HolaCTF Full Reverse Engineering + Programming + Stego Write-up

# :rocket: B1thon > Author: [Cao Tất Thành](https://github.com/TwentySick) > [+] [Source](https://drive.google.com/drive/folders/114D4RhcQJzTFxJQZjYqm3gMcAvemDgEC?usp=sharing) Excutable file is built from Python, so we need [pyinstxtractor](https://github.com/extremecoders-re/pyinstxtractor) to convert excutable into [pyc] file (https://www.tutorialspoint.com/What-are-pyc-files-in-Python) and [uncompyle6](https://pypi.org/project/uncompyle6/) to decompile pyc into python source code like following: ```python= def banner(): print('') print('██████╗ ██╗████████╗██╗ ██╗ ██████╗ ███╗ ██╗') print('██╔══██╗███║╚══██╔══╝██║ ██║██╔═████╗████╗ ██║') print('██████╔╝╚██║ ██║ ███████║██║██╔██║██╔██╗ ██║') print('██╔══██╗ ██║ ██║ ██╔══██║████╔╝██║██║╚██╗██║') print('██████╔╝ ██║ ██║ ██║ ██║╚██████╔╝██║ ╚████║') print('╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═══╝') print('███████████████████████████████████████████████╗') print('╚══════════════════════════════════════════════╝') print('') def encrypt_1(inp): return ((inp >> 7 & 1 | (inp >> 6 & 1) << 1) << 6 | (inp >> 5 & 1 | (inp >> 4 & 1) << 1) << 4 | (inp >> 3 & 1 | (inp >> 2 & 1) << 1) << 2 | (inp >> 1 & 1 | (inp & 1) << 1)) >> 4 | ((inp >> 7 & 1 | (inp >> 6 & 1) << 1) << 6 | (inp >> 5 & 1 | (inp >> 4 & 1) << 1) << 4 | (inp >> 3 & 1 | (inp >> 2 & 1) << 1) << 2 | (inp >> 1 & 1 | (inp & 1) << 1)) << 4 & 255 def encrypt_2(inp): return encrypt_1(encrypt_1(encrypt_1(inp) >> 7 | encrypt_1(inp) << 1 & 255) >> 7 | encrypt_1(encrypt_1(inp) >> 7 | encrypt_1(inp) << 1 & 255) << 1 & 255) def check(inp): if len(inp) != 26: return False data = [178, 212, 186, 246, 50, 238, 233, 164, 58, 238, 233, 190, 50, 205, 216, 30, 202, 212, 233, 158, 210, 20, 202, 172, 56, 52] dark = [] for i in range(0, len(inp), 2): dark.append(((encrypt_2(ord(inp[i])) << 8 | encrypt_2(ord(inp[i + 1]))) ^ 4919) >> 8) dark.append(((encrypt_2(ord(inp[i])) << 8 | encrypt_2(ord(inp[i + 1]))) ^ 4919) & 255) for i in range(len(inp)): if dark[i] != data[i]: return False return True def main(): banner() inp = str(input('Enter the flag: ')) if check(inp): print('\n!!! Congratulation !!!\n') else: print('\n!!! Try harder !!!\n') if __name__ == '__main__': main() ``` The flow of encrypt_2 is encrypt_1 -> rotate left 1 bit -> encrypt_1 -> rotate left 1 bit -> encrypt_1. Don't try to understand what encrypt_1 does, because if this function runs even times, the data will return to the original. Next, look at the check function, it encrypts each 2 characters and appends it to the dark list. So I wrote a short script to solve this challenge ``` def decrypt(inp): return ((inp >> 7 & 1 | (inp >> 6 & 1) << 1) << 6 | (inp >> 5 & 1 | (inp >> 4 & 1) << 1) << 4 | (inp >> 3 & 1 | (inp >> 2 & 1) << 1) << 2 | (inp >> 1 & 1 | (inp & 1) << 1)) >> 4 | ((inp >> 7 & 1 | (inp >> 6 & 1) << 1) << 6 | (inp >> 5 & 1 | (inp >> 4 & 1) << 1) << 4 | (inp >> 3 & 1 | (inp >> 2 & 1) << 1) << 2 | (inp >> 1 & 1 | (inp & 1) << 1)) << 4 & 255 def main(): data = [178, 212, 186, 246, 50, 238, 233, 164, 58, 238, 233, 190, 50, 205, 216, 30, 202, 212, 233, 158, 210, 20, 202, 172, 56, 52] # XOR dark = [] for i in range(0,26,2): temp = (data[i] << 8 | data[i+1]) ^ 4919 dark.append(temp >> 8) dark.append(temp & 255) # Decrypt dark magic for i in range(26): dark[i] = decrypt(dark[i]) dark[i] = (dark[i] >> 1) | ((dark[i] << 7) & 0b10000000) dark[i] = decrypt(dark[i]) dark[i] = (dark[i] >> 1) | ((dark[i] << 7) & 0b10000000) dark[i] = decrypt(dark[i]) for i in dark: print(chr(i), end = "") print() if __name__ == '__main__': main() ``` The output is **pyth0n_c4n_d0_m4ny_th1ng5!** -> the flag: **EHC{pyth0n_c4n_d0_m4ny_th1ng5!}** # :rocket: Letgo > Author: [Cao Tất Thành](https://github.com/TwentySick) > [+] [Source](https://drive.google.com/drive/folders/1mXoEkij6534XDrcZaJMbUPcXmyUQXF0F?usp=sharing) Look at the **main_main** function, see that **main_check** function was called here. ``` ... .text:000000000048F112 mov rax, [rcx] .text:000000000048F115 mov rbx, [rcx+8] .text:000000000048F119 call main_check .text:000000000048F11E xchg ax, ax .text:000000000048F120 test al, al ... ``` Look through the **main_check** function, we can see some things interesting here ``` ... v14 = v10 + 1; v15 = *(unsigned __int8 *)(v7 + v9); v16 = (unsigned __int8)(16 * v15); v17 = v15 >> 4; v18 = *((_QWORD *)&v33 + v9) ^ (v17 | v16); ... ``` It just rotates 4 bits and then XOR with key. We know the length of the input is 27 and we have 2 arrays having 27 elements each array. ``` ... *(_QWORD *)&v33 = 102LL; *((_QWORD *)&v33 + 1) = 246LL; v34 = 87LL; v35 = 230LL; v36 = 70LL; v37 = 86LL; v38 = 39LL; v39 = 245LL; v40 = 246LL; v41 = 102LL; v42 = 245LL; v43 = 118LL; v44 = 246LL; v45 = 198LL; v46 = 22LL; v47 = 230LL; v48 = 118LL; v49 = 245LL; v50 = 150LL; v51 = 55LL; v52 = 245LL; v53 = 118LL; v54 = 246LL; v55 = 246LL; v56 = 118LL; v57 = 198LL; v58 = 86LL; ... *(_QWORD *)&v28 = 117LL; *((_QWORD *)&v28 + 1) = 193LL; v29 = 162LL; v30 = 144LL; v31 = 69LL; v32[0] = 163LL; v32[1] = 225LL; v32[2] = 182LL; v32[3] = 16LL; v32[4] = 16LL; v32[5] = 0LL; v32[6] = 69LL; v32[7] = 181LL; v32[8] = 241LL; v32[9] = 129LL; v32[10] = 19LL; v32[11] = 49LL; v32[12] = 246LL; v32[13] = 99LL; v32[14] = 16LL; v32[15] = 198LL; v32[16] = 17LL; v32[17] = 197LL; v32[18] = 209LL; v32[19] = 69LL; v32[20] = 53LL; v32[21] = 165LL; ... ``` So, I wrote a short script to solve this challenge: ``` data1 = [102, 246, 87, 230, 70, 86, 39, 245, 246, 102, 245, 118, 246, 198, 22, 230, 118, 245, 150, 55, 245, 118, 246, 246, 118, 198, 86] data2 = [117, 193, 162, 144, 69, 163, 225, 182, 16, 16, 0, 69, 181, 241, 129, 19, 49, 246, 99, 16, 198, 17, 197, 209, 69, 53, 165] for i in range(27): temp = (data1[i] ^ data2[i]) temp = (temp >> 4) | ((temp << 4) & 0xff) print(chr(temp), end = "") print() ``` The flag: **EHC{1s_g0_l4ng_34sy_t0_r3v3r3??