腾讯极客挑战赛第三期——码上种树 WP

/ ctf

1-10000

1
2
3
4
5
6
window.A274075A = async
function ({
    a
}) {
    return new Promise(_ => setTimeout(__ => _(a[0]), 2000))
}

原样push即可

10000 - 100000

1
2
3
4
5
6
window.A3C2EA99 = async
function ({
    a
}) {
    return new Promise(_ => setTimeout(__ => _(a[0] * a[0] + a[0]), 2000))
}

做运算后push

100000 - 250000

1
eval(atob("dmFyIF8weGU5MzY9WydBNTQ3Mzc4OCddOyhmdW5jdGlvbihfMHg0OGU4NWMsXzB4ZTkzNmQ4KXt2YXIgXzB4MjNmYzVhPWZ1bmN0aW9uKF8weDI4NThkOSl7d2hpbGUoLS1fMHgyODU4ZDkpe18weDQ4ZTg1Y1sncHVzaCddKF8weDQ4ZTg1Y1snc2hpZnQnXSgpKTt9fTtfMHgyM2ZjNWEoKytfMHhlOTM2ZDgpO30oXzB4ZTkzNiwweDE5NikpO3ZhciBfMHgyM2ZjPWZ1bmN0aW9uKF8weDQ4ZTg1YyxfMHhlOTM2ZDgpe18weDQ4ZTg1Yz1fMHg0OGU4NWMtMHgwO3ZhciBfMHgyM2ZjNWE9XzB4ZTkzNltfMHg0OGU4NWNdO3JldHVybiBfMHgyM2ZjNWE7fTt3aW5kb3dbXzB4MjNmYygnMHgwJyldPWZ1bmN0aW9uKF8weDMzNTQzNyl7dmFyIF8weDFhYWMwMj0weDMwZDNmO2Zvcih2YXIgXzB4M2JlZDZhPTB4MzBkM2Y7XzB4M2JlZDZhPjB4MDtfMHgzYmVkNmEtLSl7dmFyIF8weDM3NTM0MD0weDA7Zm9yKHZhciBfMHgxZGRiNzc9MHgwO18weDFkZGI3NzxfMHgzYmVkNmE7XzB4MWRkYjc3Kyspe18weDM3NTM0MCs9XzB4MzM1NDM3WydhJ11bMHgwXTt9XzB4Mzc1MzQwJV8weDMzNTQzN1snYSddWzB4Ml09PV8weDMzNTQzN1snYSddWzB4MV0mJl8weDNiZWQ2YTxfMHgxYWFjMDImJihfMHgxYWFjMDI9XzB4M2JlZDZhKTt9cmV0dXJuIF8weDFhYWMwMjt9Ow=="))

base64解码，得

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
var _0xe936 = ['A5473788'];
(function (_0x48e85c, _0xe936d8) {
    var _0x23fc5a = function (_0x2858d9) {
        while (--_0x2858d9) {
            _0x48e85c['push'](_0x48e85c['shift']());
        }
    };
    _0x23fc5a(++_0xe936d8);
}(_0xe936, 0x196));
var _0x23fc = function (_0x48e85c, _0xe936d8) {
    _0x48e85c = _0x48e85c - 0x0;
    var _0x23fc5a = _0xe936[_0x48e85c];
    return _0x23fc5a;
};
window[_0x23fc('0x0')] = function (_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = 0x0;
        for (var _0x1ddb77 = 0x0; _0x1ddb77 < _0x3bed6a; _0x1ddb77++) {
            _0x375340 += _0x335437['a'][0x0];
        }
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }
    return _0x1aac02;
};

更改变量名和函数名：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
var text = ['A5473788'];

(function (func_arg1, func_arg2) {
    var func_2 = function (func_arg) {
        while (--func_arg) {
            func_arg1['push'](func_arg1['shift']());
        }
    };
    func_2(++func_arg2);
}(text, 406));

var func1 = function (func_arg1, _0xe936d8) {
    func_arg1 = func_arg1 - 0;
    var tmp = text[func_arg1];
    return tmp;
};

window[func1('0x0')] = function (func_arg1) {
    var num = 199999;
    for (var i = 199999; i > 0; i--) {
        var tmp = 0;
        for (var j = 0; j < i; j++) {
            tmp += func_arg1['a'][0];
        }
        tmp % func_arg1['a'][2] == func_arg1['a'][1] && i < num && (num = i);
    }
    return num;
};

