TGCTF2025 re
蛇年的本命语言
from collections import Counter
print('Welcome to HZNUCTF!!!')
print('Plz input the flag:')
ooo0oOoooOOO0 = input()
oOO0OoOoo000 = Counter(ooo0oOoooOOO0)
O0o00 = ''.join((str(oOO0OoOoo000[oOooo0OOO]) for oOooo0OOO in ooo0oOoooOOO0))
print('ans1: ', end='')
print(O0o00)
if O0o00 != '111111116257645365477364777645752361':
print('wrong_wrong!!!')
exit(1)
iiIII = ''
for oOooo0OOO in ooo0oOoooOOO0:
if oOO0OoOoo000[oOooo0OOO] > 0:
iiIII += oOooo0OOO + str(oOO0OoOoo000[oOooo0OOO])
oOO0OoOoo000[oOooo0OOO] = 0
i11i1Iii1I1 = [ord(oOooo0OOO) for oOooo0OOO in iiIII]
ii1iIi1i11i = [
7 * i11i1Iii1I1[0] == 504,
9 * i11i1Iii1I1[0] - 5 * i11i1Iii1I1[1] == 403,
(2 * i11i1Iii1I1[0] - 5 * i11i1Iii1I1[1]) + 10 * i11i1Iii1I1[2] == 799,
3 * i11i1Iii1I1[0] + 8 * i11i1Iii1I1[1] + 15 * i11i1Iii1I1[2] + 20 * i11i1Iii1I1[3] == 2938,
(5 * i11i1Iii1I1[0] + 15 * i11i1Iii1I1[1] + 20 * i11i1Iii1I1[2] - 19 * i11i1Iii1I1[3]) + 1 * i11i1Iii1I1[4] == 2042,
(7 * i11i1Iii1I1[0] + 1 * i11i1Iii1I1[1] + 9 * i11i1Iii1I1[2] - 11 * i11i1Iii1I1[3]) + 2 * i11i1Iii1I1[4] + 5 * i11i1Iii1I1[5] == 1225,
11 * i11i1Iii1I1[0] + 22 * i11i1Iii1I1[1] + 33 * i11i1Iii1I1[2] + 44 * i11i1Iii1I1[3] + 55 * i11i1Iii1I1[4] + 66 * i11i1Iii1I1[5] - 77 * i11i1Iii1I1[6] == 7975,
((21 * i11i1Iii1I1[0] + 23 * i11i1Iii1I1[1] + 3 * i11i1Iii1I1[2] + 24 * i11i1Iii1I1[3] - 55 * i11i1Iii1I1[4]) + 6 * i11i1Iii1I1[5] - 7 * i11i1Iii1I1[6]) + 15 * i11i1Iii1I1[7] == 229,
(2 * i11i1Iii1I1[0] + 26 * i11i1Iii1I1[1] + 13 * i11i1Iii1I1[2] + 0 * i11i1Iii1I1[3] - 65 * i11i1Iii1I1[4]) + 15 * i11i1Iii1I1[5] + 29 * i11i1Iii1I1[6] + 1 * i11i1Iii1I1[7] + 20 * i11i1Iii1I1[8] == 2107,
(10 * i11i1Iii1I1[0] + 7 * i11i1Iii1I1[1] + -9 * i11i1Iii1I1[2] + 6 * i11i1Iii1I1[3] + 7 * i11i1Iii1I1[4] + 1 * i11i1Iii1I1[5] + 22 * i11i1Iii1I1[6] + 21 * i11i1Iii1I1[7] - 22 * i11i1Iii1I1[8]) + 30 * i11i1Iii1I1[9] == 4037,
(15 * i11i1Iii1I1[0] + 59 * i11i1Iii1I1[1] + 56 * i11i1Iii1I1[2] + 66 * i11i1Iii1I1[3] + 7 * i11i1Iii1I1[4] + 1 * i11i1Iii1I1[5] - 122 * i11i1Iii1I1[6]) + 21 * i11i1Iii1I1[7] + 32 * i11i1Iii1I1[8] + 3 * i11i1Iii1I1[9] - 10 * i11i1Iii1I1[10] == 4950,
(((13 * i11i1Iii1I1[0] + 66 * i11i1Iii1I1[1] + 29 * i11i1Iii1I1[2] + 39 * i11i1Iii1I1[3] - 33 * i11i1Iii1I1[4]) + 13 * i11i1Iii1I1[5] - 2 * i11i1Iii1I1[6]) + 42 * i11i1Iii1I1[7] + 62 * i11i1Iii1I1[8] + 1 * i11i1Iii1I1[9] - 10 * i11i1Iii1I1[10]) + 11 * i11i1Iii1I1[11] == 12544,
(((23 * i11i1Iii1I1[0] + 6 * i11i1Iii1I1[1] + 29 * i11i1Iii1I1[2] + 3 * i11i1Iii1I1[3] - 3 * i11i1Iii1I1[4]) + 63 * i11i1Iii1I1[5] - 25 * i11i1Iii1I1[6]) + 2 * i11i1Iii1I1[7] + 32 * i11i1Iii1I1[8] + 1 * i11i1Iii1I1[9] - 10 * i11i1Iii1I1[10]) + 11 * i11i1Iii1I1[11] - 12 * i11i1Iii1I1[12] == 6585,