}** # :rocket: Zi Zay 3 > Author: [Cao Tất Thành](https://github.com/TwentySick) > [+] [Source](https://drive.google.com/drive/folders/13zUkQxRJFWwq4HMdLMdN3eO5zENgCf9W?usp=sharing) First of all, look at the main function, we know that we need to enter the flag, this flag will send to a check function and get the output if it is correct. Then just look through the check function, there are too many conditions. And all of those are not possible to solve handly. So we just need a tool to do this for us. [z3](https://pypi.org/project/z3/) is fine to do that. I wrote a short script to solve by z3. ``` import z3 flag = [z3.Int(f'flag_{i}') for i in range(18)] solver = z3.Solver() solver.add(flag[0x03] - flag[0x11] + flag[0x08] - flag[0x0c] - flag[0x09] + flag[0x0f] - flag[0x06] - flag[0x00] - flag[0x02] + flag[0x05] == -396) solver.add(flag[0x02] - flag[0x07] - flag[0x00] - flag[0x0f] - flag[0x0a] - flag[0x0e] - flag[0x03] + flag[0x06] + flag[0x04] + flag[0x0d] == -67) solver.add(flag[0x02] - flag[0x0b] + flag[0x10] - flag[0x03] + flag[0x11] - flag[0x05] - flag[0x04] + flag[0x00] - flag[0x0a] + flag[0x01] == 82) solver.add(flag[0x0e] + flag[0x0d] + flag[0x04] - flag[0x09] + flag[0x05] - flag[0x0c] - flag[0x11] - flag[0x0f] - flag[0x10] - flag[0x08] == -122) solver.add(flag[0x0b] + flag[0x0d] - flag[0x04] + flag[0x11] + flag[0x06] - flag[0x05] + flag[0x0c] + flag[0x03] - flag[0x09] + flag[0x0e] == 318) solver.add(flag[0x11] + flag[0x03] + flag[0x00] + flag[0x0f] + flag[0x06] + flag[0x0c] + flag[0x05] + flag[0x04] - flag[0x0a] - flag[0x0e] == 552) solver.add(flag[0x06] + flag[0x11] + flag[0x04] + flag[0x0d] + flag[0x09] - flag[0x0b] + flag[0x0c] - flag[0x08] + flag[0x0a] - flag[0x01] == 577) solver.add(flag[0x03] - flag[0x0f] + flag[0x00] - flag[0x0d] - flag[0x05] - flag[0x0b] - flag[0x01] + flag[0x0a] + flag[0x06] + flag[0x02] == 119) solver.add(flag[0x05] - flag[0x08] + flag[0x06] - flag[0x01] - flag[0x07] + flag[0x09] + flag[0x00] + flag[0x02] - flag[0x0c] - flag[0x0d] == 157) solver.add(flag[0x00] - flag[0x11] - flag[0x0b] + flag[0x05] + flag[0x0f] - flag[0x03] + flag[0x02] + flag[0x06] + flag[0x0d] - flag[0x08] == 309) solver.add(flag[0x00] - flag[0x08] - flag[0x0a] - flag[0x0f] - flag[0x10] + flag[0x02] - flag[0x0c] - flag[0x07] + flag[0x01] - flag[0x05] == -302) solver.add(flag[0x0f] + flag[0x0c] + flag[0x05] - flag[0x07] - flag[0x04] - flag[0x00] - flag[0x0b] + flag[0x11] - flag[0x03] + flag[0x09] == 81) solver.add(flag[0x0c] - flag[0x09] - flag[0x02] - flag[0x0a] - flag[0x0f] - flag[0x01] + flag[0x0e] + flag[0x0b] - flag[0x11] + flag[0x07] == -172) solver.add(flag[0x0b] - flag[0x0a] - flag[0x05] + flag[0x0d] - flag[0x04] - flag[0x08] + flag[0x00] + flag[0x11] + flag[0x09] + flag[0x0c] == 236) solver.add(flag[0x02] - flag[0x00] - flag[0x10] + flag[0x11] - flag[0x05] - flag[0x0a] - flag[0x0e] - flag[0x01] + flag[0x03] + flag[0x0c] == -224) solver.add(flag[0x0a] - flag[0x06] - flag[0x02] + flag[0x05] + flag[0x0d] - flag[0x08] + flag[0x04] - flag[0x07] + flag[0x0c] - flag[0x09] == 122) solver.add(flag[0x04] + flag[0x10] - flag[0x01] + flag[0x0f] - flag[0x02] - flag[0x05] - flag[0x0c] + flag[0x0d] + flag[0x0b] + flag[0x03] == 