主要的运算逻辑在最后一块，是求最小的i，a[0]*i % a[2] = a[1]简化一下，写成python ，跑

1
2
3
4
5
6
7
8
9
10
11
12
13
# 100000 - 250000
while(True):
    a = requests.get("http://159.75.70.9:8081/pull?u=00000594E3FF0D82DA2B94E8A44213A4")
    b = json.loads(a.text)
    a = [477, 976, 179600] # [477, 976, 179600]
    t = b["t"]
    print(a,t)
    for i in range(0,199999):
        if((i * a[0])%a[2] == a[1]):
            a = i 
            break
    a = requests.get("http://159.75.70.9:8081/push?t="+t+"&a"+a)
    print(a.text)

250000 - 500000

上来就一大段JSFuck ，看得我眼睛疼

直接丢jsunfuck解，不行，分段解，得

1
2
3
4
5
6
7
8
9
10
11
window.A593C8B8 = async(_) => (($, _, __, ___, ____) => {
    let _____ = function * () {
        while ([]) yield[(_, __) => _ + __, (_, __) => _ - __, (_, __) => _ * __][++__ % (3)].bind(+[], ___, ____)
    }();
    let ______ = function (_____, ______, _______) {
        ____ = _____;
        ___ = ______next().value();
        __ == _["a"].length && _______(-___)
    };
    return new Promise(__ => _["a"].forEach(___ => $setTimeout(____ => ______(___, _____, __), ___)))
})(window, _, 0, 0, 0)

改改变量名

1
2
3
4
5
6
7
8
9
10
11
12
13
14
window.A593C8B8 = a = async(input) => (($,input,times,arg1,funCc)=>{
    let funCb = function*() {
        while ([]){
            yield[(input,times)=>input + times, (input,times)=>input - times, (input,times)=>input * times][++times % 3].bind(0, arg1, funCc)
        }
    }();
    let funCa = function(funCb, funCa, something) {
        funCc = funCb;
        arg1 = funCa.next().value();
        times == input.a.length && something(-arg1)
    };
    return new Promise(times=>input['a'].forEach(arg1=>$.setTimeout(funCc=>funCa(arg1, funCb, times), arg1)))
}
)(window, input, 0, 0, 0)

js的generator，放到控制台跑，看看结果，猜测是算法是

1
result = (((a[0] * -a[1]) +a[2] - a[3]) * a[4] + a[5] -a[6]) * -1

写脚本跑，发现答案错误。

噢，要先排序。。。

1
2
3
4
5
6
7
8
9
while(True):
    a = requests.get("http://159.75.70.9:8081/pull?u=00000594E3FF0D82DA2B94E8A44213A4")
    b = json.loads(a.text)
    a = b["a"]
    a.sort()
    t = b["t"]
    result = (((a[0] * -a[1]) +a[2] - a[3]) * a[4] + a[5] -a[6]) * -1
    a = requests.get("http://159.75.70.9:8081/push?t="+str(t)+"&a="+str(result))
    print(json.loads(a.text)["score"])

500000 - 1000000

这个阶段找不到代码了，以后要养成存代码的习惯= =

总之就是WebAssembly

搜索了资料，直接用wabt反编译，汇编看不大懂，那就再编译成C，丢IDA里看看

找到关键的运算逻辑：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
__int64 __fastcall w2c_Run(unsigned int a1, int a2)
{
  unsigned int v4; // [rsp+20h] [rbp-20h]
  int v5; // [rsp+24h] [rbp-1Ch]
  unsigned int v6; // [rsp+28h] [rbp-18h]
  unsigned int v7; // [rsp+2Ch] [rbp-14h]
  unsigned int v8; // [rsp+30h] [rbp-10h]

  if ( ++wasm_rt_call_stack_depth > 0x1F4u )
    wasm_rt_trap(7LL);
  v5 = a2 - 1;
  if ( a2 != 1 )
  {
    do
    {
      v4 = a1;
      v6 = 0;
      v7 = 10;
      do
      {
        v8 = v4 % 0xA;
        v4 /= 0xAu;
        v6 = Z_MathZ_maxZ_iii(v8, v6);
        v7 = Z_MathZ_minZ_iii(v8, v7);
      }
      while ( v4 );
      a1 += v7 * v6;
      --v5;
    }
    while ( v5 );
  }
  --wasm_rt_call_stack_depth;
  return a1;
}