((((223 * i11i1Iii1I1[0] + 6 * i11i1Iii1I1[1] - 29 * i11i1Iii1I1[2] - 53 * i11i1Iii1I1[3] - 3 * i11i1Iii1I1[4]) + 3 * i11i1Iii1I1[5] - 65 * i11i1Iii1I1[6]) + 0 * i11i1Iii1I1[7] + 36 * i11i1Iii1I1[8] + 1 * i11i1Iii1I1[9] - 15 * i11i1Iii1I1[10]) + 16 * i11i1Iii1I1[11] - 18 * i11i1Iii1I1[12]) + 13 * i11i1Iii1I1[13] == 6893,
((((29 * i11i1Iii1I1[0] + 13 * i11i1Iii1I1[1] - 9 * i11i1Iii1I1[2] - 93 * i11i1Iii1I1[3]) + 33 * i11i1Iii1I1[4] + 6 * i11i1Iii1I1[5] + 65 * i11i1Iii1I1[6] + 1 * i11i1Iii1I1[7] - 36 * i11i1Iii1I1[8]) + 0 * i11i1Iii1I1[9] - 16 * i11i1Iii1I1[10]) + 96 * i11i1Iii1I1[11] - 68 * i11i1Iii1I1[12]) + 33 * i11i1Iii1I1[13] - 14 * i11i1Iii1I1[14] == 1883,
(((69 * i11i1Iii1I1[0] + 77 * i11i1Iii1I1[1] - 93 * i11i1Iii1I1[2] - 12 * i11i1Iii1I1[3]) + 0 * i11i1Iii1I1[4] + 0 * i11i1Iii1I1[5] + 1 * i11i1Iii1I1[6] + 16 * i11i1Iii1I1[7] + 36 * i11i1Iii1I1[8] + 6 * i11i1Iii1I1[9] + 19 * i11i1Iii1I1[10] + 66 * i11i1Iii1I1[11] - 8 * i11i1Iii1I1[12]) + 38 * i11i1Iii1I1[13] - 16 * i11i1Iii1I1[14]) + 15 * i11i1Iii1I1[15] == 8257,
((((23 * i11i1Iii1I1[0] + 2 * i11i1Iii1I1[1] - 3 * i11i1Iii1I1[2] - 11 * i11i1Iii1I1[3]) + 12 * i11i1Iii1I1[4] + 24 * i11i1Iii1I1[5] + 1 * i11i1Iii1I1[6] + 6 * i11i1Iii1I1[7] + 14 * i11i1Iii1I1[8] - 0 * i11i1Iii1I1[9]) + 1 * i11i1Iii1I1[10] + 68 * i11i1Iii1I1[11] - 18 * i11i1Iii1I1[12]) + 68 * i11i1Iii1I1[13] - 26 * i11i1Iii1I1[14]) + 15 * i11i1Iii1I1[15] - 16 * i11i1Iii1I1[16] == 5847,
(((((24 * i11i1Iii1I1[0] + 0 * i11i1Iii1I1[1] - 1 * i11i1Iii1I1[2] - 15 * i11i1Iii1I1[3]) + 13 * i11i1Iii1I1[4] + 4 * i11i1Iii1I1[5] + 16 * i11i1Iii1I1[6] + 67 * i11i1Iii1I1[7] + 146 * i11i1Iii1I1[8] - 50 * i11i1Iii1I1[9]) + 16 * i11i1Iii1I1[10] + 6 * i11i1Iii1I1[11] - 1 * i11i1Iii1I1[12]) + 69 * i11i1Iii1I1[13] - 27 * i11i1Iii1I1[14]) + 45 * i11i1Iii1I1[15] - 6 * i11i1Iii1I1[16]) + 17 * i11i1Iii1I1[17] == 18257,
((((25 * i11i1Iii1I1[0] + 26 * i11i1Iii1I1[1] - 89 * i11i1Iii1I1[2]) + 16 * i11i1Iii1I1[3] + 19 * i11i1Iii1I1[4] + 44 * i11i1Iii1I1[5] + 36 * i11i1Iii1I1[6] + 66 * i11i1Iii1I1[7] - 150 * i11i1Iii1I1[8] - 250 * i11i1Iii1I1[9]) + 166 * i11i1Iii1I1[10] + 126 * i11i1Iii1I1[11] - 11 * i11i1Iii1I1[12]) + 690 * i11i1Iii1I1[13] - 207 * i11i1Iii1I1[14]) + 46 * i11i1Iii1I1[15] + 6 * i11i1Iii1I1[16] + 7 * i11i1Iii1I1[17] - 18 * i11i1Iii1I1[18] == 12591,
(((((5 * i11i1Iii1I1[0] + 26 * i11i1Iii1I1[1] + 8 * i11i1Iii1I1[2] + 160 * i11i1Iii1I1[3] + 9 * i11i1Iii1I1[4] - 4 * i11i1Iii1I1[5]) + 36 * i11i1Iii1I1[6] + 6 * i11i1Iii1I1[7] - 15 * i11i1Iii1I1[8] - 20 * i11i1Iii1I1[9]) + 66 * i11i1Iii1I1[10] + 16 * i11i1Iii1I1[11] - 1 * i11i1Iii1I1[12]) + 690 * i11i1Iii1I1[13] - 20 * i11i1Iii1I1[14]) + 46 * i11i1Iii1I1[15] + 6 * i11i1Iii1I1[16] + 7 * i11i1Iii1I1[17] - 18 * i11i1Iii1I1[18]) + 19 * i11i1Iii1I1[19] == 52041,
