首页
社区
课程
招聘
[原创]看雪 2025·KCTF 第二题 初窥门径 by 心学
发表于: 2025-8-17 16:53 3654

[原创]看雪 2025·KCTF 第二题 初窥门径 by 心学

htg 活跃值
6
2025-8-17 16:53
3654

可以直接看到伪码,貌似很简单,不过深入到 sub_701280 ,发现有混淆或花指令跳转。

此时可以确认此处不能直接观看伪码,来找到具体的算法之处。

经过代码走查分析,能找到关键之处为 .text:00701293(开花之处) 和 .text:0070129F(结果之处)

初步判断在 .text:00701293 和 .text:0070129E 之间的代码被花处理了,此处的原始代码被放到别处(00701EEB)

长度分析:.text:00701293 和 .text:0070129E 有 12 字节代码

刚好是 12 个字节,现在需要调试下,确认开花之处与结果之处时,堆栈没有变化。

观察堆栈情况,没有变化。此处 EAX 指向 输入字符串的结尾 00

根据上面分析结果,可以直接将拷贝字节码,拼接后,复制到开花之处。

根据用户输入的字符串进行校验,主要判断如下:

长度需在 0x70(112)个字符以内,即 56 组(2个一组)

字符为数字和小写字母

每组计算之后,获得三组数值:value={j}*90+{m}*10+{n},【此处擂主未处理好,存在多解情况】,与上面的代码关系是 v8=j,v5=m,v11=n,计算出来的value必须在270以内(内置的 dword_703020 int数组 )

v16、v17、v18分别记录上一组的结果 v11、v5、v8:并有一个重要判断,三组数值之差的绝对值之和为1,即只有一组的绝对值为1,其余相等,初步看会存在环路,但是前面有 0x70 的限制,规避了环路。abs32(v11 - v16) + abs32(v5 - v17) + abs32(v8 - v18) != 1

第0组的结果必须是 00 (c0、o0也可以):其对应的三组数值为 [0,0,0],value = 0,对应的值是 0x2C0E(查找dword_703020数组)if ( v10 == 1 && dword_703020[80 * v8 + 10 * v8 + 10 * v5 + v11] != 0x2C0E )

最后一组的结果必须是 8x(kx、wx也可以):其对应的三组数值为[9,8,2], value=269,对应值为 0x1FB2。if ( v13 == lenSN2 - 1 && dword_703020[80 * v8 + 10 * v8 + 10 * v5 + v11] != 0x1FB2 )

中间组需要满足:除了相邻的两组之外,还有重要的判断,即它找到值(dword_703020[value])必须是半素数,即两个素数的乘积,每个素数必需大于等于2,且不能相等。v19 < 2;v20 < 2;v19 == v20。【此处可以筛选 dword_703020 中满足条件的值

上面的方法是以遍历 dword_703020 索引,然后构造出 j、m、n 三组数,不是通过两个字符串来处理,我们会发现每组字符对的第0个字符均为数值0-8,没有其他数,其实冲突就在于此,该值加上12或24,都会形成生成相同的  j、m、n 三组数。

消除多解的方法:约定每组字符的第0个字符必须为数字即可。

既然第0位字符存在多解可能,第1位字符是否也存在,答案是不行,因为它直接影响了 j,即 v8,它会参与 *90 的计算。

在sub_701280里,如何分析出调用函数的意义:sub_7011C0?

直接将其拷贝到豆包里分析即可,会找到 开方、素数判断,组合之后就是判断是否为半素数,如是就返回两个素数。

详见第五部分的代码。



传播安全知识、拓宽行业人脉——看雪讲师团队等你加入!