没多分析，直接改成Python代码，跑起来：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
while(True):	
    a = requests.get("http://159.75.70.9:8081/pull?u=00000594E3FF0D82DA2B94E8A44213A4")
    b = json.loads(a.text)
    arg = b["a"]
    t = b["t"]
    a1 = arg[0]
    a2 = arg[1]
    v5 = 1000
    if ( a2 != 1 ):
        first_times = 0
        while(True):
            if (first_times == 0 or v5):
                first_times = first_times + 1 
                v4 = a1
                v6 = 0
                v7 = 10
                second_times = 0
                while(True):
                    if(second_times == 0 or v4):
                        second_times = second_times + 1
                        v8 = v4 % 10
                        v4 = int(v4 / 10)
                        v6 = max(v8, v6)
                        v7 = min(v8, v7)
                    else:
                        break
                a1 += v7 * v6
                v5 = v5 - 1
            else:
                break
    a = requests.get("http://159.75.70.9:8081/push?t="+str(t)+"&a="+str(a1))
    print(a.text)

1000000 - 2000000

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
var __TENCENT_CHAOS_STACK = function () {
    function __TENCENT_CHAOS_VM(f, e, c, r, l, g, s, a) {
        var n = !r;
        f = +f, e = e || [0], r = r || [
            [this],
            [{}]
        ], l = l || {};
        var t = [],
            o = null,
            u = [
                function () {
                    r[r.length - 2] = r[r.length - 2] | r.pop()
                }, , ,
                function () {
                    for (var o = e[f++], u = [], n = e[f++], t = e[f++], p = [], h = 0; h < n; h++) u[e[f++]] = r[e[f++]];
                    for (h = 0; h < t; h++) p[h] = e[f++];
                    r.push(function i() {
                        var n = u.slice(0);
                        n[0] = [this], n[1] = [arguments], n[2] = [i];
                        for (var t = 0; t < p.length && t < arguments.length; t++) 0 < p[t] && (n[p[t]] = [arguments[t]]);
                        return __TENCENT_CHAOS_VM(o, e, c, n, l, g, s, a)
                    })
                }, ,
                function () {
                    r.push(undefined)
                }, ,
                function () {
                    return !0
                },
                function () {
                    var n = r[r.length - 2];
                    n[0][n[1]] = r[r.length - 1]
                },
                function () {
                    r.push(!r.pop())
                }, , ,
                function () {
                    r.push([e[f++]])
                },
                function () {
                    r[r.length - 1] = e[f++]
                }, ,
                function () {
                    r[r.length - 2] = r[r.length - 2] % r.pop()
                },
                function () {
                    r.push("")
                },
                function () {
                    f = e[f++]
                }, , , , , , ,
                function () {
                    var n = r.pop();
                    r.push([r[r.pop()][0], n])
                },
                function () {
                    var n = e[f++];
                    r[n] = r[n] === undefined ? [] : r[n]
                }, , , , , ,
                function () {
                    var n = e[f++],
                        t = r[r.length - 2 - n];
                    r[r.length - 2 - n] = r.pop(), r.push(t)
                },
                function () {
                    var n = e[f++];
                    r[r.length - 1] && (f = n)
                },
                function () {
                    r.length = e[f++]
                },
                function () {
                    r[r.length - 2] = r[r.length - 2] >= r.pop()
                }, , ,
                function () {
                    r.pop()
                }, , , ,
                function () {
                    r[r[r.length - 2][0]][0] = r[r.length - 1]
                }, , ,
                function () {
                    r[r.length - 2] = r[r.length - 2] * r.pop()
                },
                function () {
                    r.push([c, r.pop()])
                }, , ,
                function () {
                    r.push(r[r.pop()[0]][0])
                }, , , ,
                function () {
                    var n = e[f++],
                        t = n ? r.slice(-n) : [];
                    r.length -= n;
                    var o = r.pop();
                    r.push(o[0][o[1]].apply(o[0], t))
                },
                function () {
                    r.push(r[e[f++]][0])
                }, ,
                function () {
                    r.push(e[f++])
                }, ,
                function () {
                    var n = r.pop();
                    r.push(n[0][n[1]])
                },
                function () {
                    r.push(r[r.length - 1])
                }, , , , ,
                function () {
                    r.length -= e[f++]
                }, ,
                function () {
                    var n = r.pop(),
                        t = r.pop();
                    r.push([t[0][t[1]], n])
                },
                function () {
                    r[r.length - 2] = r[r.length - 2] + r.pop()
                }, ,
                function () {
                    r[r.length - 1] += String.fromCharCode(e[f++])
                }
            ];
        for (0;;) try {
            for (var p = !1; !p;) p = u[e[f++]]();
            if (0, o) throw o;