((((((29 * i11i1Iii1I1[0] - 26 * i11i1Iii1I1[1]) + 0 * i11i1Iii1I1[2] + 60 * i11i1Iii1I1[3] + 90 * i11i1Iii1I1[4] - 4 * i11i1Iii1I1[5]) + 6 * i11i1Iii1I1[6] + 6 * i11i1Iii1I1[7] - 16 * i11i1Iii1I1[8] - 21 * i11i1Iii1I1[9]) + 69 * i11i1Iii1I1[10] + 6 * i11i1Iii1I1[11] - 12 * i11i1Iii1I1[12]) + 69 * i11i1Iii1I1[13] - 20 * i11i1Iii1I1[14] - 46 * i11i1Iii1I1[15]) + 65 * i11i1Iii1I1[16] + 0 * i11i1Iii1I1[17] - 1 * i11i1Iii1I1[18]) + 39 * i11i1Iii1I1[19] - 20 * i11i1Iii1I1[20] == 20253,
(((((((45 * i11i1Iii1I1[0] - 56 * i11i1Iii1I1[1]) + 10 * i11i1Iii1I1[2] + 650 * i11i1Iii1I1[3] - 900 * i11i1Iii1I1[4]) + 44 * i11i1Iii1I1[5] + 66 * i11i1Iii1I1[6] - 6 * i11i1Iii1I1[7] - 6 * i11i1Iii1I1[8] - 21 * i11i1Iii1I1[9]) + 9 * i11i1Iii1I1[10] - 6 * i11i1Iii1I1[11] - 12 * i11i1Iii1I1[12]) + 69 * i11i1Iii1I1[13] - 2 * i11i1Iii1I1[14] - 406 * i11i1Iii1I1[15]) + 651 * i11i1Iii1I1[16] + 2 * i11i1Iii1I1[17] - 10 * i11i1Iii1I1[18]) + 69 * i11i1Iii1I1[19] - 0 * i11i1Iii1I1[20]) + 21 * i11i1Iii1I1[21] == 18768,
(((((555 * i11i1Iii1I1[0] - 6666 * i11i1Iii1I1[1]) + 70 * i11i1Iii1I1[2] + 510 * i11i1Iii1I1[3] - 90 * i11i1Iii1I1[4]) + 499 * i11i1Iii1I1[5] + 66 * i11i1Iii1I1[6] - 66 * i11i1Iii1I1[7] - 610 * i11i1Iii1I1[8] - 221 * i11i1Iii1I1[9]) + 9 * i11i1Iii1I1[10] - 23 * i11i1Iii1I1[11] - 102 * i11i1Iii1I1[12]) + 6 * i11i1Iii1I1[13] + 2050 * i11i1Iii1I1[14] - 406 * i11i1Iii1I1[15]) + 665 * i11i1Iii1I1[16] + 333 * i11i1Iii1I1[17] + 100 * i11i1Iii1I1[18] + 609 * i11i1Iii1I1[19] + 777 * i11i1Iii1I1[20] + 201 * i11i1Iii1I1[21] - 22 * i11i1Iii1I1[22] == 111844,
(((((((1 * i11i1Iii1I1[0] - 22 * i11i1Iii1I1[1]) + 333 * i11i1Iii1I1[2] + 4444 * i11i1Iii1I1[3] - 5555 * i11i1Iii1I1[4]) + 6666 * i11i1Iii1I1[5] - 666 * i11i1Iii1I1[6]) + 676 * i11i1Iii1I1[7] - 660 * i11i1Iii1I1[8] - 22 * i11i1Iii1I1[9]) + 9 * i11i1Iii1I1[10] - 73 * i11i1Iii1I1[11] - 107 * i11i1Iii1I1[12]) + 6 * i11i1Iii1I1[13] + 250 * i11i1Iii1I1[14] - 6 * i11i1Iii1I1[15]) + 65 * i11i1Iii1I1[16] + 39 * i11i1Iii1I1[17] + 10 * i11i1Iii1I1[18] + 69 * i11i1Iii1I1[19] + 777 * i11i1Iii1I1[20] + 201 * i11i1Iii1I1[21] - 2 * i11i1Iii1I1[22]) + 23 * i11i1Iii1I1[23] == 159029,
(((520 * i11i1Iii1I1[0] - 222 * i11i1Iii1I1[1]) + 333 * i11i1Iii1I1[2] + 4 * i11i1Iii1I1[3] - 56655 * i11i1Iii1I1[4]) + 6666 * i11i1Iii1I1[5] + 666 * i11i1Iii1I1[6] + 66 * i11i1Iii1I1[7] - 60 * i11i1Iii1I1[8] - 220 * i11i1Iii1I1[9]) + 99 * i11i1Iii1I1[10] + 73 * i11i1Iii1I1[11] + 1007 * i11i1Iii1I1[12] + 7777 * i11i1Iii1I1[13] + 2500 * i11i1Iii1I1[14] + 6666 * i11i1Iii1I1[15] + 605 * i11i1Iii1I1[16] + 390 * i11i1Iii1I1[17] + 100 * i11i1Iii1I1[18] + 609 * i11i1Iii1I1[19] + 99999 * i11i1Iii1I1[20] + 210 * i11i1Iii1I1[21] + 232 * i11i1Iii1I1[22] + 23 * i11i1Iii1I1[23] - 24 * i11i1Iii1I1[24] == 2762025,