122) solver.add(flag[0x09] - flag[0x08] + flag[0x0a] + flag[0x0c] - flag[0x01] - flag[0x06] - flag[0x03] + flag[0x0f] + flag[0x0e] + flag[0x04] == 336) solver.add(flag[0x0a] + flag[0x09] + flag[0x0c] - flag[0x0f] - flag[0x02] - flag[0x08] + flag[0x0e] - flag[0x04] - flag[0x0d] - flag[0x0b] == -37) solver.add(flag[0x07] - flag[0x09] + flag[0x00] + flag[0x08] + flag[0x11] - flag[0x01] + flag[0x0e] + flag[0x0a] + flag[0x02] - flag[0x04] == 355) solver.add(flag[0x00] + flag[0x10] - flag[0x03] + flag[0x0e] + flag[0x08] + flag[0x0f] - flag[0x0b] + flag[0x01] + flag[0x11] + flag[0x0d] == 596) solver.add(flag[0x0d] - flag[0x00] - flag[0x02] + flag[0x09] + flag[0x0c] + flag[0x0b] - flag[0x07] - flag[0x0e] + flag[0x03] - flag[0x10] == -78) print(solver.check()) m = solver.model() out = [chr(m.evaluate(flag[i]).as_long()) for i in range(18)] print("".join(out)) ``` When ran this script, the output is **z3_1s_g00d_4t_m4th**. So, the flag is **EHC{z3_1s_g00d_4t_m4th}** (you should check the result with this execute file before submitting the flag). # :rocket: Is it a gift for you? > Author: [Cao Tất Thành](https://github.com/TwentySick) > [+] [Source](https://drive.google.com/drive/folders/15mxO_1OBRBdmChWSLXV8LLk6pxxMDWU5?usp=sharing) Đầu tiên, khi check **main** function, mình dễ thấy được đoạn input sẽ được chuyền vào 1 function và tại function này, có diễn ra việc check gì đó: ```cpp LOBYTE(v1) = sub_472A40(a1) != 36; if ( !(_BYTE)v1 ) { v27 = 0; memset(v12, 0, 0x90uLL); memset(v11, 0, sizeof(v11)); memset(v10, 0, sizeof(v10)); memset(v9, 0, sizeof(v9)); sub_4BA0D0(1337LL); for ( i = 0; i <= 5; ++i ) { for ( j = 0; j <= 5; ++j ) v11[6 * i + j] = (int)sub_4BA0C0() % 2; } for ( k = 0; k <= 5; ++k ) { for ( m = 0; m <= 5; ++m ) { v2 = v27++; v3 = (char *)sub_472D50(a1, v2); v12[6 * k + m] = *v3; } } for ( n = 0; n <= 5; ++n ) { for ( ii = 0; ii <= 5; ++ii ) { for ( jj = 0; jj <= 31; ++jj ) { v4 = v12[6 * ii + n]; v5 = sub_4BA0C0(); v12[6 * ii + n] = ((unsigned __int8)(((unsigned int)(v5 >> 31) >> 24) + v5) - ((unsigned int)(v5 >> 31) >> 24)) ^ v4; sub_404366((unsigned int)v12[6 * ii + n], 1LL); } } } for ( kk = 0; kk <= 5; ++kk ) { for ( mm = 0; mm <= 5; ++mm ) { for ( nn = 0; nn <= 5; ++nn ) v10[6 * kk + mm] += v12[6 * kk + nn] * v11[6 * nn + mm]; } } v16 = 0; for ( i1 = 0; i1 <= 5; ++i1 ) { for ( i2 = 0; i2 <= 5; ++i2 ) { v6 = v10[6 * i1 + i2]; v7 = v16++; v9[v7] = v6; } } for ( i3 = 0; ; ++i3 ) { if ( i3 > 35 ) { sub_404225(); sub_4B93F0(0LL); } v1 = dword_5AD140[i3]; if ( v9[i3] != v1 ) break; } } return v1; } ``` Đọc kỹ description của challenge, chúng ta thấy được file thực thi này được tạo bởi C++ và có nhắc đến hàm random. Nhìn qua 1 đoạn sẽ thấy được có function có tham số truyền vào là 1337, rất có thể đây sẽ là hàm random vì trong description có nhắc đến hàm random cố định seed (`sub_4BA0D0(1337LL);`). Tiếp theo, function sẽ có 36 lần lặp và tạo 1 matrix 6x6. Sau 36 lần này