            return n ? (r.pop(), r.slice(3 + __TENCENT_CHAOS_VM.v)) : r.pop()
        } catch (i) {
            0;
            var h = t.pop();
            if (h === undefined) throw i;
            o = i, f = h[0], r.length = h[1], h[2] && (r[h[2]][0] = o)
        }
    }
    __TENCENT_CHAOS_VM.v = 0;
    return __TENCENT_CHAOS_VM(0, [33, 3, 25, 2, 16, 68, 119, 68, 105, 68, 110, 68, 100, 68, 111, 68, 119, 45, 16, 68, 67, 68, 65, 68, 49, 68, 56, 68, 48, 68, 55, 68, 69, 68, 66, 65, 17, 2426, 33, 7, 25, 2, 25, 3, 25, 4, 25, 5, 25, 6, 12, 4, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 55, 0, 52, 1, 41, 12, 5, 55, 0, 41, 31, 0, 12, 6, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 55, 1, 52, 1, 41, 31, 0, 63, 6, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 0, 65, 57, 34, 9, 32, 123, 37, 17, 243, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 54, 68, 54, 68, 49, 68, 53, 68, 57, 68, 52, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 103, 12, 5, 55, 0, 41, 31, 0, 37, 37, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 1, 65, 57, 34, 9, 32, 272, 37, 17, 392, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 50, 68, 52, 68, 55, 68, 55, 68, 54, 68, 50, 68, 55, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 252, 12, 4, 58, 48, 53, 6, 66, 41, 31, 0, 12, 4, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 55, 0, 41, 31, 0, 12, 6, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 55, 1, 52, 1, 41, 31, 0, 63, 8, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 2, 65, 57, 34, 9, 32, 511, 37, 17, 631, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 54, 68, 56, 68, 55, 68, 56, 68, 55, 68, 57, 68, 52, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 491, 12, 5, 55, 0, 41, 31, 0, 37, 37, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 3, 65, 57, 34, 9, 32, 660, 37, 17, 780, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 55, 68, 53, 68, 52, 68, 54, 68, 51, 68, 54, 68, 52, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 640, 12, 4, 58, 48, 53, 6, 66, 41, 31, 0, 12, 4, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 55, 0, 41, 31, 0, 12, 6, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 55, 1, 52, 1, 41, 31, 0, 63, 8, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 4, 65, 57, 34, 9, 32, 899, 37, 17, 1019, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 50, 68, 57, 68, 57, 68, 49, 68, 57, 68, 49, 68, 57, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 879, 12, 5, 55, 0, 41, 31, 0, 37, 37, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 5, 65, 57, 34, 9, 32, 1048, 37, 17, 1168, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 50, 68, 49, 68, 56, 68, 50, 68, 54, 68, 52, 68, 51, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 1028, 12, 4, 58, 48, 53, 6, 66, 41, 31, 0, 12, 4, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 55, 0, 41, 31, 0, 12, 6, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 55, 1, 52, 1, 41, 31, 0, 63, 8, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 6, 65, 57, 34, 9, 32, 1287, 37, 17, 1407, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 55, 68, 57, 68, 51, 68, 48, 68, 48, 68, 57, 68, 52, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 1267, 12, 5, 55, 0, 41, 31, 0, 37, 37, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 7, 65, 57, 34, 9, 32, 1436, 37, 17, 1556, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 52, 68, 52, 68, 52, 68, 56, 68, 54, 68, 49, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 1416, 12, 4, 58, 48, 53, 6, 66, 41, 31, 0, 12, 4, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 55, 0, 41, 31, 0, 12, 6, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 55, 1, 52, 1, 41, 31, 0, 63, 8, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 8, 65, 57, 34, 9, 32, 1675, 37, 17, 1795, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 53, 68, 53, 68, 57, 68, 54, 68, 48, 68, 50, 68, 52, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 1655, 12, 5, 55, 0, 41, 31, 0, 37, 37, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 9, 65, 57, 34, 9, 32, 1824, 37, 17, 1944, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 54, 68, 50, 68, 52, 68, 54, 68, 56, 68, 55, 68, 51, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 1804, 12, 4, 58, 48, 53, 6, 66, 41, 31, 0, 12, 4, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 55, 0, 41, 31, 0, 12, 6, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 55, 1, 52, 1, 41, 31, 0, 63, 8, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 10, 65, 57, 34, 9, 32, 2063, 37, 17, 2183, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 56, 68, 55, 68, 50, 68, 54, 68, 57, 68, 48, 68, 57, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 2043, 12, 5, 55, 0, 41, 31, 0, 37, 37, 12, 5, 48, 12, 3, 16, 68, 97, 24, 55, 11, 65, 57, 34, 9, 32, 2212, 37, 17, 2332, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 53, 68, 56, 68, 49, 68, 49, 68, 55, 68, 55, 68, 51, 52, 1, 44, 41, 31, 0, 12, 6, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 12, 5, 58, 48, 58, 31, 1, 31, 0, 55, 1, 66, 41, 37, 13, 0, 31, 0, 0, 63, 5, 37, 17, 2192, 12, 4, 58, 48, 53, 6, 66, 41, 31, 0, 12, 4, 58, 48, 16, 68, 66, 68, 105, 68, 103, 68, 73, 68, 110, 68, 116, 45, 16, 68, 49, 68, 49, 68, 50, 68, 53, 68, 56, 68, 57, 68, 57, 68, 57, 68, 48, 68, 54, 68, 56, 68, 52, 68, 50, 68, 53, 68, 57, 68, 55, 52, 1, 15, 41, 31, 0, 16, 68, 112, 68, 97, 68, 114, 68, 115, 68, 101, 68, 73, 68, 110, 68, 116, 45, 53, 4, 52, 1, 7, 5, 7, 63, 4, 3, 38, 0, 1, 3, 8, 31, 0, 5, 7, 37, 37], window)
}();
__TENCENT_CHAOS_STACK.g = function () {
    return __TENCENT_CHAOS_STACK.shift()[0]
};

