]);',

    6:  'reg{}+=reg{};',

    7:  'reg{}-=reg{};',

    8:  'reg{}*=reg{};',

    9:  'reg{}%=reg{};',

    10: 'reg{}^=reg{};',

    11: 'goto _(3*{}-3);',                     # 3*{}-3

    12: 'e_flag = reg{} - reg{};',

    13: 'if(e_flag) goto _rip+3; else goto _(3*{}-3);',

    14: 'if(e_flag) goto _(3*{}-3); else goto _rip+3;',

    15: 'if(e_flag <= 0) goto _rip+3; else goto _(3*{}-3);',

    16: 'if(e_flag >= 0) goto _rip+3; else goto _(3*{}-3);',

    17: 'scanf("%s",input);',

    18: 'mem_init {} {}',

    19: 'reg{}=pop(stack, &rsp);',

    20: 'reg{}=input[{}];',

    0xff: 'exit(0);'}

opcode_key = {

    0: 'nop',

    1: 'reg{}={};',

    2: 'push(stack, &rsp, {});',

    3: 'push(stack, &rsp, reg{});',

    4: 'reg{}=pop(stack, &rsp);',

    5:  'printf("%s",string[reg3]);',

    6:  'reg{}+=reg{};',

    7:  'reg{}-=reg{};',

    8:  'reg{}*=reg{};',

    9:  'reg{}%=reg{};',

    10: 'reg{}^=reg{};',

    11: 'goto _(3*{}-3);',                     # 3*{}-3

    12: 'e_flag = reg{} - reg{};',

    13: 'if(e_flag) goto _rip+3; else goto _(3*{}-3);',

    14: 'if(e_flag) goto _(3*{}-3); else goto _rip+3;',

    15: 'if(e_flag <= 0) goto _rip+3; else goto _(3*{}-3);',

    16: 'if(e_flag >= 0) goto _rip+3; else goto _(3*{}-3);',

    17: 'scanf("%s",input);',

    18: 'mem_init {} {}',

    19: 'reg{}=pop(stack, &rsp);',

    20: 'reg{}=input[{}];',

    0xff: 'exit(0);'}
# _*_ coding: utf-8 _*_
# editor: SYJ
# function: Reversed By SYJ
# describe:

opcode_team = [0x01, 0x03, 0x03, 0x05, 0x00, 0x00, 0x11, 0x00, 0x00, 0x01, 0x01, 0x11, 0x0C, 0x00, 0x01, 0x0D, 0x0A, 0x00, 0x01, 0x03, 0x01, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x01, 0x02, 0x00, 0x01, 0x00, 0x11, 0x0C, 0x00, 0x02, 0x0D, 0x2B, 0x00, 0x14, 0x00, 0x02, 0x01, 0x01, 0x61, 0x0C, 0x00, 0x01, 0x10, 0x1A, 0x00, 0x01, 0x01, 0x7A, 0x0C, 0x00, 0x01, 0x0F, 0x1A, 0x00, 0x01, 0x01, 0x47, 0x0A, 0x00, 0x01, 0x01, 0x01, 0x01, 0x06, 0x00, 0x01, 0x0B, 0x24, 0x00, 0x01, 0x01, 0x41, 0x0C, 0x00, 0x01, 0x10, 0x24, 0x00, 0x01, 0x01, 0x5A, 0x0C, 0x00, 0x01, 0x0F, 0x24, 0x00, 0x01, 0x01, 0x4B, 0x0A, 0x00, 0x01, 0x01, 0x01, 0x01, 0x07, 0x00, 0x01, 0x01, 0x01, 0x10, 0x09, 0x00, 0x01, 0x03, 0x01, 0x00, 0x03, 0x00, 0x00, 0x01, 0x01, 0x01, 0x06, 0x02, 0x01, 0x0B, 0x0B, 0x00, 0x02, 0x07, 0x00, 0x02, 0x0D, 0x00, 0x02, 0x00, 0x00, 0x02, 0x05, 0x00, 0x02, 0x01, 0x00, 0x02, 0x0C, 0x00, 0x02, 0x01, 0x00, 0x02, 0x00, 0x00, 0x02, 0x00, 0x00, 0x02, 0x0D, 0x00, 0x02, 0x05, 0x00, 0x02, 0x0F, 0x00, 0x02, 0x00, 0x00, 0x02, 0x09, 0x00, 0x02, 0x05, 0x00, 0x02, 0x0F, 0x00, 0x02, 0x03, 0x00, 0x02, 0x00, 0x00, 0x02, 0x02, 0x00, 0x02, 0x05, 0x00, 0x02, 0x03, 0x00, 0x02, 0x03, 0x00, 0x02, 0x01, 0x00, 0x02, 0x07, 0x00, 0x02, 0x07, 0x00, 0x02, 0x0B, 0x00, 0x02, 0x02, 0x00, 0x02, 0x01, 0x00, 0x02, 0x02, 0x00, 0x02, 0x07, 0x00, 0x02, 0x02, 0x00, 0x02, 0x0C, 0x00, 0x02, 0x02, 0x00, 0x02, 0x02, 0x00, 0x01, 0x02, 0x01, 0x13, 0x01, 0x02, 0x04, 0x00, 0x00, 0x0C, 0x00, 0x01, 0x0E, 0x5B, 0x00, 0x01, 0x01, 0x22, 0x0C, 0x02, 0x01, 0x0D, 0x59, 0x00, 0x01, 0x01, 0x01, 0x06, 0x02, 0x01, 0x0B, 0x4E, 0x00, 0x01, 0x03, 0x00, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x01, 0x03, 0x01, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x00]

opcode_key = {

    0: 'nop',

    1: 'reg{}={};',

    2: 'push(stack, &rsp, {});',

    3: 'push(stack, &rsp, reg{});',

    4: 'reg{}=pop(stack, &rsp);',

    5:  'printf("%s",string[reg3]);',

    6:  'reg{}+=reg{};',

    7:  'reg{}-=reg{};',

    8:  'reg{}*=reg{};',

    9:  'reg{}%=reg{};',

    10: 'reg{}^=reg{};',

    11: 'goto _(3*{}-3);',                     # 3*{}-3

    12: 'e_flag = reg{} - reg{};',

    13: 'if(e_flag) goto _rip+3; else goto _(3*{}-3);',

    14: 'if(e_flag) goto _(3*{}-3); else goto _rip+3;',

    15: 'if(e_flag <= 0) goto _rip+3; else goto _(3*{}-3);',

    16: 'if(e_flag >= 0) goto _rip+3; else goto _(3*{}-3);',

    17: 'scanf("%s",input);',

    18: 'mem_init {} {}',

    19: 'reg{}=pop(stack, &rsp);',

    20: 'reg{}=input[{}];',

    0xff: 'exit(0);'}

rip = 0

all = len(opcode_team)

while rip < all:

    x = opcode_team[rip]

    if x != 0:

        print("_" + str(hex(rip)) + ": " + opcode_key[x].format(opcode_team[rip+1], (opcode_team[rip+2])))

        rip += 3

    else:

        print("_" + str(hex(rip)) + ": " + opcode_key[x].format(hex(rip+1)))

        rip += 1
# _*_ coding: utf-8 _*_
# editor: SYJ
# function: Reversed By SYJ
# describe:

opcode_team = [0x01, 0x03, 0x03, 0x05, 0x00, 0x00, 0x11, 0x00, 0x00, 0x01, 0x01, 0x11, 0x0C, 0x00, 0x01, 0x0D, 0x0A, 0x00, 0x01, 0x03, 0x01, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x01, 0x02, 0x00, 0x01, 0x00, 0x11, 0x0C, 0x00, 0x02, 0x0D, 0x2B, 0x00, 0x14, 0x00, 0x02, 0x01, 0x01, 0x61, 0x0C, 0x00, 0x01, 0x10, 0x1A, 0x00, 0x01, 0x01, 0x7A, 0x0C, 0x00, 0x01, 0x0F, 0x1A, 0x00, 0x01, 0x01, 0x47, 0x0A, 0x00, 0x01, 0x01, 0x01, 0x01, 0x06, 0x00, 0x01, 0x0B, 0x24, 0x00, 0x01, 0x01, 0x41, 0x0C, 0x00, 0x01, 0x10, 0x24, 0x00, 0x01, 0x01, 0x5A, 0x0C, 0x00, 0x01, 0x0F, 0x24, 0x00, 0x01, 0x01, 0x4B, 0x0A, 0x00, 0x01, 0x01, 0x01, 0x01, 0x07, 0x00, 0x01, 0x01, 0x01, 0x10, 0x09, 0x00, 0x01, 0x03, 0x01, 0x00, 0x03, 0x00, 0x00, 0x01, 0x01, 0x01, 0x06, 0x02, 0x01, 0x0B, 0x0B, 0x00, 0x02, 0x07, 0x00, 0x02, 0x0D, 0x00, 0x02, 0x00, 0x00, 0x02, 0x05, 0x00, 0x02, 0x01, 0x00, 0x02, 0x0C, 0x00, 0x02, 0x01, 0x00, 0x02, 0x00, 0x00, 0x02, 0x00, 0x00, 0x02, 0x0D, 0x00, 0x02, 0x05, 0x00, 0x02, 0x0F, 0x00, 0x02, 0x00, 0x00, 0x02, 0x09, 0x00, 0x02, 0x05, 0x00, 0x02, 0x0F, 0x00, 0x02, 0x03, 0x00, 0x02, 0x00, 0x00, 0x02, 0x02, 0x00, 0x02, 0x05, 0x00, 0x02, 0x03, 0x00, 0x02, 0x03, 0x00, 0x02, 0x01, 0x00, 0x02, 0x07, 0x00, 0x02, 0x07, 0x00, 0x02, 0x0B, 0x00, 0x02, 0x02, 0x00, 0x02, 0x01, 0x00, 0x02, 0x02, 0x00, 0x02, 0x07, 0x00, 0x02, 0x02, 0x00, 0x02, 0x0C, 0x00, 0x02, 0x02, 0x00, 0x02, 0x02, 0x00, 0x01, 0x02, 0x01, 0x13, 0x01, 0x02, 0x04, 0x00, 0x00, 0x0C, 0x00, 0x01, 0x0E, 0x5B, 0x00, 0x01, 0x01, 0x22, 0x0C, 0x02, 0x01, 0x0D, 0x59, 0x00, 0x01, 0x01, 0x01, 0x06, 0x02, 0x01, 0x0B, 0x4E, 0x00, 0x01, 0x03, 0x00, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x01, 0x03, 0x01, 0x05, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x00]

opcode_key = {

    0: 'nop',

    1: 'reg{}={};',

    2: 'push(stack, &rsp, {});',

    3: 'push(stack, &rsp, reg{});',

    4: 'reg{}=pop(stack, &rsp);',

    5:  'printf("%s",string[reg3]);',

    6:  'reg{}+=reg{};',

    7:  'reg{}-=reg{};',

    8:  'reg{}*=reg{};',

    9:  'reg{}%=reg{};',

    10: 'reg{}^=reg{};',

    11: 'goto _(3*{}-3);',                     # 3*{}-3

    12: 'e_flag = reg{} - reg{};',

    13: 'if(e_flag) goto _rip+3; else goto _(3*{}-3);',

    14: 'if(e_flag) goto _(3*{}-3); else goto _rip+3;',

    15: 'if(e_flag <= 0) goto _rip+3; else goto _(3*{}-3);',

    16: 'if(e_flag >= 0) goto _rip+3; else goto _(3*{}-3);',

    17: 'scanf("%s",input);',

    18: 'mem_init {} {}',

    19: 'reg{}=pop(stack, &rsp);',

    20: 'reg{}=input[{}];',

    0xff: 'exit(0);'}

rip = 0

all = len(opcode_team)

while rip < all:

    x = opcode_team[rip]

    if x != 0:

        print("_" + str(hex(rip)) + ": " + opcode_key[x].format(opcode_team[rip+1], (opcode_team[rip+2])))

        rip += 3

    else:

        print("_" + str(hex(rip)) + ": " + opcode_key[x].format(hex(rip+1)))

        rip += 1

_0x0: reg3=3;

_0x3: printf("%s",string[reg3]);

_0x6: scanf("%s",input);

_0x9: reg1=17;

_0xc: e_flag = reg0 - reg1;

_0xf: if(e_flag) goto _rip+3; else goto _(3*10-3);

_0x12: reg3=1;

_0x15: printf("%s",string[reg3]);

_0x18: exit(0);

_0x1b: reg2=0;

_0x1e: reg0=17;

_0x21: e_flag = reg0 - reg2;

_0x24: if(e_flag) goto _rip+3; else goto _(3*43-3);

_0x27: reg0=input[2];

_0x2a: reg1=97;

_0x2d: e_flag = reg0 - reg1;

_0x30: if(e_flag >= 0) goto _rip+3; else goto _(3*26-3);

_0x33: reg1=122;

_0x36: e_flag = reg0 - reg1;

_0x39: if(e_flag <= 0) goto _rip+3; else goto _(3*26-3);

_0x3c: reg1=71;

_0x3f: reg0^=reg1;

_0x42: reg1=1;

_0x45: reg0+=reg1;

_0x48: goto _(3*36-3);

_0x4b: reg1=65;

_0x4e: e_flag = reg0 - reg1;

_0x51: if(e_flag >= 0) goto _rip+3; else goto _(3*36-3);

_0x54: reg1=90;

_0x57: e_flag = reg0 - reg1;

_0x5a: if(e_flag <= 0) goto _rip+3; else goto _(3*36-3);

_0x5d: reg1=75;

_0x60: reg0^=reg1;

_0x63: reg1=1;

_0x66: reg0-=reg1;

_0x69: reg1=16;

_0x6c: reg0%=reg1;
_0x6f: push(stack, &rsp, reg1);
_0x72: push(stack, &rsp, reg0);

_0x75: reg1=1;

_0x78: reg2+=reg1;

_0x7b: goto _(3*11-3);

_0x7e: push(stack, &rsp, 7);

_0x81: push(stack, &rsp, 13);

_0x84: push(stack, &rsp, 0);

_0x87: push(stack, &rsp, 5);

_0x8a: push(stack, &rsp, 1);

_0x8d: push(stack, &rsp, 12);

_0x90: push(stack, &rsp, 1);

_0x93: push(stack, &rsp, 0);

_0x96: push(stack, &rsp, 0);

_0x99: push(stack, &rsp, 13);

_0x9c: push(stack, &rsp, 5);

_0x9f: push(stack, &rsp, 15);

_0xa2: push(stack, &rsp, 0);

_0xa5: push(stack, &rsp, 9);

_0xa8: push(stack, &rsp, 5);

_0xab: push(stack, &rsp, 15);

_0xae: push(stack, &rsp, 3);

_0xb1: push(stack, &rsp, 0);

_0xb4: push(stack, &rsp, 2);

_0xb7: push(stack, &rsp, 5);

_0xba: push(stack, &rsp, 3);

_0xbd: push(stack, &rsp, 3);

_0xc0: push(stack, &rsp, 1);

_0xc3: push(stack, &rsp, 7);

_0xc6: push(stack, &rsp, 7);

_0xc9: push(stack, &rsp, 11);

_0xcc: push(stack, &rsp, 2);

_0xcf: push(stack, &rsp, 1);

_0xd2: push(stack, &rsp, 2);

_0xd5: push(stack, &rsp, 7);

_0xd8: push(stack, &rsp, 2);

_0xdb: push(stack, &rsp, 12);

_0xde: push(stack, &rsp, 2);

_0xe1: push(stack, &rsp, 2);

_0xe4: reg2=1;

_0xe7: reg1=pop(stack, &rsp);

_0xea: reg0=pop(stack, &rsp);

_0xed: e_flag = reg0 - reg1;

_0xf0: if(e_flag) goto _(3*91-3); else goto _rip+3;

_0xf3: reg1=34;

_0xf6: e_flag = reg2 - reg1;

_0xf9: if(e_flag) goto _rip+3; else goto _(3*89-3);