này, tham số truyền vào sẽ được chia đều và đưa vào 1 matrix 6x6. Sau khi đưa vào matrix này, sẽ đến việc thực hiện encrypt lần 1 theo từng cột một, với thứ tự từ trên xuống với các cột. Sau encrypt lần 1, sẽ encrypt lần nữa bằng cách nhân chúng với matrix được tạo ra ban đầu. Để giải challenge, mình sẽ cần nhân matrix sau encrypt lần 2 với matrix nghịch đảo của matrix ban đầu được tạo ra và làm ngược lại với hàm encrypt 1. Mình đã viết 1 đoạn code bằng C++ để giải challenge này ```cpp #include <iostream> #include <string> using namespace std; #define INT_BITS 32 int CORRECT[] = {0x205,0x0DF,0x165,0x202,0x296,0x1D4,0x23A,0x0D2,0x165,0x214,0x308,0x23D,0x1DA,0x4C,0x0FA,0x137,0x2C4,0x31D,0x197,0x0FC,0x130,0x236,0x2B8,0x27A,0x252,0x0E0,0x187,0x25E,0x2FA,0x285,0x139,0x9A,0x11D,0x120,0x1C2,0x21F}; int rotateRight(int n, unsigned int d){ return (n >> d) | (n << (INT_BITS - d)); } int main(){ int matrix[6][6]; srand(1337); // Do 36 first random for(int i = 0; i < 6; i++){ for(int j = 0; j < 6; j++){ matrix[i][j] = rand() % 2; } } // Just find the inverse of matrix, but I'm too lazy to write code so I find it and paste that shit to here int inv[6][6] = { {-1,1,0,0,-2,1}, {-1,0,1,1,-2,1}, {1,-1,0,0,1,0}, {1,0,0,0,1,-1}, {0,0,0,-1,1,0}, {0,0,0,1,0,0} }; int matrix2[6][6] = {}; // Split CORRECT array into a matrix int flag_matrix[6][6] = {}; int temp = 0; for(int i = 0; i < 6; i++){ for(int j = 0; j < 6; j++){ flag_matrix[i][j] = CORRECT[temp++]; } } // Multi flag_matrix with inverse matrix for(int i = 0; i < 6; i++){ for(int j = 0; j < 6; j++){ for(int k = 0; k < 6; k++){ matrix2[i][j] += flag_matrix[i][k] * inv[k][j]; } } } // Do decrypt 1 for(int i = 0; i < 6; i++){ for(int j = 0; j < 6; j++){ for(int k = 0; k < 32; k++){ rotateRight(matrix[j][i],1); matrix2[j][i] = matrix2[j][i] ^ (rand()%256); } } } for(int i = 0; i < 6; i++){ for(int j = 0; j < 6; j++){ cout << (char)matrix2[i][j]; } } return 0; } ``` Flag: **EHC{y0u_c4n_s0lv3_1t_w1th0ut_d3bug!}** # :rocket: Can you see me? > Author: [Cao Tất Thành](https://github.com/TwentySick) > [+] [Source](https://battle.cookiearena.org/challenges/stenography/can-you-see-me) *It's a very very challenge* First of all, I used binwalk to check this file to see what file was embedded with this file, but I see nothing. It's same when I used some tool like zsteg, stegoveritas, stegsolve,... But when using exiftool, I can see a comment here (or zsteg btw) ```bash └─$ exiftool s3cr3t.png ExifTool Version Number : 12.57 File Name : s3cr3t.png Directory : . File Size : 243 kB File Modification Date/Time : 2023:06:22 13:17:26-04:00 File Access Date/Time : 2023:06:30 07:04:45-04:00 File Inode Change Date/Time : 2023:07:05 21:12:17-04:00 File Permissions : -rw-rw-r-- File Type : PNG File Type Extension : png MIME Type : image/png Image Width : 838 Image Height : 626 Bit Depth : 8 Color Type : RGB Compression : Deflate/Inflate Filter : Adaptive Interlace : Noninterlaced SRGB Rendering : Perceptual Gamma : 2.2 Pixels Per Unit X : 3779 