((((1323 * i11i1Iii1I1[0] - 22 * i11i1Iii1I1[1]) + 333 * i11i1Iii1I1[2] + 4 * i11i1Iii1I1[3] - 55 * i11i1Iii1I1[4]) + 666 * i11i1Iii1I1[5] + 666 * i11i1Iii1I1[6] + 66 * i11i1Iii1I1[7] - 660 * i11i1Iii1I1[8] - 220 * i11i1Iii1I1[9]) + 99 * i11i1Iii1I1[10] + 3 * i11i1Iii1I1[11] + 100 * i11i1Iii1I1[12] + 777 * i11i1Iii1I1[13] + 2500 * i11i1Iii1I1[14] + 6666 * i11i1Iii1I1[15] + 605 * i11i1Iii1I1[16] + 390 * i11i1Iii1I1[17] + 100 * i11i1Iii1I1[18] + 609 * i11i1Iii1I1[19] + 9999 * i11i1Iii1I1[20] + 210 * i11i1Iii1I1[21] + 232 * i11i1Iii1I1[22] + 23 * i11i1Iii1I1[23] - 24 * i11i1Iii1I1[24]) + 25 * i11i1Iii1I1[25] == 1551621,
(((((777 * i11i1Iii1I1[0] - 22 * i11i1Iii1I1[1]) + 6969 * i11i1Iii1I1[2] + 4 * i11i1Iii1I1[3] - 55 * i11i1Iii1I1[4]) + 666 * i11i1Iii1I1[5] - 6 * i11i1Iii1I1[6]) + 96 * i11i1Iii1I1[7] - 60 * i11i1Iii1I1[8] - 220 * i11i1Iii1I1[9]) + 99 * i11i1Iii1I1[10] + 3 * i11i1Iii1I1[11] + 100 * i11i1Iii1I1[12] + 777 * i11i1Iii1I1[13] + 250 * i11i1Iii1I1[14] + 666 * i11i1Iii1I1[15] + 65 * i11i1Iii1I1[16] + 90 * i11i1Iii1I1[17] + 100 * i11i1Iii1I1[18] + 609 * i11i1Iii1I1[19] + 999 * i11i1Iii1I1[20] + 21 * i11i1Iii1I1[21] + 232 * i11i1Iii1I1[22] + 23 * i11i1Iii1I1[23] - 24 * i11i1Iii1I1[24]) + 25 * i11i1Iii1I1[25] - 26 * i11i1Iii1I1[26] == 948348,
((((((97 * i11i1Iii1I1[0] - 22 * i11i1Iii1I1[1]) + 6969 * i11i1Iii1I1[2] + 4 * i11i1Iii1I1[3] - 56 * i11i1Iii1I1[4]) + 96 * i11i1Iii1I1[5] - 6 * i11i1Iii1I1[6]) + 96 * i11i1Iii1I1[7] - 60 * i11i1Iii1I1[8] - 20 * i11i1Iii1I1[9]) + 99 * i11i1Iii1I1[10] + 3 * i11i1Iii1I1[11] + 10 * i11i1Iii1I1[12] + 707 * i11i1Iii1I1[13] + 250 * i11i1Iii1I1[14] + 666 * i11i1Iii1I1[15] + -9 * i11i1Iii1I1[16] + 90 * i11i1Iii1I1[17] + -2 * i11i1Iii1I1[18] + 609 * i11i1Iii1I1[19] + 0 * i11i1Iii1I1[20] + 21 * i11i1Iii1I1[21] + 2 * i11i1Iii1I1[22] + 23 * i11i1Iii1I1[23] - 24 * i11i1Iii1I1[24]) + 25 * i11i1Iii1I1[25] - 26 * i11i1Iii1I1[26]) + 27 * i11i1Iii1I1[27] == 777044,
(((((177 * i11i1Iii1I1[0] - 22 * i11i1Iii1I1[1]) + 699 * i11i1Iii1I1[2] + 64 * i11i1Iii1I1[3] - 56 * i11i1Iii1I1[4] - 96 * i11i1Iii1I1[5] - 66 * i11i1Iii1I1[6]) + 96 * i11i1Iii1I1[7] - 60 * i11i1Iii1I1[8] - 20 * i11i1Iii1I1[9]) + 99 * i11i1Iii1I1[10] + 3 * i11i1Iii1I1[11] + 10 * i11i1Iii1I1[12] + 707 * i11i1Iii1I1[13] + 250 * i11i1Iii1I1[14] + 666 * i11i1Iii1I1[15] + -9 * i11i1Iii1I1[16] + 0 * i11i1Iii1I1[17] + -2 * i11i1Iii1I1[18] + 69 * i11i1Iii1I1[19] + 0 * i11i1Iii1I1[20] + 21 * i11i1Iii1I1[21] + 222 * i11i1Iii1I1[22] + 23 * i11i1Iii1I1[23] - 224 * i11i1Iii1I1[24]) + 25 * i11i1Iii1I1[25] - 26 * i11i1Iii1I1[26]) + 27 * i11i1Iii1I1[27] - 28 * i11i1Iii1I1[28] == 185016,
((((((77 * i11i1Iii1I1[0] - 2 * i11i1Iii1I1[1]) + 6 * i11i1Iii1I1[2] + 6 * i11i1Iii1I1[3] - 96 * i11i1Iii1I1[4] - 9 * i11i1Iii1I1[5] - 6 * i11i1Iii1I1[6]) + 96 * i11i1Iii1I1[7] - 0 * i11i1Iii1I1[8] - 20 * i11i1Iii1I1[9]) + 99 * i11i1Iii1I1[10] + 3 * i11i1Iii1I1[11] + 10 * i11i1Iii1I1[12] + 707 * i11i1Iii1I1[13] + 250 * i11i1Iii1I1[14] + 666 * i11i1Iii1I1[15] + -9 * i11i1Iii1I1[16] + 0 * i11i1Iii1I1[17] + -2 * i11i1Iii1I1[18] + 9 * i11i1Iii1I1[19] + 0 * i11i1Iii1I1[20] + 21 * i11i1Iii1I1[21] + 222 * i11i1Iii1I1[22] + 23 * i11i1Iii1I1[23] - 224 * i11i1Iii1I1[24]) + 26 * i11i1Iii1I1[25] - -58 * i11i1Iii1I1[26]) + 27 * i11i1Iii1I1[27] - 2 * i11i1Iii1I1[28]) + 29 * i11i1Iii1I1[29] == 130106]