_0xfc: reg1=1;

_0xff: reg2+=reg1;

_0x102: goto _(3*78-3);

_0x105: reg3=0;

_0x108: printf("%s",string[reg3]);

_0x10b: exit(0);

_0x10e: reg3=1;

_0x111: printf("%s",string[reg3]);

_0x114: exit(0);
_0x117: nop

_0x0: reg3=3;

_0x3: printf("%s",string[reg3]);

_0x6: scanf("%s",input);

_0x9: reg1=17;

_0xc: e_flag = reg0 - reg1;

_0xf: if(e_flag) goto _rip+3; else goto _(3*10-3);

_0x12: reg3=1;

_0x15: printf("%s",string[reg3]);

_0x18: exit(0);

_0x1b: reg2=0;

_0x1e: reg0=17;

_0x21: e_flag = reg0 - reg2;

_0x24: if(e_flag) goto _rip+3; else goto _(3*43-3);

_0x27: reg0=input[2];

_0x2a: reg1=97;

_0x2d: e_flag = reg0 - reg1;

_0x30: if(e_flag >= 0) goto _rip+3; else goto _(3*26-3);

_0x33: reg1=122;

_0x36: e_flag = reg0 - reg1;

_0x39: if(e_flag <= 0) goto _rip+3; else goto _(3*26-3);

_0x3c: reg1=71;

_0x3f: reg0^=reg1;

_0x42: reg1=1;

_0x45: reg0+=reg1;

_0x48: goto _(3*36-3);

_0x4b: reg1=65;

_0x4e: e_flag = reg0 - reg1;

_0x51: if(e_flag >= 0) goto _rip+3; else goto _(3*36-3);

_0x54: reg1=90;

_0x57: e_flag = reg0 - reg1;

_0x5a: if(e_flag <= 0) goto _rip+3; else goto _(3*36-3);

_0x5d: reg1=75;

_0x60: reg0^=reg1;

_0x63: reg1=1;

_0x66: reg0-=reg1;

_0x69: reg1=16;

_0x6c: reg0%=reg1;
_0x6f: push(stack, &rsp, reg1);
_0x72: push(stack, &rsp, reg0);

_0x75: reg1=1;

_0x78: reg2+=reg1;

_0x7b: goto _(3*11-3);

_0x7e: push(stack, &rsp, 7);

_0x81: push(stack, &rsp, 13);

_0x84: push(stack, &rsp, 0);

_0x87: push(stack, &rsp, 5);

_0x8a: push(stack, &rsp, 1);

_0x8d: push(stack, &rsp, 12);

_0x90: push(stack, &rsp, 1);

_0x93: push(stack, &rsp, 0);

_0x96: push(stack, &rsp, 0);

_0x99: push(stack, &rsp, 13);

_0x9c: push(stack, &rsp, 5);

_0x9f: push(stack, &rsp, 15);

_0xa2: push(stack, &rsp, 0);

_0xa5: push(stack, &rsp, 9);

_0xa8: push(stack, &rsp, 5);

_0xab: push(stack, &rsp, 15);

_0xae: push(stack, &rsp, 3);

_0xb1: push(stack, &rsp, 0);

_0xb4: push(stack, &rsp, 2);

_0xb7: push(stack, &rsp, 5);

_0xba: push(stack, &rsp, 3);

_0xbd: push(stack, &rsp, 3);

_0xc0: push(stack, &rsp, 1);

_0xc3: push(stack, &rsp, 7);

_0xc6: push(stack, &rsp, 7);

_0xc9: push(stack, &rsp, 11);

_0xcc: push(stack, &rsp, 2);

_0xcf: push(stack, &rsp, 1);

_0xd2: push(stack, &rsp, 2);

_0xd5: push(stack, &rsp, 7);

_0xd8: push(stack, &rsp, 2);

_0xdb: push(stack, &rsp, 12);

_0xde: push(stack, &rsp, 2);

_0xe1: push(stack, &rsp, 2);

_0xe4: reg2=1;

_0xe7: reg1=pop(stack, &rsp);

_0xea: reg0=pop(stack, &rsp);

_0xed: e_flag = reg0 - reg1;

_0xf0: if(e_flag) goto _(3*91-3); else goto _rip+3;

_0xf3: reg1=34;

_0xf6: e_flag = reg2 - reg1;

_0xf9: if(e_flag) goto _rip+3; else goto _(3*89-3);

_0xfc: reg1=1;

_0xff: reg2+=reg1;

_0x102: goto _(3*78-3);

_0x105: reg3=0;

_0x108: printf("%s",string[reg3]);

_0x10b: exit(0);

_0x10e: reg3=1;

_0x111: printf("%s",string[reg3]);

_0x114: exit(0);
_0x117: nop
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void push(int stack[], int* rsp, int data)
{

    *rsp = *rsp + 1;

    stack[*rsp] = data;
}
 
int pop(int stack[], int* rsp)
{

    int ret = stack[*rsp];

    stack[*rsp] = 0;

    *rsp = *rsp-1;

    return ret;
}
 
int main()
{

    int rsp = -1;

    int stack[10] = {0};

    int e_flag;

    int i=0;

    int reg0, reg1, reg2, reg3;

    char* string[5] = {"right", "wrong", "puts", "plz input:", "hacker"};

    char input[0x30];

_0x0: reg3=3;

_0x3: printf("%s",string[reg3]);

_0x6: scanf("%s",input);reg0=strlen(input);

_0x9: reg1=17;

_0xc: e_flag = reg0 - reg1;

_0xf: if(e_flag) {goto _0x12;} else {goto _0x1b;}

_0x12: reg3=1;

_0x15: printf("%s",string[reg3]);

_0x18: exit(0);

_0x1b: reg2=0;

_0x1e: reg0=17;

_0x21: e_flag = reg0 - reg2;

_0x24: if(e_flag) {goto _0x27;} else {goto _0x7e;}

_0x27: reg0=input[2];

_0x2a: reg1=97;

_0x2d: e_flag = reg0 - reg1;

_0x30: if(e_flag >= 0) {goto _0x33;} else {goto _0x4b;}

_0x33: reg1=122;

_0x36: e_flag = reg0 - reg1;

_0x39: if(e_flag <= 0) {goto _0x3c;} else {goto _0x4b;}

_0x3c: reg1=71;

_0x3f: reg0^=reg1;

_0x42: reg1=1;

_0x45: reg0+=reg1;
_0x48: goto _0x69;

_0x4b: reg1=65;

_0x4e: e_flag = reg0 - reg1;

_0x51: if(e_flag >= 0) {goto _0x54;} else {goto _0x69;}

_0x54: reg1=90;

_0x57: e_flag = reg0 - reg1;

_0x5a: if(e_flag <= 0) {goto _0x5d;} else {goto _0x69;}

_0x5d: reg1=75;

_0x60: reg0^=reg1;

_0x63: reg1=1;

_0x66: reg0-=reg1;

_0x69: reg1=reg0/16;

_0x6c: reg0%=16;
_0x6f: push(stack, &rsp, reg1);
_0x72: push(stack, &rsp, reg0);

_0x75: reg1=1;

_0x78: reg2+=reg1;
_0x7b: goto _0x1e;

_0x7e: push(stack, &rsp, 7);

_0x81: push(stack, &rsp, 13);

_0x84: push(stack, &rsp, 0);

_0x87: push(stack, &rsp, 5);

_0x8a: push(stack, &rsp, 1);

_0x8d: push(stack, &rsp, 12);

_0x90: push(stack, &rsp, 1);

_0x93: push(stack, &rsp, 0);

_0x96: push(stack, &rsp, 0);

_0x99: push(stack, &rsp, 13);

_0x9c: push(stack, &rsp, 5);

_0x9f: push(stack, &rsp, 15);

_0xa2: push(stack, &rsp, 0);

_0xa5: push(stack, &rsp, 9);

_0xa8: push(stack, &rsp, 5);

_0xab: push(stack, &rsp, 15);

_0xae: push(stack, &rsp, 3);

_0xb1: push(stack, &rsp, 0);

_0xb4: push(stack, &rsp, 2);

_0xb7: push(stack, &rsp, 5);

_0xba: push(stack, &rsp, 3);

_0xbd: push(stack, &rsp, 3);

_0xc0: push(stack, &rsp, 1);

_0xc3: push(stack, &rsp, 7);

_0xc6: push(stack, &rsp, 7);

_0xc9: push(stack, &rsp, 11);

_0xcc: push(stack, &rsp, 2);

_0xcf: push(stack, &rsp, 1);

_0xd2: push(stack, &rsp, 2);

_0xd5: push(stack, &rsp, 7);

_0xd8: push(stack, &rsp, 2);

_0xdb: push(stack, &rsp, 12);

_0xde: push(stack, &rsp, 2);

_0xe1: push(stack, &rsp, 2);

_0xe4: reg2=1;

_0xe7: reg1=pop(stack, &rsp);

_0xea: reg0=pop(stack, &rsp);

_0xed: e_flag = reg0 - reg1;

_0xf0: if(e_flag) {goto _0x10e;} else {goto _0xf3;}

_0xf3: reg1=34;

_0xf6: e_flag = reg2 - reg1;

_0xf9: if(e_flag) {goto _0xfc;} else {goto _0x108;}

_0xfc: reg1=1;

_0xff: reg2+=reg1;
_0x102: goto _0xe7;

_0x105: reg3=0;

_0x108: printf("%s",string[reg3]);

_0x10b: exit(0);

_0x10e: reg3=1;

_0x111: printf("%s",string[reg3]);

_0x114: exit(0);

    return 0;
}
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void push(int stack[], int* rsp, int data)
{

    *rsp = *rsp + 1;

    stack[*rsp] = data;
}
 
int pop(int stack[], int* rsp)
{

    int ret = stack[*rsp];

    stack[*rsp] = 0;

    *rsp = *rsp-1;

    return ret;
}
 
int main()
{

    int rsp = -1;

    int stack[10] = {0};

    int e_flag;

    int i=0;

    int reg0, reg1, reg2, reg3;

    char* string[5] = {"right", "wrong", "puts", "plz input:", "hacker"};

    char input[0x30];

_0x0: reg3=3;

_0x3: printf("%s",string[reg3]);

_0x6: scanf("%s",input);reg0=strlen(input);

_0x9: reg1=17;

_0xc: e_flag = reg0 - reg1;

_0xf: if(e_flag) {goto _0x12;} else {goto _0x1b;}

_0x12: reg3=1;

_0x15: printf("%s",string[reg3]);

_0x18: exit(0);

_0x1b: reg2=0;

_0x1e: reg0=17;

_0x21: e_flag = reg0 - reg2;

_0x24: if(e_flag) {goto _0x27;} else {goto _0x7e;}

_0x27: reg0=input[2];

_0x2a: reg1=97;

_0x2d: e_flag = reg0 - reg1;

_0x30: if(e_flag >= 0) {goto _0x33;} else {goto _0x4b;}

_0x33: reg1=122;

_0x36: e_flag = reg0 - reg1;

_0x39: if(e_flag <= 0) {goto _0x3c;} else {goto _0x4b;}

_0x3c: reg1=71;

_0x3f: reg0^=reg1;

_0x42: reg1=1;

_0x45: reg0+=reg1;
_0x48: goto _0x69;

_0x4b: reg1=65;

_0x4e: e_flag = reg0 - reg1;

_0x51: if(e_flag >= 0) {goto _0x54;} else {goto _0x69;}

_0x54: reg1=90;

_0x57: e_flag = reg0 - reg1;

_0x5a: if(e_flag <= 0) {goto _0x5d;} else {goto _0x69;}

_0x5d: reg1=75;

_0x60: reg0^=reg1;

_0x63: reg1=1;

_0x66: reg0-=reg1;

_0x69: reg1=reg0/16;

_0x6c: reg0%=16;
_0x6f: push(stack, &rsp, reg1);
_0x72: push(stack, &rsp, reg0);

_0x75: reg1=1;

_0x78: reg2+=reg1;
_0x7b: goto _0x1e;

_0x7e: push(stack, &rsp, 7);

_0x81: push(stack, &rsp, 13);

_0x84: push(stack, &rsp, 0);

_0x87: push(stack, &rsp, 5);

_0x8a: push(stack, &rsp, 1);

_0x8d: push(stack, &rsp, 12);

_0x90: push(stack, &rsp, 1);

_0x93: push(stack, &rsp, 0);

_0x96: push(stack, &rsp, 0);

_0x99: push(stack, &rsp, 13);

_0x9c: push(stack, &rsp, 5);

_0x9f: push(stack, &rsp, 15);

_0xa2: push(stack, &rsp, 0);

_0xa5: push(stack, &rsp, 9);

_0xa8: push(stack, &rsp, 5);

_0xab: push(stack, &rsp, 15);

_0xae: push(stack, &rsp, 3);

_0xb1: push(stack, &rsp, 0);

_0xb4: push(stack, &rsp, 2);

_0xb7: push(stack, &rsp, 5);

_0xba: push(stack, &rsp, 3);

_0xbd: push(stack, &rsp, 3);

_0xc0: push(stack, &rsp, 1);

_0xc3: push(stack, &rsp, 7);

_0xc6: push(stack, &rsp, 7);

_0xc9: push(stack, &rsp, 11);

_0xcc: push(stack, &rsp, 2);

_0xcf: push(stack, &rsp, 1);

_0xd2: push(stack, &rsp, 2);

_0xd5: push(stack, &rsp, 7);

_0xd8: push(stack, &rsp, 2);

_0xdb: push(stack, &rsp, 12);

_0xde: push(stack, &rsp, 2);

_0xe1: push(stack, &rsp, 2);

_0xe4: reg2=1;

_0xe7: reg1=pop(stack, &rsp);

_0xea: reg0=pop(stack, &rsp);

_0xed: e_flag = reg0 - reg1;

_0xf0: if(e_flag) {goto _0x10e;} else {goto _0xf3;}

_0xf3: reg1=34;

_0xf6: e_flag = reg2 - reg1;

_0xf9: if(e_flag) {goto _0xfc;} else {goto _0x108;}

_0xfc: reg1=1;

_0xff: reg2+=reg1;
_0x102: goto _0xe7;

_0x105: reg3=0;

_0x108: printf("%s",string[reg3]);

_0x10b: exit(0);

_0x10e: reg3=1;

_0x111: printf("%s",string[reg3]);

_0x114: exit(0);

    return 0;
}
 
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{

  int v3; // kr00_4

  char input[48]; // [rsp+20h] [rbp-B0h] BYREF

  char *string[5]; // [rsp+50h] [rbp-80h]

  int stack[10]; // [rsp+80h] [rbp-50h] BYREF

  int rsp_0; // [rsp+B4h] [rbp-1Ch] BYREF

  int e_flag; // [rsp+B8h] [rbp-18h]

  int reg1; // [rsp+BCh] [rbp-14h]

  int reg3; // [rsp+C0h] [rbp-10h]

  int i; // [rsp+C4h] [rbp-Ch]

  int j; // [rsp+C8h] [rbp-8h]

  int reg0; // [rsp+CCh] [rbp-4h]
 
  _main(argc, argv, envp);

  rsp_0 = -1;

  memset(stack, 0, sizeof(stack));

  i = 0;

  string[0] = "right";

  string[1] = "wrong";

  string[2] = "puts";

  string[3] = "plz input:";

  string[4] = "hacker";

  reg3 = 3;

  printf("%s", "plz input:");

  scanf("%s", input);

  reg0 = strlen(input);

  reg1 = 17;

  e_flag = reg0 - 17;

  if ( reg0 != 17 )

  {

    reg3 = 1;

    printf("%s", string[1]);

    exit(0);

  }

  for ( j = 0; ; ++j )

  {

    reg0 = 17;

    e_flag = 17 - j;

    if ( j == 17 )

      break;

    reg0 = input[2];

    reg1 = 97;

    e_flag = input[2] - 97;

    if ( e_flag < 0 || (reg1 = 'z', e_flag = reg0 - 'z', reg0 - 'z' > 0) )