最后于 2025-8-17 16:55 被htg编辑 ,原因:
上传的附件:
收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 7786
活跃值: (4488)
能力值: ( LV12,RANK:564 )
在线值:
发帖
回帖
粉丝
2

主要代码如下:

from semiprime import *
import os
import itertools
# 创建一个示例数组a(实际使用时应该是您的272个int的数组)
#a = [i for i in range(272)]:后面有两个0 ,可能不是有效值
#a = [i for i in range(270)]
a=[0x2C0E,0x1312,0x7F44,0x4C2B,0x966,0x1E12,0x1263,0x1828,0x31A1,0x52AE,0x1DC6,0x4019,0x3D89,0x614D,0x1A4A,0x3A24,
0x5406,0x0E61,0x658,0x0D4C,0x5423,0x4860,0x7988,0x1FA3,0x705B,0x4464,0x63EF,0x403E,0x50CB,0x1676,0x5132,0x68B5,
0x4A38,0x6FF5,0x189B,0x170B,0x2704,0x20ED,0x4938,0x47F6,0x7512,0x5196,0x2B7C,0x4A50,0x2E54,0x6FBE,0x3532,0x7B54,
0x0ABD,0x2889,0x56C0,0x323B,0x3698,0x31CF,0x435A,0x75FA,0x0A2B,0x200B,0x45ED,0x163F,0x2554,0x62BB,0x3393,0x2A31,
0x2956,0x3004,0x3684,0x3DEE,0x47AC,0x2267,0x629E,0x1E93,0x7943,0x661B,0x7FB4,0x255A,0x3D37,0x1804,0x69E1,0x312C,
0x3999,0x293F,0x2F0E,0x743A,0x117,0x64CD,0x7C76,0x5CBF,0x6AB0,0x585,0x6CFC,0x3CE6,0x6FAB,0x0F81,0x511C,0x24E4,
0x785,0x5AEB,0x2977,0x0BFB,0x55F8,0x39,0x29DD,0x4987,0x133B,0x5E2F,0x7F4D,0x6497,0x62C2,0x3774,0x1826,0x78C,
0x20BB,0x5473,0x68B6,0x27FB,0x7321,0x1B0E,0x6280,0x54E2,0x5133,0x61E7,0x2F6B,0x5AE2,0x1B09,0x64BB,0x71B,0x6272,
0x453F,0x22BD,0x0D68,0x52A9,0x3116,0x19AD,0x28F6,0x141E,0x6B10,0x32AC,0x2394,0x353D,0x6A40,0x697,0x80E,0x6883,
0x4297,0x175D,0x0B3A,0x4584,0x4FB8,0x55D2,0x2592,0x5F99,0x5986,0x5A84,0x71A3,0x3975,0x525,0x3E15,0x823,0x12D7,
0x78EF,0x636B,0x471A,0x531C,0x23F8,0x38D7,0x7E64,0x18DB,0x344E,0x5655,0x1C69,0x0EE8,0x23C,0x25C8,0x684,0x776D,
0x0B65,0x7855,0x602D,0x277E,0x60AC,0x1885,0x6E40,0x3EEC,0x175C,0x0D2B,0x4F2E,0x645,0x6C70,0x457D,0x5CD8,0x2B12,
0x11C,0x7AAD,0x2E5E,0x37CB,0x5CF8,0x5C48,0x648F,0x3841,0x6344,0x7F63,0x5C2,0x0BE2,0x717A,0x7317,0x711A,0x4344,
0x319,0x756E,0x2F5E,0x6EF2,0x23B0,0x1ED5,0x5A1B,0x5FFF,0x7494,0x5C4C,0x7D2C,0x2C51,0x4BE4,0x5197,0x2384,0x64DD,
0x62E9,0x5019,0x447E,0x1DA1,0x70B3,0x5B03,0x17BC,0x4ED4,0x3E1F,0x26F8,0x2AF2,0x7B64,0x4634,0x69D9,0x75A,0x344B,
0x27D0,0x0C9C,0x385E,0x2496,0x5635,0x57AA,0x44A8,0x62AF,0x65E7,0x3284,0x7A73,0x1CCF,0x25F4,0x5DCD,0x5CDE,0x109B,
0x7890,0x45CF,0x5FEF,0x4ABB,0x26,0x47D,0x6121,0x3A42,0x5519,0x32AF,0x2096,0x18E7,0x4181,0x1FB2]
print(f"alen={len(a)}")
# 基础字符串,包含0-9和a-z共36个字符
base_string = "0123456789abcdefghijklmnopqrstuvwxyz"