Pixels Per Unit Y : 3779 Pixel Units : meters Comment : y0u_c4n_n0t_cr4ck_th1s_f1l3_w1th_th3_d3f4ut_w0rdl1st_0n_k4l1 Warning : Corrupted PNG image Image Size : 838x626 Megapixels : 0.525 ``` And then, I used some hex editor to check this file. It was a file embedded on the last. ``` └─$ xxd file.data 00000000: 0089 0050 004e 0047 000d 000a 001a 000a ...P.N.G........ 00000010: 0000 0000 0000 000d 0049 0048 0044 0052 .........I.H.D.R 00000020: 0000 0000 0000 00fa 0000 0000 0000 00fa ................ 00000030: 0008 0002 0000 0000 0000 0007 008e 00cd ................ 00000040: 006a 0000 0000 000d 00c3 0049 0044 0041 .j.........I.D.A 00000050: 0054 0078 009c 00ed 00dd 004f 00a8 00ae .T.x.......O.... 00000060: 0055 0015 00c7 00f1 00af 0047 00f3 006f .U.........G...o 00000070: 0054 0084 008a 0098 0088 0023 009d 0035 .T.........#...5 00000080: 0012 00a9 0091 0014 0006 0041 0016 0037 ...........A...7 00000090: 00a8 0028 006a 0090 0029 0035 00c8 0082 ...(.j...).5.... 000000a0: 0024 004d 0010 004b 0003 009d 004a 00d0 .$.M...K.....J.. 000000b0: 00a4 00e8 000f 0084 000d 009a 0039 000a .............9.. 000000c0: 0042 0048 00a2 00a0 0046 0041 00d1 0020 .B.H.....F.A... 000000d0: 0025 00c4 0020 00e9 005e 002a 00ec 009f .%... ...^.*.... 000000e0: 0050 00a0 00fc 001a 002c 000f 0067 0079 .P.......,...g.y 000000f0: 00f7 0079 009e 009e 007b 00df 00f7 005c ...y.....{.....\ 00000100: 009f 0067 00ad 00df 00cb 0082 00f7 007d ...g...........} 00000110: 009f 003f 00fb 00d9 0067 00ef 0075 003f ...?.....g...u.? 00000120: 00ac 007d 00d8 00f7 005e 0024 00a4 0053 ...}.....^.$...S 00000130: 0012 00d2 0007 0024 00a4 008b 0025 00a4 .......$.....%.. 00000140: 004b 0024 00a4 002b 0025 000e 00e3 008a .K.$...+.%...... 00000150: 00f4 0039 00c7 009b 0025 00a4 00af 004a ...9.....%.....J 00000160: 0048 00bf 0094 0090 003e 0026 0021 003d .H.......>.&.!.= 00000170: 0023 0021 00fd 0057 0042 00ba 0045 0042 .#.!...W.B...E.B 00000180: 007a 005a 0042 00ba 0069 00a2 009d 00ab .z.Z.B...i...... 00000190: 0027 008e 005f 009e 003e 00df 0090 003e .'..._...>.....> 000001a0: 007f 0056 0042 00ba 0057 0042 00ba 004b ...V.B...W.B...K 000001b0: 0042 00fa 009c 0084 00f4 004e 0009 00e9 .B.........N.... 000001c0: 00cb 0012 00d2 0083 00e9 00f3 0047 0025 .............G.% 000001d0: 00a4 008f 000c 003f 004b 00fc 00bc 001f .......?.K...... 000001e0: 0097 0090 00ee 0090 0090 001e 0091 0090 ................ 000001f0: 00ee 0091 0090 001e 009f 0038 007e 007f ...........8.~.. 00000200: 006a 00ff 00aa 00d4 00da 0045 0069 00f4 .j.........E.i.. 00000210: 004e 00a7 00f6 0073 00cc 009f 007d 004e .N.....s.....}.N 00000220: 0042 00ba 004f 0042 00ba 0046 0042 007a .B...O.B...F.B.z 00000230: 0040 0042 00ba 0055 0042 00fa 009e 0084 .@.B...U.B...... 00000240: 00f4 000f 0009 00e9 0061 0009 00e9 00fd .........a...... 00000250: 0012 00d2 00f3 0012 00d2 007b 0025 00a4 ...........{.%.. 00000260: 00eb 0025 00a4 007f 0049 0048 0077 004b ...%.....I.H.w.K 00000270: 0048 009f 0094 0090 007e 0025 0021 00dd .H.......~.%.!.. 