    {

      reg1 = 'A';

      e_flag = reg0 - 'A';

      if ( reg0 - 'A' >= 0 )

      {

        reg1 = 'Z';

        e_flag = reg0 - 'Z';

        if ( reg0 - 'Z' <= 0 )                  // 'A' - 'Z'

        {

          reg0 ^= 75u;

          reg1 = 1;

          --reg0;

        }

      }

    }

    else                                        // 'a' - 'z'

    {

      reg0 ^= 71u;

      reg1 = 1;

      ++reg0;

    }

    v3 = reg0;

    reg1 = reg0 / 16;

    reg0 %= 16;

    push(stack, &rsp_0, v3 / 16);     //push进除16的整数

    push(stack, &rsp_0, reg0);        //push进%16的整数

    reg1 = 1;

  }

  push(stack, &rsp_0, 7);

  push(stack, &rsp_0, 13);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 5);

  push(stack, &rsp_0, 1);

  push(stack, &rsp_0, 12);

  push(stack, &rsp_0, 1);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 13);

  push(stack, &rsp_0, 5);

  push(stack, &rsp_0, 15);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 9);

  push(stack, &rsp_0, 5);

  push(stack, &rsp_0, 15);

  push(stack, &rsp_0, 3);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 5);

  push(stack, &rsp_0, 3);

  push(stack, &rsp_0, 3);

  push(stack, &rsp_0, 1);

  push(stack, &rsp_0, 7);

  push(stack, &rsp_0, 7);

  push(stack, &rsp_0, 11);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 1);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 7);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 12);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 2);

  for ( j = 1; ; ++j )

  {

    reg1 = pop(stack, &rsp_0);

    reg0 = pop(stack, &rsp_0);

    e_flag = reg0 - reg1;

    if ( reg0 != reg1 )

      break;

    reg1 = 34;

    e_flag = j - 34;

    if ( j == 34 )

    {

      printf("%s", string[reg3]);

      exit(0);

    }

    reg1 = 1;

  }

  reg3 = 1;

  printf("%s", string[1]);

  exit(0);
}

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{

  int v3; // kr00_4

  char input[48]; // [rsp+20h] [rbp-B0h] BYREF

  char *string[5]; // [rsp+50h] [rbp-80h]

  int stack[10]; // [rsp+80h] [rbp-50h] BYREF

  int rsp_0; // [rsp+B4h] [rbp-1Ch] BYREF

  int e_flag; // [rsp+B8h] [rbp-18h]

  int reg1; // [rsp+BCh] [rbp-14h]

  int reg3; // [rsp+C0h] [rbp-10h]

  int i; // [rsp+C4h] [rbp-Ch]

  int j; // [rsp+C8h] [rbp-8h]

  int reg0; // [rsp+CCh] [rbp-4h]
 
  _main(argc, argv, envp);

  rsp_0 = -1;

  memset(stack, 0, sizeof(stack));

  i = 0;

  string[0] = "right";

  string[1] = "wrong";

  string[2] = "puts";

  string[3] = "plz input:";

  string[4] = "hacker";

  reg3 = 3;

  printf("%s", "plz input:");

  scanf("%s", input);

  reg0 = strlen(input);

  reg1 = 17;

  e_flag = reg0 - 17;

  if ( reg0 != 17 )

  {

    reg3 = 1;

    printf("%s", string[1]);

    exit(0);

  }

  for ( j = 0; ; ++j )

  {

    reg0 = 17;

    e_flag = 17 - j;

    if ( j == 17 )

      break;

    reg0 = input[2];

    reg1 = 97;

    e_flag = input[2] - 97;

    if ( e_flag < 0 || (reg1 = 'z', e_flag = reg0 - 'z', reg0 - 'z' > 0) )

    {

      reg1 = 'A';

      e_flag = reg0 - 'A';

      if ( reg0 - 'A' >= 0 )

      {

        reg1 = 'Z';

        e_flag = reg0 - 'Z';

        if ( reg0 - 'Z' <= 0 )                  // 'A' - 'Z'

        {

          reg0 ^= 75u;

          reg1 = 1;

          --reg0;

        }

      }

    }

    else                                        // 'a' - 'z'

    {

      reg0 ^= 71u;

      reg1 = 1;

      ++reg0;

    }

    v3 = reg0;

    reg1 = reg0 / 16;

    reg0 %= 16;

    push(stack, &rsp_0, v3 / 16);     //push进除16的整数

    push(stack, &rsp_0, reg0);        //push进%16的整数

    reg1 = 1;

  }

  push(stack, &rsp_0, 7);

  push(stack, &rsp_0, 13);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 5);

  push(stack, &rsp_0, 1);

  push(stack, &rsp_0, 12);

  push(stack, &rsp_0, 1);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 13);

  push(stack, &rsp_0, 5);

  push(stack, &rsp_0, 15);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 9);

  push(stack, &rsp_0, 5);

  push(stack, &rsp_0, 15);

  push(stack, &rsp_0, 3);

  push(stack, &rsp_0, 0);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 5);

  push(stack, &rsp_0, 3);

  push(stack, &rsp_0, 3);

  push(stack, &rsp_0, 1);

  push(stack, &rsp_0, 7);

  push(stack, &rsp_0, 7);

  push(stack, &rsp_0, 11);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 1);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 7);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 12);

  push(stack, &rsp_0, 2);

  push(stack, &rsp_0, 2);

  for ( j = 1; ; ++j )

  {

    reg1 = pop(stack, &rsp_0);

    reg0 = pop(stack, &rsp_0);

    e_flag = reg0 - reg1;

    if ( reg0 != reg1 )

      break;

    reg1 = 34;

    e_flag = j - 34;

    if ( j == 34 )

    {

      printf("%s", string[reg3]);

      exit(0);

    }

    reg1 = 1;

  }

  reg3 = 1;

  printf("%s", string[1]);

  exit(0);
}

cmp_data = [0x7,0xd,0x0,0x5,0x1,0xc,0x1,0x0,0x0,0xd,0x5,0xf,0x0,0x9,0x5,0xf,0x3,0x0,0x2,0x5,0x3,0x3,0x1,0x7,0x7,0xb,0x2,0x1,0x2,0x7,0x2,0xc,0x2,0x2,]

cmp_data = cmp_data[::-1]

print(cmp_data)

flag = ''

for i in range(0, 34, 2):

    temp = cmp_data[i] + cmp_data[i+1]*16

    x = ((temp+1) ^ 75)

    y = ((temp-1) ^ 71)

    if (x >= 65) and (x <= 90):    # 'A'-'Z'

        flag += chr(x)

    elif (y >= 97) and (y <= 122):   # 'a' - 'z'

        flag += chr(y)

    else:

        flag += chr(temp)    # 没有处于'a'-'z'或'A'-'Z'之间

print(flag)
# flag{Such_A_EZVM}

cmp_data = [0x7,0xd,0x0,0x5,0x1,0xc,0x1,0x0,0x0,0xd,0x5,0xf,0x0,0x9,0x5,0xf,0x3,0x0,0x2,0x5,0x3,0x3,0x1,0x7,0x7,0xb,0x2,0x1,0x2,0x7,0x2,0xc,0x2,0x2,]

cmp_data = cmp_data[::-1]

print(cmp_data)

flag = ''

for i in range(0, 34, 2):

    temp = cmp_data[i] + cmp_data[i+1]*16

    x = ((temp+1) ^ 75)

    y = ((temp-1) ^ 71)

    if (x >= 65) and (x <= 90):    # 'A'-'Z'

        flag += chr(x)

    elif (y >= 97) and (y <= 122):   # 'a' - 'z'

        flag += chr(y)

    else:

        flag += chr(temp)    # 没有处于'a'-'z'或'A'-'Z'之间

print(flag)
# flag{Such_A_EZVM}

__int64 __fastcall main(int a1, char **a2, char **a3)
{

  void *opcode; // rbx

  FILE *fp; // rbp

  void *v5; // rbx

  char v7[5]; // [rsp+3h] [rbp-25h] BYREF

  unsigned __int64 v8; // [rsp+8h] [rbp-20h]
 
  v8 = __readfsqword(0x28u);

  opcode = malloc(0x400uLL);

  if ( a1 > 1 )

  {

    fp = fopen(a2[1], "rb");

    fread(opcode, 1uLL, 1000uLL, fp);

    fclose(fp);

  }

  code_adr = opcode;

  rip_ = 0;

  rsp_ = 0;

  v5 = malloc(0x100uLL);

  save_local = (__int64)malloc(0x100uLL);

  stack = (__int64)v5;

  v7[0] = 0;

  save_cnt = (__int64)v7;

  v7[1] = 0;

  v7[2] = 0;

  v7[3] = 0;

  v7[4] = 0;

  VM((unsigned int *)&rip_);

  return 0LL;
}

__int64 __fastcall main(int a1, char **a2, char **a3)
{

  void *opcode; // rbx

  FILE *fp; // rbp

  void *v5; // rbx

  char v7[5]; // [rsp+3h] [rbp-25h] BYREF

  unsigned __int64 v8; // [rsp+8h] [rbp-20h]
 
  v8 = __readfsqword(0x28u);

  opcode = malloc(0x400uLL);

  if ( a1 > 1 )

  {

    fp = fopen(a2[1], "rb");

    fread(opcode, 1uLL, 1000uLL, fp);

    fclose(fp);

  }

  code_adr = opcode;

  rip_ = 0;

  rsp_ = 0;

  v5 = malloc(0x100uLL);

  save_local = (__int64)malloc(0x100uLL);

  stack = (__int64)v5;

  v7[0] = 0;

  save_cnt = (__int64)v7;

  v7[1] = 0;

  v7[2] = 0;

  v7[3] = 0;

  v7[4] = 0;

  VM((unsigned int *)&rip_);

  return 0LL;
}

.bss:00000000006020A0 rip_            dd ?                    ; DATA XREF: main+6A↑w

.bss:00000000006020A0                                         ; main+9C↑o

.bss:00000000006020A4 rsp_            dd ?                    ; DATA XREF: main+74↑w

.bss:00000000006020A8 code_adr        dq ?                    ; DATA XREF: main+63↑w

.bss:00000000006020B0 stack           dq ?                    ; DATA XREF: main+A1↑w

.bss:00000000006020B8 save_local      dq ?                    ; DATA XREF: main+90↑w

.bss:00000000006020C0 save_cnt        dq ?                    ; DATA XREF: main+AD↑w

.bss:00000000006020A0 rip_            dd ?                    ; DATA XREF: main+6A↑w

.bss:00000000006020A0                                         ; main+9C↑o

.bss:00000000006020A4 rsp_            dd ?                    ; DATA XREF: main+74↑w

.bss:00000000006020A8 code_adr        dq ?                    ; DATA XREF: main+63↑w

.bss:00000000006020B0 stack           dq ?                    ; DATA XREF: main+A1↑w

.bss:00000000006020B8 save_local      dq ?                    ; DATA XREF: main+90↑w

.bss:00000000006020C0 save_cnt        dq ?                    ; DATA XREF: main+AD↑w
struct _VM{

    dword  rip_;

    dword  rsp_;

    qword* code_adr;

    qword* stack;

    qword* save_local;        //存放本地变量的地方,三个数组

    qword* save_cnt;          //存放计数变量的数组的指针
}VMStruct;
struct _VM{

    dword  rip_;

    dword  rsp_;

    qword* code_adr;

    qword* stack;

    qword* save_local;        //存放本地变量的地方,三个数组

    qword* save_cnt;          //存放计数变量的数组的指针
}VMStruct;

*(_BYTE *)(code + rip__1)             //根据rip执行对应指令,取操作码
 
 *(code + rip__1 + 1)                  //操作数,单操作码才会出现这个变量
 
VMstruct[1]                            //栈顶rsp,表示栈内有几个数据
 
*VMStruct                              //rip
 
*((_QWORD *)VMStruct + 1);             //qword指针+1说明偏移8字节，取到了code
 
*((_QWORD *)VMStruct + 2)              //偏移2个8字节,偏移16字节取到stack
 
*((_QWORD *)VMStruct + 3)              //取到一片用来存储数据(数组)的空间
 
*((_QWORD *)VMStruct + 4)              //取到储存循环变量的地址

*(_BYTE *)(code + rip__1)             //根据rip执行对应指令,取操作码
 
 *(code + rip__1 + 1)                  //操作数,单操作码才会出现这个变量
 
VMstruct[1]                            //栈顶rsp,表示栈内有几个数据
 
*VMStruct                              //rip
 
*((_QWORD *)VMStruct + 1);             //qword指针+1说明偏移8字节，取到了code
 
*((_QWORD *)VMStruct + 2)              //偏移2个8字节,偏移16字节取到stack
 
*((_QWORD *)VMStruct + 3)              //取到一片用来存储数据(数组)的空间
 
*((_QWORD *)VMStruct + 4)              //取到储存循环变量的地址
 
__int64 __fastcall dispatcher(unsigned int *VMStruct)
{

  __int64 code; // rcx

  __int64 rip_; // rax

  __int64 rip__1; // rdx

  unsigned int v5; // eax

  __int64 stack_5; // rcx

  _BYTE *v7; // rdx

  signed int v8; // eax

  char b; // al

  unsigned int v10; // edx

  __int64 save_cnt_1; // rsi

  _BYTE *v12; // rax

  __int64 v13; // rcx

  char v14; // cl

  int data_1; // er8

  signed int v16; // edx

  __int64 v17; // rdi

  signed int v18; // esi

  int v19; // er8

  signed int v20; // edx

  __int64 v21; // rdi

  signed int v22; // esi

  int data; // er8

  signed int v24; // edx

  __int64 v25; // rdi

  signed int v26; // esi

  signed int v27; // edx

  __int64 v28; // rdi

  signed int v29; // esi

  int data_3; // er8

  signed int v31; // edx

  __int64 v32; // rdi

  signed int v33; // esi

  int data_2; // edi

  signed int v35; // edx

  __int64 v36; // r8

  signed int v37; // esi

  signed int v38; // ecx

  _BYTE *v39; // rax

  __int64 stack_3; // rdx

  signed int v41; // eax

  signed int v42; // esi

  char v43; // cl

  char v44; // cl

  signed int v45; // eax

  signed int v46; // esi

  char v47; // cl

  char v48; // cl

  signed int v49; // eax

  signed int v50; // esi

  char v51; // cl

  char v52; // cl

  signed int v53; // eax

  __int64 v54; // rdx

  signed int v55; // esi

  unsigned __int8 v56; // cl

  _BYTE *v57; // rdx

  signed int v58; // eax

  __int64 v59; // rdx

  signed int v60; // ecx

  unsigned __int8 v61; // si

  signed int v62; // edx

  __int64 v63; // rcx

  signed int v64; // esi

  char v65; // al

  signed int v66; // eax

  char v67; // si

  signed int rip__2; // eax

  signed int v69; // esi

  char v70; // cl

  char v71; // cl

  _BYTE *lo_var; // rdx

  __int64 stack_2; // rcx

  signed int v74; // eax

  __int64 reg1; // rax

  __int64 save_local; // rdx

  char reg0; // cl

  __int64 rsp__1; // rax

  __int64 stack_1; // rdx

  __int64 stack; // rdx

  _IO_FILE *v81; // rsi

  signed int rsp_1; // eax

  char input_char; // al

  __int64 rsp_; // rdx

  __int64 stack_4; // rcx
 
  code = *((_QWORD *)VMStruct + 1);

  rip_ = *VMStruct;

  while ( 2 )                                   // 循环

  {

    rip__1 = (int)rip_;
LABEL_3:

    switch ( *(_BYTE *)(code + rip__1) )

    {

      case 1:                                   // getc,push   rip+=1

        input_char = _IO_getc(stdin);

        rsp_ = (int)VMStruct[1];

        stack_4 = *((_QWORD *)VMStruct + 2);

        VMStruct[1] = rsp_ + 1;

        *(_BYTE *)(stack_4 + rsp_) = input_char;