def dfs(current_node, path):
        # 如果当前节点是终点,记录路径
        if current_node == "8x":
            all_paths.append(path.copy())
            return
        # 遍历当前节点的所有后继
        for next_node in successors.get(current_node, []):
            # 避免循环:如果后继节点已在当前路径中,跳过(防止无限循环)
            if next_node not in path:
                path.append(next_node)
                dfs(next_node, path)
                path.pop()  # 回溯

def get_element(a, input_string):  
    # 验证输入是否符合要求
    if len(input_string) != 2:
        raise ValueError("输入字符串必须包含两个字符")
    if input_string[0] not in base_string or input_string[1] not in base_string:
        raise ValueError("输入字符必须在baseString中")
    
    # 计算两个字符在base_string中的索引
    index0 = base_string.index(input_string[0])
    index1 = base_string.index(input_string[1])
    
    # 计算x: 第一个字符索引与0xC(12)取余
    x = index0 % 0xC  # 0xC即12
    
    # 计算y: 第二个字符索引与0xC(12)取余
    y = index1 % 0xC  # 0xC即12
    
    # 确定第二个字符所在的分组,计算z
    # 第一组: 0-11 (0123456789ab)
    # 第二组: 12-23 (cdefghijklmn)
    # 第三组: 24-35 (opqrstuvwxyz)
    if index1 < 12:
        z = 0
    elif index1 < 24:
        z = 1
    else:
        z = 2
    
    # 计算索引m
    m = 90 * z + 10 * x + y
    print(f"x={x},y={y},z={z}")
    
    # 验证m是否在数组a的有效范围内
    if m < 0 or m >= len(a):
        raise IndexError(f"计算得到的索引{m}超出数组a的范围")
    
    # 返回数组a中索引为m的元素
    return a[m]


# 示例用法
if __name__ == "__main__":
   
    # 测试一些输入
    test_cases = ["00", "0c", "0o", "az", "9z", "m3", "8x"]
    for case in test_cases:
        try:
            result = get_element(a, case)
            print(f"输入: {case}, 结果: {hex(result)}")
        except (ValueError, IndexError) as e:
            print(f"输入: {case}, 错误: {e}")
    
    print("\n"+"根据a的索引值,获取输入字符串")
    #根据a的索引值,获取输入字符串
    lst=[]#记录当前字符的情况
    for i in range(len(a)):
        #定义 j 为 90 的倍数
        j = i // 90
        if j >2:j=2
        k = i - j * 90
        #定义 m 为 10 的倍数
        m = k // 10
        n = k % 10
        ii = j*90+m*10+n
        if ii != i:
            raise ValueError(f"{j}*90+{m}*10+{n} != {i}:错误")
        #输出
        xa = base_string[m]
        xb = base_string[n+0xC*j]
        
        num = a[i]
        result = check_semiprime(num)
        if result != 0:
            print(f"{hex(i)}\t{xa}{xb}\t{hex(n)}\t{hex(m)}\t{j}\t{hex(a[i])}\t{hex(result[0])}\t{hex(result[1])}")
            lst.append([xa+xb,n,m,j])
        #if result != 0:
        #    print(f"{num} 是半素数,分解为: {result[0]} × {result[1]} = {result[0]*result[1]}")
        #else:
        #    print(f"{num} 不是半素数")
            
        #print(f"{hex(i)}\t{xa}{xb}\t{hex(a[i])}")
    
    #构造后继字典
    successors = {}
    for value in lst:
        for tmp in lst:
            if abs(value[1]-tmp[1])+abs(value[2]-tmp[2])+abs(value[3]-tmp[3]) == 1:
                #print(f"{value[0]}->{tmp[0]}")
                if value[0] not in  successors:
                    successors[value[0]] = [tmp[0]]
                else:
                    successors[value[0]].append(tmp[0])
    print("\n successors: ")
    print(successors)
    