if all(ii1iIi1i11i):
print('Congratulation!!!')
else:
print('wrong_wrong!!!')
z3
# from z3 import *
#
# # 创建求解器
# s = Solver()
#
# # 定义变量（假设有30个变量）
# a = [Int(f'a_{i}') for i in range(30)]
#
# # 添加约束
# s.add(7 * a[0] == 504)
# s.add(9 * a[0] - 5 * a[1] == 403)
# s.add((2 * a[0] - 5 * a[1]) + 10 * a[2] == 799)
# s.add(3 * a[0] + 8 * a[1] + 15 * a[2] + 20 * a[3] == 2938)
# s.add((5 * a[0] + 15 * a[1] + 20 * a[2] - 19 * a[3]) + 1 * a[4] == 2042)
# s.add((7 * a[0] + 1 * a[1] + 9 * a[2] - 11 * a[3]) + 2 * a[4] + 5 * a[5] == 1225)
# s.add(11 * a[0] + 22 * a[1] + 33 * a[2] + 44 * a[3] + 55 * a[4] + 66 * a[5] - 77 * a[6] == 7975)
# s.add(((21 * a[0] + 23 * a[1] + 3 * a[2] + 24 * a[3] - 55 * a[4]) + 6 * a[5] - 7 * a[6]) + 15 * a[7] == 229)
# s.add((2 * a[0] + 26 * a[1] + 13 * a[2] + 0 * a[3] - 65 * a[4]) + 15 * a[5] + 29 * a[6] + 1 * a[7] + 20 * a[8] == 2107)
# s.add((10 * a[0] + 7 * a[1] + -9 * a[2] + 6 * a[3] + 7 * a[4] + 1 * a[5] + 22 * a[6] + 21 * a[7] - 22 * a[8]) + 30 * a[9] == 4037)
# s.add((15 * a[0] + 59 * a[1] + 56 * a[2] + 66 * a[3] + 7 * a[4] + 1 * a[5] - 122 * a[6]) + 21 * a[7] + 32 * a[8] + 3 * a[9] - 10 * a[10] == 4950)
# s.add((((13 * a[0] + 66 * a[1] + 29 * a[2] + 39 * a[3] - 33 * a[4]) + 13 * a[5] - 2 * a[6]) + 42 * a[7] + 62 * a[8] + 1 * a[9] - 10 * a[10]) + 11 * a[11] == 12544)
# s.add((((23 * a[0] + 6 * a[1] + 29 * a[2] + 3 * a[3] - 3 * a[4]) + 63 * a[5] - 25 * a[6]) + 2 * a[7] + 32 * a[8] + 1 * a[9] - 10 * a[10]) + 11 * a[11] - 12 * a[12] == 6585)
# s.add(((((223 * a[0] + 6 * a[1] - 29 * a[2] - 53 * a[3] - 3 * a[4]) + 3 * a[5] - 65 * a[6]) + 0 * a[7] + 36 * a[8] + 1 * a[9] - 15 * a[10]) + 16 * a[11] - 18 * a[12]) + 13 * a[13] == 6893)
# s.add(((((29 * a[0] + 13 * a[1] - 9 * a[2] - 93 * a[3]) + 33 * a[4] + 6 * a[5] + 65 * a[6] + 1 * a[7] - 36 * a[8]) + 0 * a[9] - 16 * a[10]) + 96 * a[11] - 68 * a[12]) + 33 * a[13] - 14 * a[14] == 1883)
# s.add((((69 * a[0] + 77 * a[1] - 93 * a[2] - 12 * a[3]) + 0 * a[4] + 0 * a[5] + 1 * a[6] + 16 * a[7] + 36 * a[8] + 6 * a[9] + 19 * a[10] + 66 * a[11] - 8 * a[12]) + 38 * a[13] - 16 * a[14]) + 15 * a[15] == 8257)
# s.add(((((23 * a[0] + 2 * a[1] - 3 * a[2] - 11 * a[3]) + 12 * a[4] + 24 * a[5] + 1 * a[6] + 6 * a[7] + 14 * a[8] - 0 * a[9]) + 1 * a[10] + 68 * a[11] - 18 * a[12]) + 68 * a[13] - 26 * a[14]) + 15 * a[15] - 16 * a[16] == 5847)
# s.add((((((24 * a[0] + 0 * a[1] - 1 * a[2] - 15 * a[3]) + 13 * a[4] + 4 * a[5] + 16 * a[6] + 67 * a[7] + 146 * a[8] - 