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 2:                                   // pop,putc    rip+=1

        stack = *((_QWORD *)VMStruct + 2);

        v81 = stdout;

        rsp_1 = VMStruct[1] - 1;

        VMStruct[1] = rsp_1;

        _IO_putc(*(unsigned __int8 *)(stack + rsp_1), v81);

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 3:                                   // nop  rip+=1

        rip_ = (unsigned int)(rip_ + 1);

        *VMStruct = rip_;

        continue;

      case 4:                                   // mov reg0, data; push reg0  rip+=2

        reg0 = *(_BYTE *)(code + rip__1 + 1);

        goto push_reg0;

      case 5:                                   // mov reg1, data; mov reg0, *(cnt_adr+reg1); push reg0;     rip += 2

        reg1 = *(unsigned __int8 *)(code + rip__1 + 1);

        save_local = *((_QWORD *)VMStruct + 4);

        goto pop_reg0;

      case 6:                                   // pop *(cnt_adr+data)     rip+=2

        lo_var = (_BYTE *)(*((_QWORD *)VMStruct + 4) + *(unsigned __int8 *)(code + rip__1 + 1));

        goto pop_to_local;

      case 7:                                   // mov reg1, data;  mov reg0, *(save_local + reg1);   push reg0;       rip+=2

        reg1 = *(unsigned __int8 *)(code + rip__1 + 1);

        save_local = *((_QWORD *)VMStruct + 3);
pop_reg0:

        reg0 = *(_BYTE *)(save_local + reg1);
push_reg0:

        rsp__1 = (int)VMStruct[1];

        stack_1 = *((_QWORD *)VMStruct + 2);

        VMStruct[1] = rsp__1 + 1;

        *(_BYTE *)(stack_1 + rsp__1) = reg0;    // push reg0

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 2;                   // get_next_opcode_index

        *VMStruct = rip_;

        continue;

      case 8:                                   // pop *(save_local+data)    rip+=2

        lo_var = (_BYTE *)(*((_QWORD *)VMStruct + 3) + *(unsigned __int8 *)(code + rip__1 + 1));// get_local_adr
pop_to_local:

        stack_2 = *((_QWORD *)VMStruct + 2);

        v74 = VMStruct[1] - 1;

        VMStruct[1] = v74;

        *lo_var = *(_BYTE *)(stack_2 + v74);

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 2;

        *VMStruct = rip_;

        continue;

      case 9:                                   // pop rax; pop rbx; push rbx+rax;      rip+= 1

        rip__2 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v69 = rip__2 - 1;

        rip__2 -= 2;

        VMStruct[1] = v69;

        v70 = *(_BYTE *)(stack_3 + v69);

        VMStruct[1] = rip__2;

        v39 = (_BYTE *)(stack_3 + rip__2);

        v71 = *v39 + v70;

        VMStruct[1] = v69;

        LOBYTE(stack_3) = v71;

        goto LABEL_28;

      case 10:                                  // pop rax; pop rbx; push rbx-rax;      rip+= 1

        v66 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v38 = v66 - 1;

        v66 -= 2;

        VMStruct[1] = v38;

        v67 = *(_BYTE *)(stack_3 + v38);

        VMStruct[1] = v66;

        v39 = (_BYTE *)(stack_3 + v66);

        LOBYTE(stack_3) = *v39 - v67;

        goto LABEL_27;

      case 11:                                  // pop rax; pop rbx; push rbx*rax;      rip+= 1

        v62 = VMStruct[1];

        v63 = *((_QWORD *)VMStruct + 2);

        v64 = v62 - 1;

        v62 -= 2;

        VMStruct[1] = v64;

        v65 = *(_BYTE *)(v63 + v64);

        VMStruct[1] = v62;

        v7 = (_BYTE *)(v63 + v62);

        b = *v7 * v65;

        VMStruct[1] = v64;

        goto LABEL_8;

      case 12:                                  // pop rax; pop rbx; push rbx/rax;      rip+= 1

        v58 = VMStruct[1];

        v59 = *((_QWORD *)VMStruct + 2);

        v60 = v58 - 1;

        v58 -= 2;

        VMStruct[1] = v60;

        v61 = *(_BYTE *)(v59 + v60);

        VMStruct[1] = v58;

        v7 = (_BYTE *)(v58 + v59);

        rip_ = (unsigned __int8)*v7;

        if ( !v61 )

          return rip_;

        VMStruct[1] = v60;

        b = (unsigned __int16)rip_ / v61;

        goto LABEL_8;

      case 13:                                  // pop rax; pop rbx; push rbx%rax;      rip+= 1

        v53 = VMStruct[1];

        v54 = *((_QWORD *)VMStruct + 2);

        v55 = v53 - 1;

        v53 -= 2;

        VMStruct[1] = v55;

        v56 = *(_BYTE *)(v54 + v55);

        VMStruct[1] = v53;

        v57 = (_BYTE *)(v53 + v54);

        LOWORD(v53) = (unsigned __int8)*v57;

        VMStruct[1] = v55;

        rip_ = (unsigned __int8)((unsigned __int16)v53 % v56);

        *v57 = rip_;

        if ( !v56 )

          return rip_;

        goto LABEL_9;

      case 14:                                  // pop eax;  pop ebx;  push ebx^eax;      rip+= 1

        v49 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v50 = v49 - 1;

        v49 -= 2;

        VMStruct[1] = v50;

        v51 = *(_BYTE *)(stack_3 + v50);

        VMStruct[1] = v49;

        v39 = (_BYTE *)(stack_3 + v49);

        v52 = *v39 ^ v51;

        VMStruct[1] = v50;

        LOBYTE(stack_3) = v52;

        goto LABEL_28;

      case 15:                                  // pop rax; pop rbx; push rbx&rax;      rip+= 1

        v45 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v46 = v45 - 1;

        v45 -= 2;

        VMStruct[1] = v46;

        v47 = *(_BYTE *)(stack_3 + v46);

        VMStruct[1] = v45;

        v39 = (_BYTE *)(stack_3 + v45);

        v48 = *v39 & v47;

        VMStruct[1] = v46;

        LOBYTE(stack_3) = v48;

        goto LABEL_28;

      case 16:                                  // pop rax; pop rbx; push rbx|rax;      rip+= 1

        v41 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v42 = v41 - 1;

        v41 -= 2;

        VMStruct[1] = v42;

        v43 = *(_BYTE *)(stack_3 + v42);

        VMStruct[1] = v41;

        v39 = (_BYTE *)(stack_3 + v41);

        v44 = *v39 | v43;

        VMStruct[1] = v42;

        LOBYTE(stack_3) = v44;

        goto LABEL_28;

      case 17:                                  // pop reg;  push -reg;      rip+=1

        v38 = VMStruct[1];

        VMStruct[1] = v38 - 1;

        v39 = (_BYTE *)(*((_QWORD *)VMStruct + 2) + v38 - 1);

        LODWORD(stack_3) = -(unsigned __int8)*v39;

        goto LABEL_27;

      case 18:                                  // pop reg; push ~reg;       rip+=1

        v38 = VMStruct[1];

        VMStruct[1] = v38 - 1;

        v39 = (_BYTE *)(*((_QWORD *)VMStruct + 2) + v38 - 1);

        LOBYTE(stack_3) = ~*v39;
LABEL_27:

        VMStruct[1] = v38;
LABEL_28:

        *v39 = stack_3;

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 19:                                  // pop rax; pop rbx; if stack[rax] != stack[rbx]: rip+=2

                                                // else    rip+=data

        data_1 = *(unsigned __int8 *)(code + rip__1 + 1);

        v27 = VMStruct[1];

        v28 = *((_QWORD *)VMStruct + 2);

        v29 = v27 - 1;

        v27 -= 2;

        VMStruct[1] = v29;

        LOBYTE(v29) = *(_BYTE *)(v28 + v29);

        VMStruct[1] = v27;

        if ( *(_BYTE *)(v28 + v27) != (_BYTE)v29 )

          goto LABEL_21;

        goto LABEL_15;

      case 20:                                  // pop rax; pop rbx; if stack[rax] == stack[rbx]: rip+=2

                                                // else   rip+=data

        data_2 = *(char *)(code + rip__1 + 1);

        v35 = VMStruct[1];

        v36 = *((_QWORD *)VMStruct + 2);

        v37 = v35 - 1;

        v35 -= 2;

        VMStruct[1] = v37;

        LOBYTE(v37) = *(_BYTE *)(v36 + v37);

        VMStruct[1] = v35;

        if ( *(_BYTE *)(v36 + v35) == (_BYTE)v37 )

          goto LABEL_21;

        rip_ = (unsigned int)(data_2 + rip_);

        *VMStruct = rip_;

        continue;

      case 21:                                  // pop rax; pop rbx; if stack[rax] >= stack[rbx]: rip+=2

        data_3 = *(char *)(code + rip__1 + 1);  // else: rip+=data

        v31 = VMStruct[1];

        v32 = *((_QWORD *)VMStruct + 2);

        v33 = v31 - 1;

        v31 -= 2;

        VMStruct[1] = v33;

        LOBYTE(v33) = *(_BYTE *)(v32 + v33);

        VMStruct[1] = v31;

        if ( *(_BYTE *)(v32 + v31) <= (unsigned __int8)v33 )

          goto LABEL_21;

        rip_ = (unsigned int)(data_3 + rip_);

        *VMStruct = rip_;

        continue;

      case 22:                                  // pop rax; pop rbx; if stack[rax] > stack[rbx]: rip+=2

        data = *(char *)(code + rip__1 + 1);    // else: rip+=data

        v24 = VMStruct[1];

        v25 = *((_QWORD *)VMStruct + 2);

        v26 = v24 - 1;

        v24 -= 2;

        VMStruct[1] = v26;

        LOBYTE(v26) = *(_BYTE *)(v25 + v26);

        VMStruct[1] = v24;

        if ( *(_BYTE *)(v25 + v24) < (unsigned __int8)v26 )

          goto LABEL_21;

        rip_ = (unsigned int)(data + rip_);

        *VMStruct = rip_;

        continue;

      case 23:                                  // pop rax; pop rbx; if stack[rax] <= stack[rbx]: rip+=2

        v19 = *(char *)(code + rip__1 + 1);     // else: rip+=data

        v20 = VMStruct[1];

        v21 = *((_QWORD *)VMStruct + 2);

        v22 = v20 - 1;

        v20 -= 2;

        VMStruct[1] = v22;

        LOBYTE(v22) = *(_BYTE *)(v21 + v22);

        VMStruct[1] = v20;

        if ( *(_BYTE *)(v21 + v20) >= (unsigned __int8)v22 )

          goto LABEL_21;

        rip_ = (unsigned int)(v19 + rip_);

        *VMStruct = rip_;

        continue;

      case 24:                                  // pop rax; pop rbx; if stack[rax] < stack[rbx]: rip+=2

        data_1 = *(char *)(code + rip__1 + 1);  // else  rip+=data

        v16 = VMStruct[1];

        v17 = *((_QWORD *)VMStruct + 2);

        v18 = v16 - 1;

        v16 -= 2;

        VMStruct[1] = v18;

        LOBYTE(v18) = *(_BYTE *)(v17 + v18);

        VMStruct[1] = v16;

        if ( *(_BYTE *)(v17 + v16) > (unsigned __int8)v18 )

        {
LABEL_21:

          rip_ = (unsigned int)(rip_ + 2);

          *VMStruct = rip_;

        }

        else

        {
LABEL_15:

          rip_ = (unsigned int)(data_1 + rip_);

          *VMStruct = rip_;

        }

        continue;

      case 25:                                  // pop rax;  push *(save_local+rax)      rip+=1

        v10 = VMStruct[1];

        save_cnt_1 = *((_QWORD *)VMStruct + 3);

        VMStruct[1] = v10 - 1;

        v12 = (_BYTE *)(*((_QWORD *)VMStruct + 2) + (int)(v10 - 1));

        v13 = (unsigned __int8)*v12;

        goto LABEL_11;

      case 26:                                  // pop rax;  pop rbx;  mov *(save_local+rax), rbx

        v5 = VMStruct[1];

        stack_5 = *((_QWORD *)VMStruct + 2);

        VMStruct[1] = v5 - 1;

        v7 = (_BYTE *)(*((_QWORD *)VMStruct + 3) + *(unsigned __int8 *)(stack_5 + (int)(v5 - 1)));

        goto LABEL_7;

      case 27:                                  // pop rax;   push *(save_cnt+rax)        rip+=1

        v10 = VMStruct[1];

        save_cnt_1 = *((_QWORD *)VMStruct + 4);

        VMStruct[1] = v10 - 1;

        v12 = (_BYTE *)(*((_QWORD *)VMStruct + 2) + (int)(v10 - 1));

        v13 = (unsigned __int8)*v12;
LABEL_11:

        v14 = *(_BYTE *)(save_cnt_1 + v13);

        VMStruct[1] = v10;

        *v12 = v14;

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 28:                                  // pop rax; pop rbx; mov *(save_cnt+rax), rbx;   rip+=1

        v5 = VMStruct[1];

        stack_5 = *((_QWORD *)VMStruct + 2);

        VMStruct[1] = v5 - 1;

        v7 = (_BYTE *)(*((_QWORD *)VMStruct + 4) + *(unsigned __int8 *)(stack_5 + (int)(v5 - 1)));
LABEL_7:

        v8 = v5 - 2;

        VMStruct[1] = v8;

        b = *(_BYTE *)(stack_5 + v8);
LABEL_8:

        *v7 = b;
LABEL_9:

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 29:                                  // if *(code+data) <= 29: while_continue

                                                // else:  return

                                                // (这个功能就是判断是否执行到了最后,因为给的opcode最后一个就是30)

        rip_ = (unsigned int)(*(char *)(code + rip__1 + 1) + (_DWORD)rip_);

        rip__1 = (int)rip_;

        *VMStruct = rip_;

        if ( *(_BYTE *)(code + (int)rip_) <= 29u )

          goto LABEL_3;

        return rip_;

      default:

        return rip_;

    }

  }
}

__int64 __fastcall dispatcher(unsigned int *VMStruct)
{

  __int64 code; // rcx

  __int64 rip_; // rax

  __int64 rip__1; // rdx

  unsigned int v5; // eax

  __int64 stack_5; // rcx

  _BYTE *v7; // rdx

  signed int v8; // eax

  char b; // al

  unsigned int v10; // edx

  __int64 save_cnt_1; // rsi

  _BYTE *v12; // rax

  __int64 v13; // rcx

  char v14; // cl

  int data_1; // er8

  signed int v16; // edx

  __int64 v17; // rdi

  signed int v18; // esi

  int v19; // er8

  signed int v20; // edx

  __int64 v21; // rdi

  signed int v22; // esi

  int data; // er8

  signed int v24; // edx

  __int64 v25; // rdi

  signed int v26; // esi

  signed int v27; // edx

  __int64 v28; // rdi

  signed int v29; // esi

  int data_3; // er8

  signed int v31; // edx

  __int64 v32; // rdi

  signed int v33; // esi

  int data_2; // edi

  signed int v35; // edx

  __int64 v36; // r8

  signed int v37; // esi

  signed int v38; // ecx

  _BYTE *v39; // rax

  __int64 stack_3; // rdx

  signed int v41; // eax

  signed int v42; // esi

  char v43; // cl

  char v44; // cl

  signed int v45; // eax

  signed int v46; // esi

  char v47; // cl

  char v48; // cl

  signed int v49; // eax

  signed int v50; // esi

  char v51; // cl

  char v52; // cl

  signed int v53; // eax

  __int64 v54; // rdx

  signed int v55; // esi

  unsigned __int8 v56; // cl

  _BYTE *v57; // rdx

  signed int v58; // eax

  __int64 v59; // rdx

  signed int v60; // ecx

  unsigned __int8 v61; // si

  signed int v62; // edx

  __int64 v63; // rcx

  signed int v64; // esi

  char v65; // al

  signed int v66; // eax

  char v67; // si

  signed int rip__2; // eax

  signed int v69; // esi

  char v70; // cl

  char v71; // cl

  _BYTE *lo_var; // rdx

  __int64 stack_2; // rcx

  signed int v74; // eax

  __int64 reg1; // rax

  __int64 save_local; // rdx

  char reg0; // cl

  __int64 rsp__1; // rax

  __int64 stack_1; // rdx

  __int64 stack; // rdx

  _IO_FILE *v81; // rsi

  signed int rsp_1; // eax

  char input_char; // al

  __int64 rsp_; // rdx

  __int64 stack_4; // rcx
 
  code = *((_QWORD *)VMStruct + 1);

  rip_ = *VMStruct;

  while ( 2 )                                   // 循环

  {

    rip__1 = (int)rip_;
LABEL_3:

    switch ( *(_BYTE *)(code + rip__1) )