    #利用深度优先算法获取所有的路径
    all_paths = []  # 存储所有找到的路径
    # 从"00"开始搜索,初始路径为["00"]
    dfs("00", ["00"])
    print(f"\n找到从'00'到'8x'的路径共 {len(all_paths)} 条:")
    for i, path in enumerate(all_paths, 1):
        print(f"\n路径 {i}:")
        print(" -> ".join(path))
    print(path)
    #os.system("pause")
    
    
    #核实多解情况
    #根据构造的两个输入字符,获取满足条件的序列
    print("\n"+"逐个遍历所有可能得两组字符,获取输入字符串")
    equalLst=[]
    print("\n 查找 equalLst")
    for i in range(0x24):
        xa = base_string[i]
        for j in range(0x24):
            xb = base_string[j]
            k=0
            if j >= 0xC*2:
                k=2
            elif j>=0xC:
                k=1
            i = i % 0xC
            j = j % 0xC          
                        
            numIndex = k * 90 + i * 10 + j
            
            
            if numIndex >= 270:
                #print(f"numIndex:{numIndex}\t{k}*90+{i}*10+{j}")
                continue
            
            num = a[numIndex]
            result = check_semiprime(num)
            if result != 0:
                #
                print(f"{hex(numIndex)}\t{xa}{xb}\t{hex(j)}\t{hex(i)}\t{k}\t{hex(num)}\t{hex(result[0])}\t{hex(result[1])}")
                #构造一个数组,用于 查找
                indices = [index for index, x in enumerate(equalLst) if x[0][0] == j and x[0][1] == i and x[0][2] == k]
                #print(f"indices: {indices}")
                if len(indices)==0:
                    #raise ValueError(f"未找到[{j},{i},{k}]")
                    #增加
                    #print(f"增加:{[[j,i,k],[xa+xb]]}")
                    equalLst.append([[j,i,k],[xa+xb]])
                elif len(indices)>1:
                    raise ValueError(f"找到[{j},{i},{k}],数量达到2个。")
                    continue
                elif len(indices)==1:
                    #附加到后面
                    #print(f"找到 indices:{indices[0]}")
                    #print(f"增加:{[[j,i,k], equalLst[indices[0]][1] + [xa+xb]]}")
                    equalLst[indices[0]] = [[j,i,k], equalLst[indices[0]][1] + [xa+xb]]
    print("\n equalLst")
    #print(equalLst)
    for i in equalLst:print(i)
    os.system("pause")
    '''# 197 行有效值,每个值有3个等效值
[[0, 0, 0], ['00', 'c0', 'o0']]
[[1, 0, 0], ['01', 'c1', 'o1']]
[[11, 0, 0], ['0b', 'cb', 'ob']]
[[11, 0, 1], ['0n', 'cn', 'on']]
[[1, 1, 0], ['11', 'd1', 'p1']]
[[1, 1, 1], ['1d', 'dd', 'pd']]