50 * a[9]) + 16 * a[10] + 6 * a[11] - 1 * a[12]) + 69 * a[13] - 27 * a[14]) + 45 * a[15] - 6 * a[16]) + 17 * a[17] == 18257)
# s.add(((((25 * a[0] + 26 * a[1] - 89 * a[2]) + 16 * a[3] + 19 * a[4] + 44 * a[5] + 36 * a[6] + 66 * a[7] - 150 * a[8] - 250 * a[9]) + 166 * a[10] + 126 * a[11] - 11 * a[12]) + 690 * a[13] - 207 * a[14]) + 46 * a[15] + 6 * a[16] + 7 * a[17] - 18 * a[18] == 12591)
# s.add((((((5 * a[0] + 26 * a[1] + 8 * a[2] + 160 * a[3] + 9 * a[4] - 4 * a[5]) + 36 * a[6] + 6 * a[7] - 15 * a[8] - 20 * a[9]) + 66 * a[10] + 16 * a[11] - 1 * a[12]) + 690 * a[13] - 20 * a[14]) + 46 * a[15] + 6 * a[16] + 7 * a[17] - 18 * a[18]) + 19 * a[19] == 52041)
# s.add(((((((29 * a[0] - 26 * a[1]) + 0 * a[2] + 60 * a[3] + 90 * a[4] - 4 * a[5]) + 6 * a[6] + 6 * a[7] - 16 * a[8] - 21 * a[9]) + 69 * a[10] + 6 * a[11] - 12 * a[12]) + 69 * a[13] - 20 * a[14] - 46 * a[15]) + 65 * a[16] + 0 * a[17] - 1 * a[18]) + 39 * a[19] - 20 * a[20] == 20253)
# s.add((((((((45 * a[0] - 56 * a[1]) + 10 * a[2] + 650 * a[3] - 900 * a[4]) + 44 * a[5] + 66 * a[6] - 6 * a[7] - 6 * a[8] - 21 * a[9]) + 9 * a[10] - 6 * a[11] - 12 * a[12]) + 69 * a[13] - 2 * a[14] - 406 * a[15]) + 651 * a[16] + 2 * a[17] - 10 * a[18]) + 69 * a[19] - 0 * a[20]) + 21 * a[21] == 18768)
# s.add((((((555 * a[0] - 6666 * a[1]) + 70 * a[2] + 510 * a[3] - 90 * a[4]) + 499 * a[5] + 66 * a[6] - 66 * a[7] - 610 * a[8] - 221 * a[9]) + 9 * a[10] - 23 * a[11] - 102 * a[12]) + 6 * a[13] + 2050 * a[14] - 406 * a[15]) + 665 * a[16] + 333 * a[17] + 100 * a[18] + 609 * a[19] + 777 * a[20] + 201 * a[21] - 22 * a[22] == 111844)
# s.add((((((((1 * a[0] - 22 * a[1]) + 333 * a[2] + 4444 * a[3] - 5555 * a[4]) + 6666 * a[5] - 666 * a[6]) + 676 * a[7] - 660 * a[8] - 22 * a[9]) + 9 * a[10] - 73 * a[11] - 107 * a[12]) + 6 * a[13] + 250 * a[14] - 6 * a[15]) + 65 * a[16] + 39 * a[17] + 10 * a[18] + 69 * a[19] + 777 * a[20] + 201 * a[21] - 2 * a[22]) + 23 * a[23] == 159029)
# s.add((((520 * a[0] - 222 * a[1]) + 333 * a[2] + 4 * a[3] - 56655 * a[4]) + 6666 * a[5] + 666 * a[6] + 66 * a[7] - 60 * a[8] - 220 * a[9]) + 99 * a[10] + 73 * a[11] + 1007 * a[12] + 7777 * a[13] + 2500 * a[14] + 6666 * a[15] + 605 * a[16] + 390 * a[17] + 100 * a[18] + 609 * a[19] + 99999 * a[20] + 210 * a[21] + 232 * a[22] + 23 * a[23] - 24 * a[24] == 2762025)
# s.add(((((1323 * a[0] - 22 * a[1]) + 333 * a[2] + 4 * a[3] - 55 * a[4]) + 666 * a[5] + 666 * a[6] + 66 * a[7] - 660 * a[8] - 220 * a[9]) + 99 * a[10] + 3 * a[11] + 100 * a[12] + 777 * a[13] + 2500 * a[14] + 6666 * a[15] + 605 * a[16] + 390 * a[17] + 100 * a[18] + 609 * a[19] + 9999 * a[20] + 210 * a[21] + 232 * a[22] + 23 * a[23] - 24 * a[24]) + 25 * a[25] == 1551621)
# s.add((((((777 * a[0] - 22 * a[1]) + 6969 * a[2] + 4 * a[3] - 55 * a[4]) + 666 * a[5] - 6 * a[6]) + 96 * a[7] - 60 * a[8] - 