    {

      case 1:                                   // getc,push   rip+=1

        input_char = _IO_getc(stdin);

        rsp_ = (int)VMStruct[1];

        stack_4 = *((_QWORD *)VMStruct + 2);

        VMStruct[1] = rsp_ + 1;

        *(_BYTE *)(stack_4 + rsp_) = input_char;

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 2:                                   // pop,putc    rip+=1

        stack = *((_QWORD *)VMStruct + 2);

        v81 = stdout;

        rsp_1 = VMStruct[1] - 1;

        VMStruct[1] = rsp_1;

        _IO_putc(*(unsigned __int8 *)(stack + rsp_1), v81);

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 3:                                   // nop  rip+=1

        rip_ = (unsigned int)(rip_ + 1);

        *VMStruct = rip_;

        continue;

      case 4:                                   // mov reg0, data; push reg0  rip+=2

        reg0 = *(_BYTE *)(code + rip__1 + 1);

        goto push_reg0;

      case 5:                                   // mov reg1, data; mov reg0, *(cnt_adr+reg1); push reg0;     rip += 2

        reg1 = *(unsigned __int8 *)(code + rip__1 + 1);

        save_local = *((_QWORD *)VMStruct + 4);

        goto pop_reg0;

      case 6:                                   // pop *(cnt_adr+data)     rip+=2

        lo_var = (_BYTE *)(*((_QWORD *)VMStruct + 4) + *(unsigned __int8 *)(code + rip__1 + 1));

        goto pop_to_local;

      case 7:                                   // mov reg1, data;  mov reg0, *(save_local + reg1);   push reg0;       rip+=2

        reg1 = *(unsigned __int8 *)(code + rip__1 + 1);

        save_local = *((_QWORD *)VMStruct + 3);
pop_reg0:

        reg0 = *(_BYTE *)(save_local + reg1);
push_reg0:

        rsp__1 = (int)VMStruct[1];

        stack_1 = *((_QWORD *)VMStruct + 2);

        VMStruct[1] = rsp__1 + 1;

        *(_BYTE *)(stack_1 + rsp__1) = reg0;    // push reg0

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 2;                   // get_next_opcode_index

        *VMStruct = rip_;

        continue;

      case 8:                                   // pop *(save_local+data)    rip+=2

        lo_var = (_BYTE *)(*((_QWORD *)VMStruct + 3) + *(unsigned __int8 *)(code + rip__1 + 1));// get_local_adr
pop_to_local:

        stack_2 = *((_QWORD *)VMStruct + 2);

        v74 = VMStruct[1] - 1;

        VMStruct[1] = v74;

        *lo_var = *(_BYTE *)(stack_2 + v74);

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 2;

        *VMStruct = rip_;

        continue;

      case 9:                                   // pop rax; pop rbx; push rbx+rax;      rip+= 1

        rip__2 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v69 = rip__2 - 1;

        rip__2 -= 2;

        VMStruct[1] = v69;

        v70 = *(_BYTE *)(stack_3 + v69);

        VMStruct[1] = rip__2;

        v39 = (_BYTE *)(stack_3 + rip__2);

        v71 = *v39 + v70;

        VMStruct[1] = v69;

        LOBYTE(stack_3) = v71;

        goto LABEL_28;

      case 10:                                  // pop rax; pop rbx; push rbx-rax;      rip+= 1

        v66 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v38 = v66 - 1;

        v66 -= 2;

        VMStruct[1] = v38;

        v67 = *(_BYTE *)(stack_3 + v38);

        VMStruct[1] = v66;

        v39 = (_BYTE *)(stack_3 + v66);

        LOBYTE(stack_3) = *v39 - v67;

        goto LABEL_27;

      case 11:                                  // pop rax; pop rbx; push rbx*rax;      rip+= 1

        v62 = VMStruct[1];

        v63 = *((_QWORD *)VMStruct + 2);

        v64 = v62 - 1;

        v62 -= 2;

        VMStruct[1] = v64;

        v65 = *(_BYTE *)(v63 + v64);

        VMStruct[1] = v62;

        v7 = (_BYTE *)(v63 + v62);

        b = *v7 * v65;

        VMStruct[1] = v64;

        goto LABEL_8;

      case 12:                                  // pop rax; pop rbx; push rbx/rax;      rip+= 1

        v58 = VMStruct[1];

        v59 = *((_QWORD *)VMStruct + 2);

        v60 = v58 - 1;

        v58 -= 2;

        VMStruct[1] = v60;

        v61 = *(_BYTE *)(v59 + v60);

        VMStruct[1] = v58;

        v7 = (_BYTE *)(v58 + v59);

        rip_ = (unsigned __int8)*v7;

        if ( !v61 )

          return rip_;

        VMStruct[1] = v60;

        b = (unsigned __int16)rip_ / v61;

        goto LABEL_8;

      case 13:                                  // pop rax; pop rbx; push rbx%rax;      rip+= 1

        v53 = VMStruct[1];

        v54 = *((_QWORD *)VMStruct + 2);

        v55 = v53 - 1;

        v53 -= 2;

        VMStruct[1] = v55;

        v56 = *(_BYTE *)(v54 + v55);

        VMStruct[1] = v53;

        v57 = (_BYTE *)(v53 + v54);

        LOWORD(v53) = (unsigned __int8)*v57;

        VMStruct[1] = v55;

        rip_ = (unsigned __int8)((unsigned __int16)v53 % v56);

        *v57 = rip_;

        if ( !v56 )

          return rip_;

        goto LABEL_9;

      case 14:                                  // pop eax;  pop ebx;  push ebx^eax;      rip+= 1

        v49 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v50 = v49 - 1;

        v49 -= 2;

        VMStruct[1] = v50;

        v51 = *(_BYTE *)(stack_3 + v50);

        VMStruct[1] = v49;

        v39 = (_BYTE *)(stack_3 + v49);

        v52 = *v39 ^ v51;

        VMStruct[1] = v50;

        LOBYTE(stack_3) = v52;

        goto LABEL_28;

      case 15:                                  // pop rax; pop rbx; push rbx&rax;      rip+= 1

        v45 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v46 = v45 - 1;

        v45 -= 2;

        VMStruct[1] = v46;

        v47 = *(_BYTE *)(stack_3 + v46);

        VMStruct[1] = v45;

        v39 = (_BYTE *)(stack_3 + v45);

        v48 = *v39 & v47;

        VMStruct[1] = v46;

        LOBYTE(stack_3) = v48;

        goto LABEL_28;

      case 16:                                  // pop rax; pop rbx; push rbx|rax;      rip+= 1

        v41 = VMStruct[1];

        stack_3 = *((_QWORD *)VMStruct + 2);

        v42 = v41 - 1;

        v41 -= 2;

        VMStruct[1] = v42;

        v43 = *(_BYTE *)(stack_3 + v42);

        VMStruct[1] = v41;

        v39 = (_BYTE *)(stack_3 + v41);

        v44 = *v39 | v43;

        VMStruct[1] = v42;

        LOBYTE(stack_3) = v44;

        goto LABEL_28;

      case 17:                                  // pop reg;  push -reg;      rip+=1

        v38 = VMStruct[1];

        VMStruct[1] = v38 - 1;

        v39 = (_BYTE *)(*((_QWORD *)VMStruct + 2) + v38 - 1);

        LODWORD(stack_3) = -(unsigned __int8)*v39;

        goto LABEL_27;

      case 18:                                  // pop reg; push ~reg;       rip+=1

        v38 = VMStruct[1];

        VMStruct[1] = v38 - 1;

        v39 = (_BYTE *)(*((_QWORD *)VMStruct + 2) + v38 - 1);

        LOBYTE(stack_3) = ~*v39;
LABEL_27:

        VMStruct[1] = v38;
LABEL_28:

        *v39 = stack_3;

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 19:                                  // pop rax; pop rbx; if stack[rax] != stack[rbx]: rip+=2

                                                // else    rip+=data

        data_1 = *(unsigned __int8 *)(code + rip__1 + 1);

        v27 = VMStruct[1];

        v28 = *((_QWORD *)VMStruct + 2);

        v29 = v27 - 1;

        v27 -= 2;

        VMStruct[1] = v29;

        LOBYTE(v29) = *(_BYTE *)(v28 + v29);

        VMStruct[1] = v27;

        if ( *(_BYTE *)(v28 + v27) != (_BYTE)v29 )

          goto LABEL_21;

        goto LABEL_15;

      case 20:                                  // pop rax; pop rbx; if stack[rax] == stack[rbx]: rip+=2

                                                // else   rip+=data

        data_2 = *(char *)(code + rip__1 + 1);

        v35 = VMStruct[1];

        v36 = *((_QWORD *)VMStruct + 2);

        v37 = v35 - 1;

        v35 -= 2;

        VMStruct[1] = v37;

        LOBYTE(v37) = *(_BYTE *)(v36 + v37);

        VMStruct[1] = v35;

        if ( *(_BYTE *)(v36 + v35) == (_BYTE)v37 )

          goto LABEL_21;

        rip_ = (unsigned int)(data_2 + rip_);

        *VMStruct = rip_;

        continue;

      case 21:                                  // pop rax; pop rbx; if stack[rax] >= stack[rbx]: rip+=2

        data_3 = *(char *)(code + rip__1 + 1);  // else: rip+=data

        v31 = VMStruct[1];

        v32 = *((_QWORD *)VMStruct + 2);

        v33 = v31 - 1;

        v31 -= 2;

        VMStruct[1] = v33;

        LOBYTE(v33) = *(_BYTE *)(v32 + v33);

        VMStruct[1] = v31;

        if ( *(_BYTE *)(v32 + v31) <= (unsigned __int8)v33 )

          goto LABEL_21;

        rip_ = (unsigned int)(data_3 + rip_);

        *VMStruct = rip_;

        continue;

      case 22:                                  // pop rax; pop rbx; if stack[rax] > stack[rbx]: rip+=2

        data = *(char *)(code + rip__1 + 1);    // else: rip+=data

        v24 = VMStruct[1];

        v25 = *((_QWORD *)VMStruct + 2);

        v26 = v24 - 1;

        v24 -= 2;

        VMStruct[1] = v26;

        LOBYTE(v26) = *(_BYTE *)(v25 + v26);

        VMStruct[1] = v24;

        if ( *(_BYTE *)(v25 + v24) < (unsigned __int8)v26 )

          goto LABEL_21;

        rip_ = (unsigned int)(data + rip_);

        *VMStruct = rip_;

        continue;

      case 23:                                  // pop rax; pop rbx; if stack[rax] <= stack[rbx]: rip+=2

        v19 = *(char *)(code + rip__1 + 1);     // else: rip+=data

        v20 = VMStruct[1];

        v21 = *((_QWORD *)VMStruct + 2);

        v22 = v20 - 1;

        v20 -= 2;

        VMStruct[1] = v22;

        LOBYTE(v22) = *(_BYTE *)(v21 + v22);

        VMStruct[1] = v20;

        if ( *(_BYTE *)(v21 + v20) >= (unsigned __int8)v22 )

          goto LABEL_21;

        rip_ = (unsigned int)(v19 + rip_);

        *VMStruct = rip_;

        continue;

      case 24:                                  // pop rax; pop rbx; if stack[rax] < stack[rbx]: rip+=2

        data_1 = *(char *)(code + rip__1 + 1);  // else  rip+=data

        v16 = VMStruct[1];

        v17 = *((_QWORD *)VMStruct + 2);

        v18 = v16 - 1;

        v16 -= 2;

        VMStruct[1] = v18;

        LOBYTE(v18) = *(_BYTE *)(v17 + v18);

        VMStruct[1] = v16;

        if ( *(_BYTE *)(v17 + v16) > (unsigned __int8)v18 )

        {
LABEL_21:

          rip_ = (unsigned int)(rip_ + 2);

          *VMStruct = rip_;

        }

        else

        {
LABEL_15:

          rip_ = (unsigned int)(data_1 + rip_);

          *VMStruct = rip_;

        }

        continue;

      case 25:                                  // pop rax;  push *(save_local+rax)      rip+=1

        v10 = VMStruct[1];

        save_cnt_1 = *((_QWORD *)VMStruct + 3);

        VMStruct[1] = v10 - 1;

        v12 = (_BYTE *)(*((_QWORD *)VMStruct + 2) + (int)(v10 - 1));

        v13 = (unsigned __int8)*v12;

        goto LABEL_11;

      case 26:                                  // pop rax;  pop rbx;  mov *(save_local+rax), rbx

        v5 = VMStruct[1];

        stack_5 = *((_QWORD *)VMStruct + 2);

        VMStruct[1] = v5 - 1;

        v7 = (_BYTE *)(*((_QWORD *)VMStruct + 3) + *(unsigned __int8 *)(stack_5 + (int)(v5 - 1)));

        goto LABEL_7;

      case 27:                                  // pop rax;   push *(save_cnt+rax)        rip+=1

        v10 = VMStruct[1];

        save_cnt_1 = *((_QWORD *)VMStruct + 4);

        VMStruct[1] = v10 - 1;

        v12 = (_BYTE *)(*((_QWORD *)VMStruct + 2) + (int)(v10 - 1));

        v13 = (unsigned __int8)*v12;
LABEL_11:

        v14 = *(_BYTE *)(save_cnt_1 + v13);

        VMStruct[1] = v10;

        *v12 = v14;

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 28:                                  // pop rax; pop rbx; mov *(save_cnt+rax), rbx;   rip+=1

        v5 = VMStruct[1];

        stack_5 = *((_QWORD *)VMStruct + 2);

        VMStruct[1] = v5 - 1;

        v7 = (_BYTE *)(*((_QWORD *)VMStruct + 4) + *(unsigned __int8 *)(stack_5 + (int)(v5 - 1)));
LABEL_7:

        v8 = v5 - 2;

        VMStruct[1] = v8;

        b = *(_BYTE *)(stack_5 + v8);
LABEL_8:

        *v7 = b;
LABEL_9:

        code = *((_QWORD *)VMStruct + 1);

        rip_ = *VMStruct + 1;

        *VMStruct = rip_;

        continue;

      case 29:                                  // if *(code+data) <= 29: while_continue

                                                // else:  return

                                                // (这个功能就是判断是否执行到了最后,因为给的opcode最后一个就是30)

        rip_ = (unsigned int)(*(char *)(code + rip__1 + 1) + (_DWORD)rip_);

        rip__1 = (int)rip_;

        *VMStruct = rip_;

        if ( *(_BYTE *)(code + (int)rip_) <= 29u )

          goto LABEL_3;

        return rip_;

      default:

        return rip_;