[[2, 1, 1], ['1e', 'de', 'pe']]
[[3, 1, 1], ['1f', 'df', 'pf']]
[[7, 1, 1], ['1j', 'dj', 'pj']]
[[8, 1, 1], ['1k', 'dk', 'pk']]
[[8, 1, 2], ['1w', 'dw', 'pw']]
[[3, 2, 1], ['2f', 'ef', 'qf']]
[[7, 2, 1], ['2j', 'ej', 'qj']]
[[11, 2, 1], ['2n', 'en', 'qn']]
[[8, 2, 2], ['2w', 'ew', 'qw']]
[[9, 2, 2], ['2x', 'ex', 'qx']]
[[5, 3, 0], ['35', 'f5', 'r5']]
[[1, 3, 1], ['3d', 'fd', 'rd']]
[[2, 3, 1], ['3e', 'fe', 're']]
[[3, 3, 1], ['3f', 'ff', 'rf']]
[[5, 3, 1], ['3h', 'fh', 'rh']]
[[6, 3, 1], ['3i', 'fi', 'ri']]
[[7, 3, 1], ['3j', 'fj', 'rj']]
[[11, 3, 1], ['3n', 'fn', 'rn']]
[[9, 3, 2], ['3x', 'fx', 'rx']]
[[5, 4, 0], ['45', 'g5', 's5']]
[[1, 4, 1], ['4d', 'gd', 'sd']]
[[11, 4, 1], ['4n', 'gn', 'sn']]
[[9, 4, 2], ['4x', 'gx', 'sx']]
[[3, 5, 0], ['53', 'h3', 't3']]
[[5, 5, 0], ['55', 'h5', 't5']]
[[6, 5, 0], ['56', 'h6', 't6']]
[[7, 5, 0], ['57', 'h7', 't7']]
[[1, 5, 1], ['5d', 'hd', 'td']]
[[2, 5, 1], ['5e', 'he', 'te']]
[[3, 5, 1], ['5f', 'hf', 'tf']]
[[8, 5, 2], ['5w', 'hw', 'tw']]
[[9, 5, 2], ['5x', 'hx', 'tx']]
[[3, 6, 0], ['63', 'i3', 'u3']]
[[7, 6, 0], ['67', 'i7', 'u7']]
[[11, 6, 0], ['6b', 'ib', 'ub']]
[[4, 6, 1], ['6g', 'ig', 'ug']]
[[5, 6, 1], ['6h', 'ih', 'uh']]
[[6, 6, 1], ['6i', 'ii', 'ui']]
[[7, 6, 1], ['6j', 'ij', 'uj']]
[[10, 6, 1], ['6m', 'im', 'um']]
[[11, 6, 1], ['6n', 'in', 'un']]
[[4, 6, 2], ['6s', 'is', 'us']]
[[8, 6, 2], ['6w', 'iw', 'uw']]
[[1, 7, 0], ['71', 'j1', 'v1']]
[[2, 7, 0], ['72', 'j2', 'v2']]
[[3, 7, 0], ['73', 'j3', 'v3']]
[[0, 7, 1], ['7c', 'jc', 'vc']]
[[1, 7, 1], ['7d', 'jd', 'vd']]
[[10, 7, 1], ['7m', 'jm', 'vm']]
[[4, 7, 2], ['7s', 'js', 'vs']]
[[8, 7, 2], ['7w', 'jw', 'vw']]
[[10, 7, 2], ['7y', 'jy', 'vy']]
[[11, 7, 2], ['7z', 'jz', 'vz']]
[[0, 8, 1], ['8c', 'kc', 'wc']]
[[0, 8, 2], ['8o', 'ko', 'wo']]
[[1, 8, 2], ['8p', 'kp', 'wp']]
[[2, 8, 2], ['8q', 'kq', 'wq']]
[[3, 8, 2], ['8r', 'kr', 'wr']]
[[4, 8, 2], ['8s', 'ks', 'ws']]
[[8, 8, 2], ['8w', 'kw', 'ww']]
[[9, 8, 2], ['8x', 'kx', 'wx']]
[[11, 9, 0], ['9b', 'lb', 'xb']]
[[1, 10, 0], ['a1', 'm1', 'y1']]
[[2, 10, 0], ['a2', 'm2', 'y2']]
[[3, 10, 0], ['a3', 'm3', 'y3']]
[[7, 10, 0], ['a7', 'm7', 'y7']]
[[8, 10, 0], ['a8', 'm8', 'y8']]
[[8, 10, 1], ['ak', 'mk', 'yk']]
[[3, 11, 0], ['b3', 'n3', 'z3']]
[[7, 11, 0], ['b7', 'n7', 'z7']]
[[11, 11, 0], ['bb', 'nb', 'zb']]
[[8, 11, 1], ['bk', 'nk', 'zk']]
[[9, 11, 1], ['bl', 'nl', 'zl']]
    '''