00000280: 009e 007a 00fe 0013 0009 00e9 007d 0012 ...z.........}.. 00000290: 00d2 0087 0025 00a4 002f 004a 0048 000f .....%.../.J.H.. 000002a0: 0049 0048 002f 0049 0048 003f 0094 0090 .I.H./.I.H.?.... 000002b0: 005e 0096 0090 009e 0095 0090 00fe 0022 .^............." 000002c0: 0021 003d 0026 0021 00fd 004e 0042 007a .!.=.&.!...N.B.z 000002d0: 0054 0042 00ba 0076 00c8 00a5 00cb 00d2 .T.B...v........ 000002e0: 000c 00ee 002b 001f 0072 00fb 0031 00da .....+...r...1.. 000002f0: 0007 0012 00d2 008d 0069 003c 0027 00f3 .........i.<.'.. 00000300: 0036 0037 0074 0021 0013 00f7 00ba 0089 .6.7.t.!........ 00000310: 006b 0072 005c 0034 0071 00fc 00c9 0034 .k.r.\.4.q.....4 00000320: 00c4 0053 00b1 00cb 001f 0086 0037 00a5 ...S.........7.. 00000330: 0076 00e6 00ff 0030 009c 005c 00d2 00e7 .v.....0...\.... 00000340: 0049 008d 00fe 005c 00ba 0078 00ac 00f2 .I.....\...x.... 00000350: 00e7 000f 004d 005c 007f 00df 0082 00f1 .....M.\........ 00000360: 00cf 007d 0028 0082 0020 00b3 0013 006f ...}.(... .....o 00000370: 0005 009b 002a 0098 00a2 0014 0082 00f1 .....*.......... 00000380: 0066 0005 00ad 0060 008b 0052 0030 002e .f.....`...R.0.. 00000390: 00b2 0082 0056 0030 0047 00d9 0052 0070 .....V.0.G...R.p 000003a0: 00c9 0060 0059 00c1 0076 000a 004a 0094 ...`.Y...v...J.. 000003b0: 0044 0070 0079 0042 00e4 0007 0058 00c1 .D.p.y.B.....X.. 000003c0: 0088 00b2 000a 002e 0018 00ab 004d 0022 .............M." 000003d0: 0038 00d5 0009 002b 0018 00d1 0054 00c1 .8.....+.....T.. 000003e0: 00c5 00f9 0090 00db 00df 0000 0082 00f1 ................ 000003f0: 00c5 000a 005a 00c1 0016 00a5 00e0 0001 .....Z.......... 00000400: 0000 0067 0000 00b8 0004 0080 00d3 0000 ...g............ 00000410: 005c 00cc 00d9 00af 008b 0027 00ce 007e .\.........'...~ 00000420: 000a 0080 004f 0000 0070 001f 0000 00d7 .....O...p...... 00000430: 0000 00f0 0000 0000 00b7 0002 00f0 002e ................ 00000440: 0000 001e 0003 00e0 0006 0000 00fe 0008 ................ 00000450: 00c0 0053 0000 00fc 001a 0080 001f 0000 ...S............ 00000460: 00f0 0035 0000 00de 0002 00c0 0065 0000 ...5.........e.. 00000470: 00fc 001c 0080 00db 0001 00b8 001f 0080 ................ 00000480: 00bb 0000 00b8 0008 0080 00df 0000 0070 ...............p 00000490: 0025 0000 0097 0002 00f0 0015 0000 00be .%.............. 000004a0: 000d 00c0 00cb 0000 00fc 001e 0080 003f ...............? 000004b0: 0003 00f0 00dd 0074 00d7 00a3 0000 005c .......t.......\ 000004c0: 000b 00c0 009d 0000 00dc 000d 001c 008e ................ 000004d0: 00c3 00e5 0000 003c 0003 00c0 008f 0000 .......<........ 000004e0: 00f8 0003 0000 003f 0006 00e0 007a 008e .......?.....z.. 000004f0: 007f 005d 000d 0080 00d2 0091 00f8 007c ...]...........| 00000500: 000a 0080 0057 0053 00cf 0063 00e4 006f .....W.S...c...o 00000510: 0004 00e0 001b 00e9 00a7 0088 00d7 0015 ................ 00000520: 0043 00cb 004f 0001 00f0 0033 0000 001e .C...O.....3.... 00000530: 0002 000e 0047 00e6 00ce 00d4 00cf 00bf .....G.......... 00000540: 0003 0070 000b 0000 004f 0003 0070 0013 ...p.....O...p.. 00000550: 0000 00ff 0006 00e0 00eb 0000 00bc 001b ................ 