    }

  }
}
 
opcode_key = {

    1: "getc,push",

    2: "pop,putc",

    3: "nop",

    4: "mov reg0,{};  push reg0",

    5: "mov reg1,{};  mov reg0,*(cnt_adr+reg1);  push reg0",

    6: "pop *(cnt_adr+{})",

    7: "mov reg1,{};  mov reg0,*(save_cnt + reg1);  push reg0",

    8: "pop *(save_local+{})",

    9: "pop rax;  pop rbx;  push rbx+rax",

    10: "pop rax;  pop rbx;  push rbx-rax",

    11: "pop rax;  pop rbx;  push rbx*rax",

    12: "pop rax;  pop rbx;  push rbx/rax",

    13: "pop rax;  pop rbx;  push rbx%rax",

    14: "pop eax;  pop ebx;  push ebx^eax",

    15: "pop rax;  pop rbx;  push rbx&rax",

    16: "pop rax;  pop rbx;  push rbx|rax",

    17: "pop reg;  push (-reg)",

    18: "pop reg;  push ~(reg)",

    19: "pop rax;  pop rbx;  if stack[rax]!=stack[rbx]:rip+=2  else:rip+={}",

    20: "pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+={}",

    21: "pop rax;  pop rbx;  if stack[rax]>=stack[rbx]:rip+=2  else:rip+={}",

    22: "pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+={}",

    23: "pop rax;  pop rbx;  if stack[rax]<=stack[rbx]:rip+=2  else:rip+={}",

    24: "pop rax;  pop rbx;  if stack[rax]<stack[rbx]:rip+=2  else:rip+={}",

    25: "pop rax;  push *(save_local+rax)",

    26: "pop rax;  pop rbx;  mov *(save_local+rax), rbx",

    27: "pop rax;  push *(save_cnt+rax)",

    28: "pop rax;  pop rbx; mov *(save_cnt+rax), rbx",

    29: "exit",

    30: "exit"

    }

opcode_key = {

    1: "getc,push",

    2: "pop,putc",

    3: "nop",

    4: "mov reg0,{};  push reg0",

    5: "mov reg1,{};  mov reg0,*(cnt_adr+reg1);  push reg0",

    6: "pop *(cnt_adr+{})",

    7: "mov reg1,{};  mov reg0,*(save_cnt + reg1);  push reg0",

    8: "pop *(save_local+{})",

    9: "pop rax;  pop rbx;  push rbx+rax",

    10: "pop rax;  pop rbx;  push rbx-rax",

    11: "pop rax;  pop rbx;  push rbx*rax",

    12: "pop rax;  pop rbx;  push rbx/rax",

    13: "pop rax;  pop rbx;  push rbx%rax",

    14: "pop eax;  pop ebx;  push ebx^eax",

    15: "pop rax;  pop rbx;  push rbx&rax",

    16: "pop rax;  pop rbx;  push rbx|rax",

    17: "pop reg;  push (-reg)",

    18: "pop reg;  push ~(reg)",

    19: "pop rax;  pop rbx;  if stack[rax]!=stack[rbx]:rip+=2  else:rip+={}",

    20: "pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+={}",

    21: "pop rax;  pop rbx;  if stack[rax]>=stack[rbx]:rip+=2  else:rip+={}",

    22: "pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+={}",

    23: "pop rax;  pop rbx;  if stack[rax]<=stack[rbx]:rip+=2  else:rip+={}",

    24: "pop rax;  pop rbx;  if stack[rax]<stack[rbx]:rip+=2  else:rip+={}",

    25: "pop rax;  push *(save_local+rax)",

    26: "pop rax;  pop rbx;  mov *(save_local+rax), rbx",

    27: "pop rax;  push *(save_cnt+rax)",

    28: "pop rax;  pop rbx; mov *(save_cnt+rax), rbx",

    29: "exit",

    30: "exit"

    }

opcode_key = {

    1: "push getc",

    2: "putc pop",

    3: "nop",

    4: "push {}",

    5: "push *(cnt_adr+{})",

    6: "pop *(cnt_adr+{})",

    7: "push *(save_local + {})",

    8: "pop *(save_local+{})",

    9: "pop rax;  pop rbx;  push rbx+rax",

    10: "pop rax;  pop rbx;  push rbx-rax",

    11: "pop rax;  pop rbx;  push rbx*rax",

    12: "pop rax;  pop rbx;  push rbx/rax",

    13: "pop rax;  pop rbx;  push rbx%rax",

    14: "pop eax;  pop ebx;  push ebx^eax",

    15: "pop rax;  pop rbx;  push rbx&rax",

    16: "pop rax;  pop rbx;  push rbx|rax",

    17: "pop reg;  push (-reg)",

    18: "pop reg;  push ~(reg)",

    19: "pop rax;  pop rbx;  if stack[rax]!=stack[rbx]:rip+=2  else:rip+={}",

    20: "pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+={}",

    21: "pop rax;  pop rbx;  if stack[rax]>=stack[rbx]:rip+=2  else:rip+={}",

    22: "pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+={}",

    23: "pop rax;  pop rbx;  if stack[rax]<=stack[rbx]:rip+=2  else:rip+={}",

    24: "pop rax;  pop rbx;  if stack[rax]<stack[rbx]:rip+=2  else:rip+={}",

    25: "pop rax;  push *(save_local+rax)",

    26: "pop rax;  pop rbx;  mov *(save_local+rax), rbx",

    27: "pop rax;  push *(save_cnt+rax)",

    28: "pop rax;  pop rbx; mov *(save_cnt+rax), rbx",

    29: "jmp {}",

    30: "exit"

    }

opcode_key = {

    1: "push getc",

    2: "putc pop",

    3: "nop",

    4: "push {}",

    5: "push *(cnt_adr+{})",

    6: "pop *(cnt_adr+{})",

    7: "push *(save_local + {})",

    8: "pop *(save_local+{})",

    9: "pop rax;  pop rbx;  push rbx+rax",

    10: "pop rax;  pop rbx;  push rbx-rax",

    11: "pop rax;  pop rbx;  push rbx*rax",

    12: "pop rax;  pop rbx;  push rbx/rax",

    13: "pop rax;  pop rbx;  push rbx%rax",

    14: "pop eax;  pop ebx;  push ebx^eax",

    15: "pop rax;  pop rbx;  push rbx&rax",

    16: "pop rax;  pop rbx;  push rbx|rax",

    17: "pop reg;  push (-reg)",

    18: "pop reg;  push ~(reg)",

    19: "pop rax;  pop rbx;  if stack[rax]!=stack[rbx]:rip+=2  else:rip+={}",

    20: "pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+={}",

    21: "pop rax;  pop rbx;  if stack[rax]>=stack[rbx]:rip+=2  else:rip+={}",

    22: "pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+={}",

    23: "pop rax;  pop rbx;  if stack[rax]<=stack[rbx]:rip+=2  else:rip+={}",

    24: "pop rax;  pop rbx;  if stack[rax]<stack[rbx]:rip+=2  else:rip+={}",

    25: "pop rax;  push *(save_local+rax)",

    26: "pop rax;  pop rbx;  mov *(save_local+rax), rbx",

    27: "pop rax;  push *(save_cnt+rax)",

    28: "pop rax;  pop rbx; mov *(save_cnt+rax), rbx",

    29: "jmp {}",

    30: "exit"

    }
# _*_ coding: utf-8 _*_
# editor: SYJ
# function: Reversed By SYJ
# describe:
"""
# first_part: 给一个数组赋值
code_index = 0          # x在opcode_team中的下标
while code_index <= 0xA6:

    x = opcode_team[code_index]

    if x in opcode_key:

        print(opcode_key[x].format(hex(opcode_team[code_index+1])))

        code_index += 2
# print(hex(code_index))
[0x66, 0x4E, 0xA9, 0xFD, 0x3C, 0x55, 0x90, 0x24, 0x57, 0xF6, 0x5D, 0xB1, 0x01, 0x20, 0x81, 0xFD, 0x36, 0xA9, 0x1F, 0xA1, 0x0E, 0x0D, 0x80, 0x8F, 0xCE, 0x77, 0xE8, 0x23, 0x9E, 0x27, 0x60, 0x2F, 0xA5, 0xCF, 0x1B, 0xBD, 0x32, 0xDB, 0xFF, 0x28, 0xA4, 0x5D]
 
# second_part
while code_index <= 0x124:

    x = opcode_team[code_index]

    if x == 1:

        print(opcode_key[x])

        code_index += 1

    elif x == 8:

        print(opcode_key[x].format(hex(opcode_team[code_index+1])))

        code_index += 2
# print(hex(code_index))
"""

import ctypes

opcode_team = [0x04, 0x66, 0x08, 0x32, 0x04, 0x4E, 0x08, 0x33, 0x04, 0xA9, 0x08, 0x34, 0x04, 0xFD, 0x08, 0x35, 0x04, 0x3C, 0x08, 0x36, 0x04, 0x55, 0x08, 0x37, 0x04, 0x90, 0x08, 0x38, 0x04, 0x24, 0x08, 0x39, 0x04, 0x57, 0x08, 0x3A, 0x04, 0xF6, 0x08, 0x3B, 0x04, 0x5D, 0x08, 0x3C, 0x04, 0xB1, 0x08, 0x3D, 0x04, 0x01, 0x08, 0x3E, 0x04, 0x20, 0x08, 0x3F, 0x04, 0x81, 0x08, 0x40, 0x04, 0xFD, 0x08, 0x41, 0x04, 0x36, 0x08, 0x42, 0x04, 0xA9, 0x08, 0x43, 0x04, 0x1F, 0x08, 0x44, 0x04, 0xA1, 0x08, 0x45, 0x04, 0x0E, 0x08, 0x46, 0x04, 0x0D, 0x08, 0x47, 0x04, 0x80, 0x08, 0x48, 0x04, 0x8F, 0x08, 0x49, 0x04, 0xCE, 0x08, 0x4A, 0x04, 0x77, 0x08, 0x4B, 0x04, 0xE8, 0x08, 0x4C, 0x04, 0x23, 0x08, 0x4D, 0x04, 0x9E, 0x08, 0x4E, 0x04, 0x27, 0x08, 0x4F, 0x04, 0x60, 0x08, 0x50, 0x04, 0x2F, 0x08, 0x51, 0x04, 0xA5, 0x08, 0x52, 0x04, 0xCF, 0x08, 0x53, 0x04, 0x1B, 0x08, 0x54, 0x04, 0xBD, 0x08, 0x55, 0x04, 0x32, 0x08, 0x56, 0x04, 0xDB, 0x08, 0x57, 0x04, 0xFF, 0x08, 0x58, 0x04, 0x28, 0x08, 0x59, 0x04, 0xA4, 0x08, 0x5A, 0x04, 0x5D, 0x08, 0x5B, 0x01, 0x08, 0x64, 0x01, 0x08, 0x65, 0x01, 0x08, 0x66, 0x01, 0x08, 0x67, 0x01, 0x08, 0x68, 0x01, 0x08, 0x69, 0x01, 0x08, 0x6A, 0x01, 0x08, 0x6B, 0x01, 0x08, 0x6C, 0x01, 0x08, 0x6D, 0x01, 0x08, 0x6E, 0x01, 0x08, 0x6F, 0x01, 0x08, 0x70, 0x01, 0x08, 0x71, 0x01, 0x08, 0x72, 0x01, 0x08, 0x73, 0x01, 0x08, 0x74, 0x01, 0x08, 0x75, 0x01, 0x08, 0x76, 0x01, 0x08, 0x77, 0x01, 0x08, 0x78, 0x01, 0x08, 0x79, 0x01, 0x08, 0x7A, 0x01, 0x08, 0x7B, 0x01, 0x08, 0x7C, 0x01, 0x08, 0x7D, 0x01, 0x08, 0x7E, 0x01, 0x08, 0x7F, 0x01, 0x08, 0x80, 0x01, 0x08, 0x81, 0x01, 0x08, 0x82, 0x01, 0x08, 0x83, 0x01, 0x08, 0x84, 0x01, 0x08, 0x85, 0x01, 0x08, 0x86, 0x01, 0x08, 0x87, 0x01, 0x08, 0x88, 0x01, 0x08, 0x89, 0x01, 0x08, 0x8A, 0x01, 0x08, 0x8B, 0x01, 0x08, 0x8C, 0x01, 0x08, 0x8D, 0x04, 0x00, 0x06, 0x00, 0x05, 0x00, 0x04, 0x07, 0x16, 0x56, 0x04, 0x00, 0x06, 0x01, 0x05, 0x01, 0x04, 0x06, 0x16, 0x42, 0x05, 0x00, 0x04, 0x06, 0x0B, 0x05, 0x01, 0x09, 0x04, 0x64, 0x09, 0x19, 0x12, 0x05, 0x00, 0x05, 0x01, 0x04, 0x02, 0x09, 0x0B, 0x0F, 0x04, 0x64, 0x05, 0x00, 0x04, 0x06, 0x0B, 0x05, 0x01, 0x09, 0x09, 0x19, 0x05, 0x00, 0x05, 0x01, 0x04, 0x02, 0x09, 0x0B, 0x12, 0x0F, 0x10, 0x05, 0x01, 0x04, 0x07, 0x0B, 0x05, 0x00, 0x09, 0x1A, 0x05, 0x01, 0x04, 0x01, 0x09, 0x04, 0x01, 0x1C, 0x1D, 0xBC, 0x05, 0x00, 0x04, 0x01, 0x09, 0x04, 0x00, 0x1C, 0x1D, 0xA8, 0x04, 0x01, 0x06, 0x00, 0x05, 0x00, 0x04, 0x2A, 0x16, 0x34, 0x05, 0x00, 0x04, 0x02, 0x0D, 0x04, 0x00, 0x14, 0x0F, 0x05, 0x00, 0x19, 0x05, 0x00, 0x04, 0x01, 0x0A, 0x19, 0x09, 0x05, 0x00, 0x1A, 0x05, 0x00, 0x04, 0x02, 0x0D, 0x04, 0x01, 0x14, 0x0B, 0x04, 0x6B, 0x05, 0x00, 0x19, 0x0B, 0x05, 0x00, 0x1A, 0x05, 0x00, 0x04, 0x01, 0x09, 0x04, 0x00, 0x1C, 0x1D, 0xCA, 0x04, 0x00, 0x06, 0x00, 0x05, 0x00, 0x04, 0x29, 0x18, 0x04, 0x1D, 0x1B, 0x05, 0x00, 0x19, 0x04, 0x32, 0x05, 0x00, 0x09, 0x19, 0x14, 0x0C, 0x05, 0x00, 0x04, 0x01, 0x09, 0x04, 0x00, 0x1C, 0x1D, 0xE5, 0x04, 0x6E, 0x02, 0x1E, 0x04, 0x79, 0x02, 0x1E]

opcode_key = {

    1: "push getc",

    2: "putc pop",

    3: "nop",

    4: "push {}",

    5: "push *(cnt_adr+{})",

    6: "pop *(cnt_adr+{})",

    7: "push *(save_local + {})",

    8: "pop *(save_local+{})",

    9: "pop rax;  pop rbx;  push rbx+rax",

    10: "pop rax;  pop rbx;  push rbx-rax",

    11: "pop rax;  pop rbx;  push rbx*rax",

    12: "pop rax;  pop rbx;  push rbx/rax",

    13: "pop rax;  pop rbx;  push rbx%rax",

    14: "pop eax;  pop ebx;  push ebx^eax",

    15: "pop rax;  pop rbx;  push rbx&rax",

    16: "pop rax;  pop rbx;  push rbx|rax",

    17: "pop reg;  push (-reg)",

    18: "pop reg;  push ~(reg)",

    19: "pop rax;  pop rbx;  if stack[rax]!=stack[rbx]:rip+=2  else:rip+={}",

    20: "pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+={}",

    21: "pop rax;  pop rbx;  if stack[rax]>=stack[rbx]:rip+=2  else:rip+={}",

    22: "pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+={}",

    23: "pop rax;  pop rbx;  if stack[rax]<=stack[rbx]:rip+=2  else:rip+={}",

    24: "pop rax;  pop rbx;  if stack[rax]<stack[rbx]:rip+=2  else:rip+={}",

    25: "pop rax;  push *(save_local+rax)",

    26: "pop rax;  pop rbx;  mov *(save_local+rax), rbx",

    27: "pop rax;  push *(save_cnt+rax)",

    28: "pop rax;  pop rbx; mov *(save_cnt+rax), rbx",

    29: "jmp {}",

    30: "exit"