    #如只考虑每组的第一个字符是数字的情况下,其SN 为:0001111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x
    #snLstStr = "00 → 01 → 11 → 1d → 1e → 1f → 2f → 3f → 3e → 3d → 4d → 5d → 5e → 5f → 53 → 63 → 73 → 72 → 71 → 7d → 7c → 8c → 8o → 8p → 8q → 8r → 8s → 7s → 6s → 6g → 6h → 6i → 6j → 67 → 57 → 56 → 55 → 45 → 35 → 3h → 3i → 3j → 2j → 1j → 1k → 1w → 2w → 2x → 3x → 4x → 5x → 5w → 6w → 7w → 8w → 8x"
    #snLst = snLstStr.split(" → ")
    
    snLst = path
    snLst2 = []
    for tmp in snLst:
        indices = [i for i, x in enumerate(equalLst) if tmp in x[1]]
        if len(indices)==0:
            raise ValueError(f"未找到 {tmp}")
            snLst2.append([tmp])
            continue
        elif len(indices)>1:
            raise ValueError(f"找到 {tmp},{len(indices)}次")
            continue
        snLst2.append(equalLst[indices[0]][1])
    print("\nsnLst2")
    print(snLst2)
    #[['00', 'c0', 'o0'], ['01'], ['11'], ['1d'], ['1e'], ['1f'], ['2f'], ['3f'], ['3e'], ['3d'], ['4d'], ['5d'], ['5e'], ['5f'], ['53'], ['63'], ['73'], ['72'], ['71'], ['7d'], ['7c'], ['8c'], ['8o'], ['8p'], ['8q'], ['8r'], ['8s'], ['7s'], ['6s'], ['6g'], ['6h'], ['6i'], ['6j'], ['67'], ['57'], ['56'], ['55'], ['45'], ['35'], ['3h'], ['3i'], ['3j'], ['2j'], ['1j'], ['1k'], ['1w'], ['2w'], ['2x'], ['3x'], ['4x'], ['5x'], ['5w'], ['6w'], ['7w'], ['8w'], ['8x']]
    print(f"\nsnLst2:{len(snLst2)}")# 56 
    print(f"有效SN个数:{pow(3,len(snLst2))}") # 523347633027360537213511521
    os.system("pause")
    for i in snLst2:
        if len(i)>1:
            print(i)
    
    #输出所有的可能值:
    # 使用itertools.product计算笛卡尔积,得到所有可能的元素组合元组
    print("\n所有可能得序列号:")
    #product_results = itertools.product(*snLst2)# 数量太大,达到 千亿亿亿级 10 ** 26
    product_results = itertools.product(snLst2[0],snLst2[1],snLst2[2],snLst2[3])
    #剩余的列项
    lastItems = "".join(item[0] for item in snLst2[4:])
    print(f"lastItems: {lastItems}")
    combinations = [''.join(combination) for combination in product_results]
    for i in combinations:
        print(f"{i}{lastItems}")
    
    
    #['00', 'c0', 'o0']
    #只考虑第一个字符变动:3个序列号。
    #0001111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x
    #c001111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x
    #o001111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x


2025-8-17 16:55
0
雪    币: 7786
活跃值: (4488)
能力值: ( LV12,RANK:564 )
在线值:
发帖
回帖
粉丝
3

生成的部分序列号(取前4个进行交叉,共81个): 0001111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 000111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 000111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 0001d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 0001d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 0001d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 0001p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 0001p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 0001p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c1111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c1d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c1d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c1d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c1p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c1p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00c1p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o1111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o1d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o1d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o1d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o1p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o1p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x 00o1p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c001111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c00111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c00111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c001d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c001d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c001d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c001p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c001p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c001p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c1111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c1d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c1d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c1d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c1p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c1p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0c1p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o1111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o1d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o1d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o1d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o1p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o1p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x c0o1p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o001111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o00111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o00111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o001d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o001d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o001d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o001p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o001p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o001p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c1111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c1d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c1d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c1d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c1p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c1p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0c1p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o1111d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o111dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o111pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o1d11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o1d1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o1d1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o1p11d1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o1p1dd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x o0o1p1pd1e1f2f3f3e3d4d5d5e5f53637372717d7c8c8o8p8q8r8s7s6s6g6h6i6j6757565545353h3i3j2j1j1k1w2w2x3x4x5x5w6w7w8w8x

2025-8-17 16:57
0
游客
登录 | 注册 方可回帖
返回