220 * a[9]) + 99 * a[10] + 3 * a[11] + 100 * a[12] + 777 * a[13] + 250 * a[14] + 666 * a[15] + 65 * a[16] + 90 * a[17] + 100 * a[18] + 609 * a[19] + 999 * a[20] + 21 * a[21] + 232 * a[22] + 23 * a[23] - 24 * a[24]) + 25 * a[25] - 26 * a[26] == 948348)
# s.add(((((((97 * a[0] - 22 * a[1]) + 6969 * a[2] + 4 * a[3] - 56 * a[4]) + 96 * a[5] - 6 * a[6]) + 96 * a[7] - 60 * a[8] - 20 * a[9]) + 99 * a[10] + 3 * a[11] + 10 * a[12] + 707 * a[13] + 250 * a[14] + 666 * a[15] + -9 * a[16] + 90 * a[17] + -2 * a[18] + 609 * a[19] + 0 * a[20] + 21 * a[21] + 2 * a[22] + 23 * a[23] - 24 * a[24]) + 25 * a[25] - 26 * a[26]) + 27 * a[27] == 777044)
# s.add((((((177 * a[0] - 22 * a[1]) + 699 * a[2] + 64 * a[3] - 56 * a[4] - 96 * a[5] - 66 * a[6]) + 96 * a[7] - 60 * a[8] - 20 * a[9]) + 99 * a[10] + 3 * a[11] + 10 * a[12] + 707 * a[13] + 250 * a[14] + 666 * a[15] + -9 * a[16] + 0 * a[17] + -2 * a[18] + 69 * a[19] + 0 * a[20] + 21 * a[21] + 222 * a[22] + 23 * a[23] - 224 * a[24]) + 25 * a[25] - 26 * a[26]) + 27 * a[27] - 28 * a[28] == 185016)
# s.add(((((((77 * a[0] - 2 * a[1]) + 6 * a[2] + 6 * a[3] - 96 * a[4] - 9 * a[5] - 6 * a[6]) + 96 * a[7] - 0 * a[8] - 20 * a[9]) + 99 * a[10] + 3 * a[11] + 10 * a[12] + 707 * a[13] + 250 * a[14] + 666 * a[15] + -9 * a[16] + 0 * a[17] + -2 * a[18] + 9 * a[19] + 0 * a[20] + 21 * a[21] + 222 * a[22] + 23 * a[23] - 224 * a[24]) + 26 * a[25] - -58 * a[26]) + 27 * a[27] - 2 * a[28]) + 29 * a[29] == 130106)
#
# # 检查是否有解
# if s.check() == sat:
# m = s.model()
# # 获取解
# solution = [m.evaluate(a[i]) for i in range(30)]
# print("Solution:", solution)
# else:
# print("No solution found.")
z=[72, 49, 90, 49, 78, 49, 85, 49, 67, 49, 84, 49, 70, 49, 123, 49, 97, 54, 100, 50, 55, 53, 102, 55, 45, 52, 54, 51, 125, 49]
for i in z:
print(chr(i), end='')
输出为H1Z1N1U1C1T1F1{1a6d275f7-463}1
分析
from collections import Counter
print('Welcome to HZNUCTF!!!')
print('Plz input the flag:')
ooo0oOoooOOO0 = input() # 用户输入 flag
oOO0OoOoo000 = Counter(ooo0oOoooOOO0) # 统计每个字符出现次数
# 把输入的每一个字符对应的“出现次数”拼接起来
O0o00 = ''.join((str(oOO0OoOoo000[oOooo0OOO]) for oOooo0OOO in ooo0oOoooOOO0))
print('ans1: ', end='')
print(O0o00)
# 第一关检查：频率序列是否匹配
if O0o00 != '111111116257645365477364777645752361':
print('wrong_wrong!!!')
exit(1)
# 第二关处理：将每种字符+其次数，按第一次出现顺序拼接
iiIII = ''
for oOooo0OOO in ooo0oOoooOOO0:
if oOO0OoOoo000[oOooo0OOO] > 0:
iiIII += oOooo0OOO + str(oOO0OoOoo000[oOooo0OOO])
oOO0OoOoo000[oOooo0OOO] = 0
# 转成 ASCII 数字列表
i11i1Iii1I1 = [ord(oOooo0OOO) for oOooo0OOO in iiIII]
from collections import Counter
print('Welcome to HZNUCTF!!!')
print('Plz input the flag:')
flag = input()
count = Counter(flag)
O0o00 = ''.join((str(count[i]) for i in flag))
print('ans1: ', end='')
print(O0o00)
if O0o00 != '111111116257645365477364777645752361':
print('wrong_wrong!!!')