    }
 
code_index = 0

judge = [19, 20, 21, 22, 23, 24]  # 存放那几个跳转的opcode

change1 = [1, 2, 3, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 25, 26, 27, 28]  # rip+=1

change2 = [4, 5, 6, 7, 8]  # rip+=2

while code_index <= 0x1E8:

    x = opcode_team[code_index]

    if x in change1:

        print("_" + hex(code_index) + ": " + opcode_key[x])

        if x == 2 and opcode_team[code_index+1] == 0x1E:

            code_index += 2

            continue

        code_index += 1

    elif x in change2:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(opcode_team[code_index+1])))

        code_index += 2

    elif x == 19:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 20:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 21:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 22:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 23:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 24:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 29:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(eval(hex(code_index)+"+"+(str(ctypes.c_byte(opcode_team[code_index+1]))[7:-1])))))

        code_index += 2

    else:

        continue
# _*_ coding: utf-8 _*_
# editor: SYJ
# function: Reversed By SYJ
# describe:
"""
# first_part: 给一个数组赋值
code_index = 0          # x在opcode_team中的下标
while code_index <= 0xA6:

    x = opcode_team[code_index]

    if x in opcode_key:

        print(opcode_key[x].format(hex(opcode_team[code_index+1])))

        code_index += 2
# print(hex(code_index))
[0x66, 0x4E, 0xA9, 0xFD, 0x3C, 0x55, 0x90, 0x24, 0x57, 0xF6, 0x5D, 0xB1, 0x01, 0x20, 0x81, 0xFD, 0x36, 0xA9, 0x1F, 0xA1, 0x0E, 0x0D, 0x80, 0x8F, 0xCE, 0x77, 0xE8, 0x23, 0x9E, 0x27, 0x60, 0x2F, 0xA5, 0xCF, 0x1B, 0xBD, 0x32, 0xDB, 0xFF, 0x28, 0xA4, 0x5D]
 
# second_part
while code_index <= 0x124:

    x = opcode_team[code_index]

    if x == 1:

        print(opcode_key[x])

        code_index += 1

    elif x == 8:

        print(opcode_key[x].format(hex(opcode_team[code_index+1])))

        code_index += 2
# print(hex(code_index))
"""

import ctypes

opcode_team = [0x04, 0x66, 0x08, 0x32, 0x04, 0x4E, 0x08, 0x33, 0x04, 0xA9, 0x08, 0x34, 0x04, 0xFD, 0x08, 0x35, 0x04, 0x3C, 0x08, 0x36, 0x04, 0x55, 0x08, 0x37, 0x04, 0x90, 0x08, 0x38, 0x04, 0x24, 0x08, 0x39, 0x04, 0x57, 0x08, 0x3A, 0x04, 0xF6, 0x08, 0x3B, 0x04, 0x5D, 0x08, 0x3C, 0x04, 0xB1, 0x08, 0x3D, 0x04, 0x01, 0x08, 0x3E, 0x04, 0x20, 0x08, 0x3F, 0x04, 0x81, 0x08, 0x40, 0x04, 0xFD, 0x08, 0x41, 0x04, 0x36, 0x08, 0x42, 0x04, 0xA9, 0x08, 0x43, 0x04, 0x1F, 0x08, 0x44, 0x04, 0xA1, 0x08, 0x45, 0x04, 0x0E, 0x08, 0x46, 0x04, 0x0D, 0x08, 0x47, 0x04, 0x80, 0x08, 0x48, 0x04, 0x8F, 0x08, 0x49, 0x04, 0xCE, 0x08, 0x4A, 0x04, 0x77, 0x08, 0x4B, 0x04, 0xE8, 0x08, 0x4C, 0x04, 0x23, 0x08, 0x4D, 0x04, 0x9E, 0x08, 0x4E, 0x04, 0x27, 0x08, 0x4F, 0x04, 0x60, 0x08, 0x50, 0x04, 0x2F, 0x08, 0x51, 0x04, 0xA5, 0x08, 0x52, 0x04, 0xCF, 0x08, 0x53, 0x04, 0x1B, 0x08, 0x54, 0x04, 0xBD, 0x08, 0x55, 0x04, 0x32, 0x08, 0x56, 0x04, 0xDB, 0x08, 0x57, 0x04, 0xFF, 0x08, 0x58, 0x04, 0x28, 0x08, 0x59, 0x04, 0xA4, 0x08, 0x5A, 0x04, 0x5D, 0x08, 0x5B, 0x01, 0x08, 0x64, 0x01, 0x08, 0x65, 0x01, 0x08, 0x66, 0x01, 0x08, 0x67, 0x01, 0x08, 0x68, 0x01, 0x08, 0x69, 0x01, 0x08, 0x6A, 0x01, 0x08, 0x6B, 0x01, 0x08, 0x6C, 0x01, 0x08, 0x6D, 0x01, 0x08, 0x6E, 0x01, 0x08, 0x6F, 0x01, 0x08, 0x70, 0x01, 0x08, 0x71, 0x01, 0x08, 0x72, 0x01, 0x08, 0x73, 0x01, 0x08, 0x74, 0x01, 0x08, 0x75, 0x01, 0x08, 0x76, 0x01, 0x08, 0x77, 0x01, 0x08, 0x78, 0x01, 0x08, 0x79, 0x01, 0x08, 0x7A, 0x01, 0x08, 0x7B, 0x01, 0x08, 0x7C, 0x01, 0x08, 0x7D, 0x01, 0x08, 0x7E, 0x01, 0x08, 0x7F, 0x01, 0x08, 0x80, 0x01, 0x08, 0x81, 0x01, 0x08, 0x82, 0x01, 0x08, 0x83, 0x01, 0x08, 0x84, 0x01, 0x08, 0x85, 0x01, 0x08, 0x86, 0x01, 0x08, 0x87, 0x01, 0x08, 0x88, 0x01, 0x08, 0x89, 0x01, 0x08, 0x8A, 0x01, 0x08, 0x8B, 0x01, 0x08, 0x8C, 0x01, 0x08, 0x8D, 0x04, 0x00, 0x06, 0x00, 0x05, 0x00, 0x04, 0x07, 0x16, 0x56, 0x04, 0x00, 0x06, 0x01, 0x05, 0x01, 0x04, 0x06, 0x16, 0x42, 0x05, 0x00, 0x04, 0x06, 0x0B, 0x05, 0x01, 0x09, 0x04, 0x64, 0x09, 0x19, 0x12, 0x05, 0x00, 0x05, 0x01, 0x04, 0x02, 0x09, 0x0B, 0x0F, 0x04, 0x64, 0x05, 0x00, 0x04, 0x06, 0x0B, 0x05, 0x01, 0x09, 0x09, 0x19, 0x05, 0x00, 0x05, 0x01, 0x04, 0x02, 0x09, 0x0B, 0x12, 0x0F, 0x10, 0x05, 0x01, 0x04, 0x07, 0x0B, 0x05, 0x00, 0x09, 0x1A, 0x05, 0x01, 0x04, 0x01, 0x09, 0x04, 0x01, 0x1C, 0x1D, 0xBC, 0x05, 0x00, 0x04, 0x01, 0x09, 0x04, 0x00, 0x1C, 0x1D, 0xA8, 0x04, 0x01, 0x06, 0x00, 0x05, 0x00, 0x04, 0x2A, 0x16, 0x34, 0x05, 0x00, 0x04, 0x02, 0x0D, 0x04, 0x00, 0x14, 0x0F, 0x05, 0x00, 0x19, 0x05, 0x00, 0x04, 0x01, 0x0A, 0x19, 0x09, 0x05, 0x00, 0x1A, 0x05, 0x00, 0x04, 0x02, 0x0D, 0x04, 0x01, 0x14, 0x0B, 0x04, 0x6B, 0x05, 0x00, 0x19, 0x0B, 0x05, 0x00, 0x1A, 0x05, 0x00, 0x04, 0x01, 0x09, 0x04, 0x00, 0x1C, 0x1D, 0xCA, 0x04, 0x00, 0x06, 0x00, 0x05, 0x00, 0x04, 0x29, 0x18, 0x04, 0x1D, 0x1B, 0x05, 0x00, 0x19, 0x04, 0x32, 0x05, 0x00, 0x09, 0x19, 0x14, 0x0C, 0x05, 0x00, 0x04, 0x01, 0x09, 0x04, 0x00, 0x1C, 0x1D, 0xE5, 0x04, 0x6E, 0x02, 0x1E, 0x04, 0x79, 0x02, 0x1E]

opcode_key = {

    1: "push getc",

    2: "putc pop",

    3: "nop",

    4: "push {}",

    5: "push *(cnt_adr+{})",

    6: "pop *(cnt_adr+{})",

    7: "push *(save_local + {})",

    8: "pop *(save_local+{})",

    9: "pop rax;  pop rbx;  push rbx+rax",

    10: "pop rax;  pop rbx;  push rbx-rax",

    11: "pop rax;  pop rbx;  push rbx*rax",

    12: "pop rax;  pop rbx;  push rbx/rax",

    13: "pop rax;  pop rbx;  push rbx%rax",

    14: "pop eax;  pop ebx;  push ebx^eax",

    15: "pop rax;  pop rbx;  push rbx&rax",

    16: "pop rax;  pop rbx;  push rbx|rax",

    17: "pop reg;  push (-reg)",

    18: "pop reg;  push ~(reg)",

    19: "pop rax;  pop rbx;  if stack[rax]!=stack[rbx]:rip+=2  else:rip+={}",

    20: "pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+={}",

    21: "pop rax;  pop rbx;  if stack[rax]>=stack[rbx]:rip+=2  else:rip+={}",

    22: "pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+={}",

    23: "pop rax;  pop rbx;  if stack[rax]<=stack[rbx]:rip+=2  else:rip+={}",

    24: "pop rax;  pop rbx;  if stack[rax]<stack[rbx]:rip+=2  else:rip+={}",

    25: "pop rax;  push *(save_local+rax)",

    26: "pop rax;  pop rbx;  mov *(save_local+rax), rbx",

    27: "pop rax;  push *(save_cnt+rax)",

    28: "pop rax;  pop rbx; mov *(save_cnt+rax), rbx",

    29: "jmp {}",

    30: "exit"

    }
 
code_index = 0

judge = [19, 20, 21, 22, 23, 24]  # 存放那几个跳转的opcode

change1 = [1, 2, 3, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 25, 26, 27, 28]  # rip+=1

change2 = [4, 5, 6, 7, 8]  # rip+=2

while code_index <= 0x1E8:

    x = opcode_team[code_index]

    if x in change1:

        print("_" + hex(code_index) + ": " + opcode_key[x])

        if x == 2 and opcode_team[code_index+1] == 0x1E:

            code_index += 2

            continue

        code_index += 1

    elif x in change2:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(opcode_team[code_index+1])))

        code_index += 2

    elif x == 19:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 20:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 21:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 22:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 23:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 24:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(code_index+2), hex(code_index+opcode_team[code_index+1])))

        code_index += 2

    elif x == 29:

        print("_" + hex(code_index) + ": " + opcode_key[x].format(hex(eval(hex(code_index)+"+"+(str(ctypes.c_byte(opcode_team[code_index+1]))[7:-1])))))

        code_index += 2

    else:

        continue

_0x0: push 0x66

_0x2: pop *(save_local+0x32)

_0x4: push 0x4e

_0x6: pop *(save_local+0x33)

_0x8: push 0xa9

_0xa: pop *(save_local+0x34)

_0xc: push 0xfd

_0xe: pop *(save_local+0x35)

_0x10: push 0x3c

_0x12: pop *(save_local+0x36)

_0x14: push 0x55

_0x16: pop *(save_local+0x37)

_0x18: push 0x90

_0x1a: pop *(save_local+0x38)

_0x1c: push 0x24

_0x1e: pop *(save_local+0x39)

_0x20: push 0x57

_0x22: pop *(save_local+0x3a)

_0x24: push 0xf6

_0x26: pop *(save_local+0x3b)

_0x28: push 0x5d

_0x2a: pop *(save_local+0x3c)

_0x2c: push 0xb1

_0x2e: pop *(save_local+0x3d)

_0x30: push 0x1

_0x32: pop *(save_local+0x3e)

_0x34: push 0x20

_0x36: pop *(save_local+0x3f)

_0x38: push 0x81

_0x3a: pop *(save_local+0x40)

_0x3c: push 0xfd

_0x3e: pop *(save_local+0x41)

_0x40: push 0x36

_0x42: pop *(save_local+0x42)

_0x44: push 0xa9

_0x46: pop *(save_local+0x43)

_0x48: push 0x1f

_0x4a: pop *(save_local+0x44)

_0x4c: push 0xa1

_0x4e: pop *(save_local+0x45)

_0x50: push 0xe

_0x52: pop *(save_local+0x46)

_0x54: push 0xd

_0x56: pop *(save_local+0x47)

_0x58: push 0x80

_0x5a: pop *(save_local+0x48)

_0x5c: push 0x8f

_0x5e: pop *(save_local+0x49)

_0x60: push 0xce

_0x62: pop *(save_local+0x4a)

_0x64: push 0x77

_0x66: pop *(save_local+0x4b)

_0x68: push 0xe8

_0x6a: pop *(save_local+0x4c)

_0x6c: push 0x23

_0x6e: pop *(save_local+0x4d)

_0x70: push 0x9e

_0x72: pop *(save_local+0x4e)

_0x74: push 0x27

_0x76: pop *(save_local+0x4f)

_0x78: push 0x60

_0x7a: pop *(save_local+0x50)

_0x7c: push 0x2f

_0x7e: pop *(save_local+0x51)

_0x80: push 0xa5

_0x82: pop *(save_local+0x52)

_0x84: push 0xcf

_0x86: pop *(save_local+0x53)

_0x88: push 0x1b

_0x8a: pop *(save_local+0x54)

_0x8c: push 0xbd

_0x8e: pop *(save_local+0x55)

_0x90: push 0x32

_0x92: pop *(save_local+0x56)

_0x94: push 0xdb

_0x96: pop *(save_local+0x57)

_0x98: push 0xff

_0x9a: pop *(save_local+0x58)

_0x9c: push 0x28

_0x9e: pop *(save_local+0x59)

_0xa0: push 0xa4

_0xa2: pop *(save_local+0x5a)

_0xa4: push 0x5d

_0xa6: pop *(save_local+0x5b)
_0xa8: push getc

_0xa9: pop *(save_local+0x64)
_0xab: push getc

_0xac: pop *(save_local+0x65)
_0xae: push getc

_0xaf: pop *(save_local+0x66)
_0xb1: push getc

_0xb2: pop *(save_local+0x67)
_0xb4: push getc

_0xb5: pop *(save_local+0x68)
_0xb7: push getc

_0xb8: pop *(save_local+0x69)
_0xba: push getc

_0xbb: pop *(save_local+0x6a)
_0xbd: push getc

_0xbe: pop *(save_local+0x6b)
_0xc0: push getc

_0xc1: pop *(save_local+0x6c)
_0xc3: push getc

_0xc4: pop *(save_local+0x6d)
_0xc6: push getc

_0xc7: pop *(save_local+0x6e)
_0xc9: push getc

_0xca: pop *(save_local+0x6f)
_0xcc: push getc

_0xcd: pop *(save_local+0x70)
_0xcf: push getc

_0xd0: pop *(save_local+0x71)
_0xd2: push getc

_0xd3: pop *(save_local+0x72)
_0xd5: push getc

_0xd6: pop *(save_local+0x73)
_0xd8: push getc

_0xd9: pop *(save_local+0x74)
_0xdb: push getc

_0xdc: pop *(save_local+0x75)
_0xde: push getc

_0xdf: pop *(save_local+0x76)
_0xe1: push getc

_0xe2: pop *(save_local+0x77)
_0xe4: push getc

_0xe5: pop *(save_local+0x78)
_0xe7: push getc

_0xe8: pop *(save_local+0x79)
_0xea: push getc

_0xeb: pop *(save_local+0x7a)
_0xed: push getc

_0xee: pop *(save_local+0x7b)
_0xf0: push getc

_0xf1: pop *(save_local+0x7c)
_0xf3: push getc

_0xf4: pop *(save_local+0x7d)
_0xf6: push getc

_0xf7: pop *(save_local+0x7e)
_0xf9: push getc

_0xfa: pop *(save_local+0x7f)
_0xfc: push getc

_0xfd: pop *(save_local+0x80)
_0xff: push getc

_0x100: pop *(save_local+0x81)
_0x102: push getc

_0x103: pop *(save_local+0x82)
_0x105: push getc

_0x106: pop *(save_local+0x83)
_0x108: push getc

_0x109: pop *(save_local+0x84)
_0x10b: push getc

_0x10c: pop *(save_local+0x85)
_0x10e: push getc

_0x10f: pop *(save_local+0x86)
_0x111: push getc

_0x112: pop *(save_local+0x87)
_0x114: push getc

_0x115: pop *(save_local+0x88)
_0x117: push getc

_0x118: pop *(save_local+0x89)
_0x11a: push getc

_0x11b: pop *(save_local+0x8a)
_0x11d: push getc

_0x11e: pop *(save_local+0x8b)
_0x120: push getc

_0x121: pop *(save_local+0x8c)
_0x123: push getc

_0x124: pop *(save_local+0x8d)