看到这代码愣了一会儿。。。

用javascript写的栈型虚拟机= =

我是没想到还能这么写

只能操作上打log，把数字改小了看看什么效果

发现是bytecode中存着12个数字，对应着每个输入的参数，然后还有一个大数，应该是避免溢出的模数。

数字是底数，输入的参数是指数

具体的算法不写出来了，看python：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
import requests
import json,time
import math

def power(a, b):
    c = 1125899906842597
    res = 1
    a = a % c
    while (b):
        if (b & 1):
            res = (res * a) % c
        a = (a * a) % c
        b >>= 1
    return res

while(True):
    a = requests.get("http://159.75.70.9:8081/pull?u=00000594E3FF0D82DA2B94E8A44213A4")
    info = json.loads(a.text)
    a = []
    mod = 1125899906842597
    num = [3189791,9142623,8280866,8923375,3923204,6018905,7820930,3693364,4293459,7422123,8287107,1645950]
    group = info["a"]
    for i in range(len(group)):
        if(i % 2 == 0 and i != 12):
            a.append(power(num[i],group[i]))
            a[int(i/2)] = a[int(i/2)] * power(num[i+1],group[i+1])
    result = 0
    for i in a:
        result = (result + i) % mod
    print(result)
    a = requests.get("http://159.75.70.9:8081/push?t="+str(info["t"])+"&a="+str(result))
    print(a.text)

然而有几率会报错，应该是找数字时，解析出错了，还是要手动找出数字来解析= =

2000000 + 1

一开始看到的时候，觉得不是跟上一题一样嘛，ez

事实上是我太天真，

居然能套三层…

整整五天比赛时间，花了一半在这上面，比赛结束还没能解出来。。。

等wp吧。。。