exit(1)
output = ''
for i in flag:
if count[i] > 0:
output += i + str(count[i])
count[i] = 0
i11i1Iii1I1 = [ord(i) for i in output]
z3的输出是两个两个为一组，前一个是字符，后一个是出现次数，替换就好
HZNUCTF{ad7fa-76a7-ff6a-fffa-7f7d6a}
base64
改了编码表
#include<stdio.h>
#include<string.h>
int main(){
char a[]="GLp/+Wn7uqX8FQ2JDR1c0M6U53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9iebI";
for(int i=24;i<64;i++){
printf("%c",a[i]);
}
for(int i=0;i<24;i++){
printf("%c",a[i]);
}
}
//53sjBwyxglmrCVdSThAfEOvPHaYZNzo4ktK9iebIGLp/+Wn7uqX8FQ2JDR1c0M6U
base64换表解码
水果忍者
unity游戏
反编译工具可以是dnSpy或者ILSpy，前者更直观
{}目录下为函数
GameManager函数里面就有Decrypt，数据在最下面，AES-CBC模式的，cyberchef就好
XTEA
readme里面的压缩包密码就是delta
通过字符串定位到主函数
xtea加密也是标准的
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
uint32_t* dec(uint32_t delta, uint32_t* v0, uint32_t* v1, uint32_t* key)
{
uint32_t sum = -(int32_t)(delta * 32);
for (int i = 0; i < 32; ++i)
{
*v1 -= (key[(sum >> 11) & 3] + sum) ^ (*v0 + ((*v0 >> 5) ^ (*v0 << 4)));
sum += delta;
*v0 -= (key[sum & 3] + sum) ^ (*v1 + ((*v1 >> 5) ^ (*v1 << 4)));
}
}
int main()
{
uint32_t buffer[] = {
0x8CCB2324, 0x09A7741A,
0xFB3C678D, 0xF6083A79,
0xF1CC241B, 0x39FA59F2,
0xF2ABE1CC, 0x17189F72
};
srand(0x7e8);
uint32_t key[4];
for (int i = 0; i < 4; i++) key[i] = rand();
for (int j = 7; j > 0; j--) dec(0x9E3779B9, &buffer[j - 1], &buffer[j], key);
for (int i = 0; i < 8; i++) {
uint32_t val = buffer[i];
putchar((val >> 24) & 0xFF);
putchar((val >> 16) & 0xFF);
putchar((val >> 8) & 0xFF);
putchar(val & 0xFF);
}
return 0;
}
//HZNUCTF{ae6-9f57-4b74-b423-98eb}
randomsystem
sub_412370是主函数
这四个函数都有花
去花
先去第四个函数的花
sub_41105F
nop完方框内的
主函数里面传入的参数只有两个，Destination和v11
sub_411307
用nomoreflower脚本跑一下，再进入函数
按C强制转换
sub_411334
call无意义的地址，就将call指令（E9）删掉，如下图
nop
sub_4112DA
00413113的E9也要nop
TlsCallback_0_0
__int64 __fastcall TlsCallback_0_0(int a1, int a2, int a3, int a4, int a5)
{
int v5; // eax
__int64 v7; // [esp-4h] [ebp-1FCh]
int v8; // [esp+0h] [ebp-1F8h]
int j; // [esp+D0h] [ebp-128h]
int i; // [esp+DCh] [ebp-11Ch]
int v11; // [esp+E8h] [ebp-110h]
_DWORD v12[65]; // [esp+F4h] [ebp-104h] BYREF
int savedregs; // [esp+1F8h] [ebp+0h] BYREF
v5 = v8;
Seed = 2025;
v12[0] = 1;
v12[1] = 1;
v12[2] = 0;
v12[3] = 1;
v12[4] = 0;
v12[5] = 0;
v12[6] = 1;
v12[7] = 0;
v12[8] = 0;
v12[9] = 1;
v12[10] = 1;
v12[11] = 0;
v12[12] = 0;
v12[13] = 1;
v12[14] = 0;
v12[15] = 1;
v12[16] = 0;
v12[17] = 0;
v12[18] = 1;
v12[19] = 1;
v12[20] = 0;
v12[21] = 1;
v12[22] = 1;
memset(&v12[23], 0, 16);
v12[27] = 1;
v12[28] = 0;
v12[29] = 1;
v12[30] = 0;
v12[31] = 1;
v12[32] = 0;
v12[33] = 1;
v12[34] = 0;
v12[35] = 0;
v12[36] = 1;
v12[37] = 0;
v12[38] = 1;
memset(&v12[39], 0, 24);
v12[45] = 1;
v12[46] = 0;
v12[47] = 1;
memset(&v12[48], 0, 24);
v12[54] = 1;
v12[55] = 1;
v12[56] = 0;
v12[57] = 1;
v12[58] = 1;
memset(&v12[59], 0, 16);
v12[63] = 1;
v11 = 0;
for ( i = 0; i < 8; ++i )
{
for ( j = 0; j < 8; ++j )
{
a2 = v12[v11];
dword_41C368[8 * i + j] = a2;
++v11;
}
v5 = i + 1;
}
sub_41120D(&savedregs, &dword_411B50, v5, a2);
return v7;
}
回到开头
学习的是liv：https://tkazer.github.io/2025/04/13/TGCTF2025/index.html
a=[5,2,6,5,5,6,6,5,5,2,6,5,5,3,6,5]
for i in a:
print(f"{i:04b}",end='')
所以something应该是0101001001100101010101100110010101010010011001010101001101100101
浙公网安备 33010602011771号