_0x126: push 0x0

_0x128: pop *(cnt_adr+0x0)

_0x12a: push *(cnt_adr+0x0)

_0x12c: push 0x7

_0x12e: pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+=0x130

_0x130: push 0x0

_0x132: pop *(cnt_adr+0x1)

_0x134: push *(cnt_adr+0x1)

_0x136: push 0x6

_0x138: pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+=0x13a

_0x13a: push *(cnt_adr+0x0)

_0x13c: push 0x6

_0x13e: pop rax;  pop rbx;  push rbx*rax

_0x13f: push *(cnt_adr+0x1)

_0x141: pop rax;  pop rbx;  push rbx+rax

_0x142: push 0x64

_0x144: pop rax;  pop rbx;  push rbx+rax

_0x145: pop rax;  push *(save_local+rax)
_0x146: pop reg;  push ~(reg)

_0x147: push *(cnt_adr+0x0)

_0x149: push *(cnt_adr+0x1)

_0x14b: push 0x2

_0x14d: pop rax;  pop rbx;  push rbx+rax

_0x14e: pop rax;  pop rbx;  push rbx*rax
_0x14f: pop rax;  pop rbx;  push rbx&rax

_0x150: push 0x64

_0x152: push *(cnt_adr+0x0)

_0x154: push 0x6

_0x156: pop rax;  pop rbx;  push rbx*rax

_0x157: push *(cnt_adr+0x1)

_0x159: pop rax;  pop rbx;  push rbx+rax

_0x15a: pop rax;  pop rbx;  push rbx+rax

_0x15b: pop rax;  push *(save_local+rax)

_0x15c: push *(cnt_adr+0x0)

_0x15e: push *(cnt_adr+0x1)

_0x160: push 0x2

_0x162: pop rax;  pop rbx;  push rbx+rax

_0x163: pop rax;  pop rbx;  push rbx*rax
_0x164: pop reg;  push ~(reg)
_0x165: pop rax;  pop rbx;  push rbx&rax
_0x166: pop rax;  pop rbx;  push rbx|rax

_0x167: push *(cnt_adr+0x1)

_0x169: push 0x7

_0x16b: pop rax;  pop rbx;  push rbx*rax

_0x16c: push *(cnt_adr+0x0)

_0x16e: pop rax;  pop rbx;  push rbx+rax

_0x16f: pop rax;  pop rbx;  mov *(save_local+rax), rbx

_0x170: push *(cnt_adr+0x1)

_0x172: push 0x1

_0x174: pop rax;  pop rbx;  push rbx+rax

_0x175: push 0x1

_0x177: pop rax;  pop rbx; mov *(save_cnt+rax), rbx

_0x178: jmp 0x134

_0x17a: push *(cnt_adr+0x0)

_0x17c: push 0x1

_0x17e: pop rax;  pop rbx;  push rbx+rax

_0x17f: push 0x0

_0x181: pop rax;  pop rbx; mov *(save_cnt+rax), rbx

_0x182: jmp 0x12a

_0x184: push 0x1

_0x186: pop *(cnt_adr+0x0)

_0x188: push *(cnt_adr+0x0)

_0x18a: push 0x2a

_0x18c: pop rax;  pop rbx;  if stack[rax]>stack[rbx]:rip+=2  else:rip+=0x18e

_0x18e: push *(cnt_adr+0x0)

_0x190: push 0x2

_0x192: pop rax;  pop rbx;  push rbx%rax

_0x193: push 0x0

_0x195: pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+=0x197

_0x197: push *(cnt_adr+0x0)

_0x199: pop rax;  push *(save_local+rax)

_0x19a: push *(cnt_adr+0x0)

_0x19c: push 0x1

_0x19e: pop rax;  pop rbx;  push rbx-rax

_0x19f: pop rax;  push *(save_local+rax)

_0x1a0: pop rax;  pop rbx;  push rbx+rax

_0x1a1: push *(cnt_adr+0x0)

_0x1a3: pop rax;  pop rbx;  mov *(save_local+rax), rbx

_0x1a4: push *(cnt_adr+0x0)

_0x1a6: push 0x2

_0x1a8: pop rax;  pop rbx;  push rbx%rax

_0x1a9: push 0x1

_0x1ab: pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+=0x1ad

_0x1ad: push 0x6b

_0x1af: push *(cnt_adr+0x0)

_0x1b1: pop rax;  push *(save_local+rax)

_0x1b2: pop rax;  pop rbx;  push rbx*rax

_0x1b3: push *(cnt_adr+0x0)

_0x1b5: pop rax;  pop rbx;  mov *(save_local+rax), rbx

_0x1b6: push *(cnt_adr+0x0)

_0x1b8: push 0x1

_0x1ba: pop rax;  pop rbx;  push rbx+rax

_0x1bb: push 0x0

_0x1bd: pop rax;  pop rbx; mov *(save_cnt+rax), rbx

_0x1be: jmp 0x188

_0x1c0: push 0x0

_0x1c2: pop *(cnt_adr+0x0)

_0x1c4: push *(cnt_adr+0x0)

_0x1c6: push 0x29

_0x1c8: pop rax;  pop rbx;  if stack[rax]<stack[rbx]:rip+=2  else:rip+=0x1ca

_0x1ca: jmp 0x1e5

_0x1cc: push *(cnt_adr+0x0)

_0x1ce: pop rax;  push *(save_local+rax)

_0x1cf: push 0x32

_0x1d1: push *(cnt_adr+0x0)

_0x1d3: pop rax;  pop rbx;  push rbx+rax

_0x1d4: pop rax;  push *(save_local+rax)

_0x1d5: pop rax;  pop rbx;  if stack[rax]==stack[rbx]:rip+=2  else:rip+=0x1d7

_0x1d7: push *(cnt_adr+0x0)

_0x1d9: push 0x1

_0x1db: pop rax;  pop rbx;  push rbx+rax

_0x1dc: push 0x0

_0x1de: pop rax;  pop rbx; mov *(save_cnt+rax), rbx

_0x1df: jmp 0x1c4

_0x1e1: push 0x6e
_0x1e3: putc pop

_0x1e5: push 0x79
_0x1e7: putc pop

_0x0: push 0x66

_0x2: pop *(save_local+0x32)

_0x4: push 0x4e

_0x6: pop *(save_local+0x33)

_0x8: push 0xa9

_0xa: pop *(save_local+0x34)

_0xc: push 0xfd

_0xe: pop *(save_local+0x35)

_0x10: push 0x3c

_0x12: pop *(save_local+0x36)

_0x14: push 0x55

_0x16: pop *(save_local+0x37)

_0x18: push 0x90

_0x1a: pop *(save_local+0x38)

_0x1c: push 0x24

_0x1e: pop *(save_local+0x39)

_0x20: push 0x57

_0x22: pop *(save_local+0x3a)

_0x24: push 0xf6

_0x26: pop *(save_local+0x3b)

_0x28: push 0x5d

_0x2a: pop *(save_local+0x3c)

_0x2c: push 0xb1

_0x2e: pop *(save_local+0x3d)

_0x30: push 0x1

_0x32: pop *(save_local+0x3e)

_0x34: push 0x20

_0x36: pop *(save_local+0x3f)

_0x38: push 0x81

_0x3a: pop *(save_local+0x40)

_0x3c: push 0xfd

_0x3e: pop *(save_local+0x41)

_0x40: push 0x36

_0x42: pop *(save_local+0x42)

_0x44: push 0xa9

_0x46: pop *(save_local+0x43)

_0x48: push 0x1f

_0x4a: pop *(save_local+0x44)

_0x4c: push 0xa1

_0x4e: pop *(save_local+0x45)

_0x50: push 0xe

_0x52: pop *(save_local+0x46)

_0x54: push 0xd

_0x56: pop *(save_local+0x47)

_0x58: push 0x80

_0x5a: pop *(save_local+0x48)

_0x5c: push 0x8f

_0x5e: pop *(save_local+0x49)

_0x60: push 0xce

_0x62: pop *(save_local+0x4a)

_0x64: push 0x77

_0x66: pop *(save_local+0x4b)

_0x68: push 0xe8

_0x6a: pop *(save_local+0x4c)

_0x6c: push 0x23

_0x6e: pop *(save_local+0x4d)

_0x70: push 0x9e

_0x72: pop *(save_local+0x4e)

_0x74: push 0x27

_0x76: pop *(save_local+0x4f)

_0x78: push 0x60

_0x7a: pop *(save_local+0x50)

_0x7c: push 0x2f

_0x7e: pop *(save_local+0x51)

_0x80: push 0xa5

_0x82: pop *(save_local+0x52)

_0x84: push 0xcf

_0x86: pop *(save_local+0x53)

_0x88: push 0x1b

_0x8a: pop *(save_local+0x54)

_0x8c: push 0xbd

_0x8e: pop *(save_local+0x55)

_0x90: push 0x32

_0x92: pop *(save_local+0x56)

_0x94: push 0xdb

_0x96: pop *(save_local+0x57)

_0x98: push 0xff

_0x9a: pop *(save_local+0x58)

_0x9c: push 0x28

_0x9e: pop *(save_local+0x59)

_0xa0: push 0xa4

_0xa2: pop *(save_local+0x5a)

_0xa4: push 0x5d

_0xa6: pop *(save_local+0x5b)
_0xa8: push getc

_0xa9: pop *(save_local+0x64)
_0xab: push getc

_0xac: pop *(save_local+0x65)
_0xae: push getc

_0xaf: pop *(save_local+0x66)
_0xb1: push getc

_0xb2: pop *(save_local+0x67)
_0xb4: push getc

_0xb5: pop *(save_local+0x68)
_0xb7: push getc

_0xb8: pop *(save_local+0x69)
_0xba: push getc

_0xbb: pop *(save_local+0x6a)
_0xbd: push getc

_0xbe: pop *(save_local+0x6b)
_0xc0: push getc

_0xc1: pop *(save_local+0x6c)
_0xc3: push getc

_0xc4: pop *(save_local+0x6d)
_0xc6: push getc

_0xc7: pop *(save_local+0x6e)
_0xc9: push getc

_0xca: pop *(save_local+0x6f)
_0xcc: push getc

_0xcd: pop *(save_local+0x70)
_0xcf: push getc

_0xd0: pop *(save_local+0x71)
_0xd2: push getc

				登录后可查看完整内容
			
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

		#Reverse
	
上传的附件：

			VM.zip
		
		（1.59MB，22次下载）
收藏・17
免费・7
支持
最新回复 (7)
YenKoc 雪币： 2677 活跃值： (5410) 能力值： ( LV10，RANK：177 ) 在线值：发帖 6 回帖 70 粉丝 64 关注私信	YenKoc 2 2 楼为啥感觉没怎么提升效率呢，扣出汇编，直接撸香啊 2021-6-25 09:25 0
TopGreen 雪币： 1931 活跃值： (442) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 51 粉丝 0 关注私信	TopGreen 3 楼我感觉整更复杂了 2021-6-25 10:01 0
TkBinary 雪币： 950 活跃值： (9946) 能力值： ( LV13，RANK：385 ) 在线值：发帖 25 回帖 419 粉丝 213 关注私信	TkBinary 5 4 楼谢谢分享,好思路. 2021-6-25 10:01 0
v0id_ 雪币： 8452 活跃值： (5046) 能力值： ( LV4，RANK：45 ) 在线值：发帖 7 回帖 243 粉丝 34 关注私信	v0id_ 5 楼 lz用的编译器和命令行参数能不能发一下 2021-6-25 11:48 0
SYJ-Re 雪币： 3668 活跃值： (9375) 能力值： ( LV9，RANK：319 ) 在线值：发帖 37 回帖 68 粉丝 158 关注私信	SYJ-Re 3 6 楼对于栈的操作如果能优化处理就可以简便很多 2021-6-25 13:28 0
SYJ-Re 雪币： 3668 活跃值： (9375) 能力值： ( LV9，RANK：319 ) 在线值：发帖 37 回帖 68 粉丝 158 关注私信	SYJ-Re 3 7 楼 codeblocks 2021-6-25 13:29 0
SYJ-Re 雪币： 3668 活跃值： (9375) 能力值： ( LV9，RANK：319 ) 在线值：发帖 37 回帖 68 粉丝 158 关注私信	SYJ-Re 3 8 楼这个思路复杂了，其实不用想方设法编成C，如果我能直接得到转换出来的汇编代码的机器码，直接拖入IDA并设置架构不就能像正常程序一样解析吗，而pwntools的asm函数可以做到 2021-7-14 23:27 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复
SYJ-Re
发帖
回帖
319
RANK
关注
私信
他的文章
关于我们
联系我们
企业服务
看雪公众号
最新回复 (7)
YenKoc 雪币： 2677 活跃值： (5410) 能力值： ( LV10，RANK：177 ) 在线值：发帖 6 回帖 70 粉丝 64 关注私信	YenKoc 2 2 楼为啥感觉没怎么提升效率呢，扣出汇编，直接撸香啊 2021-6-25 09:25 0
TopGreen 雪币： 1931 活跃值： (442) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 51 粉丝 0 关注私信	TopGreen 3 楼我感觉整更复杂了 2021-6-25 10:01 0
TkBinary 雪币： 950 活跃值： (9946) 能力值： ( LV13，RANK：385 ) 在线值：发帖 25 回帖 419 粉丝 213 关注私信	TkBinary 5 4 楼谢谢分享,好思路. 2021-6-25 10:01 0
v0id_ 雪币： 8452 活跃值： (5046) 能力值： ( LV4，RANK：45 ) 在线值：发帖 7 回帖 243 粉丝 34 关注私信	v0id_ 5 楼 lz用的编译器和命令行参数能不能发一下 2021-6-25 11:48 0
SYJ-Re 雪币： 3668 活跃值： (9375) 能力值： ( LV9，RANK：319 ) 在线值：发帖 37 回帖 68 粉丝 158 关注私信	SYJ-Re 3 6 楼对于栈的操作如果能优化处理就可以简便很多 2021-6-25 13:28 0
SYJ-Re 雪币： 3668 活跃值： (9375) 能力值： ( LV9，RANK：319 ) 在线值：发帖 37 回帖 68 粉丝 158 关注私信	SYJ-Re 3 7 楼 codeblocks 2021-6-25 13:29 0
SYJ-Re 雪币： 3668 活跃值： (9375) 能力值： ( LV9，RANK：319 ) 在线值：发帖 37 回帖 68 粉丝 158 关注私信	SYJ-Re 3 8 楼这个思路复杂了，其实不用想方设法编成C，如果我能直接得到转换出来的汇编代码的机器码，直接拖入IDA并设置架构不就能像正常程序一样解析吗，而pwntools的asm函数可以做到 2021-7-14 23:27 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复