00000560: 0080 009f 0002 00f0 001e 00e0 0070 009c .............p.. 00000570: 009f 0005 00e0 0083 0000 00bc 0000 00c0 ................ 00000580: 0075 0043 001f 00fe 003a 001c 0089 009f .u.C.....:...... 00000590: 00e5 003f 00e9 00c8 009f 0000 0078 0012 ...?.........x.. 000005a0: 0080 0077 0000 00f0 004d 0000 00be 000f ...w.....M...... 000005b0: 00c0 00b7 0000 00f8 002d 0000 00ff 004c .........-.....L 000005c0: 007d 00fb 001b 0000 006f 0007 00e0 0039 .}.......o.....9 000005d0: 0000 003e 000f 00c0 0083 0000 007c 0009 ...>.........|.. 000005e0: 0038 001c 00bd 00b7 0001 0087 00b9 00f4 .8.............. 000005f0: 001d 0000 001e 0006 000e 0047 00fe 0017 ...........G.... 00000600: 00c0 0061 008e 00bd 0094 00ee 00fa 0002 ...a............ 00000610: 0000 0057 008d 0026 0059 0041 002b 00b8 ...W...&.Y.A.+.. 00000620: 00af 007c 0058 005d 0029 0018 00dd 0072 ...|.X.].).....r 00000630: 002d 0078 00ae 00fd 00f4 0082 0038 00c7 .-.x.........8.. 00000640: 0066 0010 00cc 0003 0061 0005 00ad 0060 .f.......a.....` 00000650: 00f1 0005 0071 00bc 0059 0041 002b 0038 .....q...Y.A.+.8 00000660: 00f6 00a1 0020 0082 000c 0013 006f 0005 ..... .......o.. 00000670: 00ad 0060 00d9 0052 0030 000e 0059 00c1 ...`...R.0...Y.. 00000680: 001c 0056 00b0 006c 0029 0018 0037 0058 ...V...l.)...7.X 00000690: 0041 002b 00d8 00a2 0014 009c 001a 002c .A.+..........., 000006a0: 002b 00d8 005a 0041 0089 0092 0008 00ce .+...Z.A........ 000006b0: 0027 0044 007e 0080 0015 008c 0068 00a1 .'.D.~.......h.. 000006c0: 00e0 00c4 0058 006d 001e 00c1 00dc 0090 .....X.m........ 000006d0: 0015 008c 00b0 0082 00f3 00f9 0090 00db ................ 000006e0: 00df 0018 0082 00c7 005e 0077 0056 00ea .........^.w.V.. 000006f0: 008c 0061 0005 00e7 00c7 006a 00f3 000a ...a.......j.... 00000700: 00a6 0028 0085 0060 00ec 00dc 00f0 003e ...(...`.......> 00000710: 0019 00ef 0093 0079 0001 00a8 00b9 004f .......y.......O 00000720: 0006 000e 0067 00e4 00d5 0025 00ce 0059 .....g.....%...Y 00000730: 00c1 0076 000a 00ee 0090 000f 00ab 002e ...v............ 00000740: 0005 00a3 008b 00ae 0005 0097 00f4 00d3 ................ 00000750: 000b 00e2 001c 009b 0044 0030 004e 00ac .........D.0.N.. 00000760: 002d 0099 00ac 00a0 0017 00c4 00b9 00fd .-.............. 00000770: 00bd 0021 0018 0087 00ac 00a0 0015 006c ...!...........l 00000780: 0051 000a 008e 003f 008c 0015 00b4 0082 .Q.....?........ 00000790: 0065 004b 00c1 0038 006d 0005 00ad 0060 .e.K...8.m.....` 000007a0: 008b 0052 0030 006e 00b6 0082 0056 00b0 ...R.0.n.....V.. 000007b0: 0045 0029 0038 0035 0070 0056 00b0 00b5 .E.).8.5.p.V.... 000007c0: 0082 0012 0025 0011 001c 004f 00e4 0007 .....%.....O.... 000007d0: 0058 00c1 0088 0076 000a 004e 007c 00de .X.....v...N.|.. 000007e0: 003c 0082 0053 009d 00b3 0082 00ad 0015 .<...S.......... 000007f0: 001c 0022 00b7 00bf 0061 0004 00c7 001b ...".....a...... 00000800: 00ac 00a0 0015 002c 005b 000a 001e 000c .......,.[...... 00000810: 003b 0022 00bc 004f 00c6 00fb 0064 006a .;."...O.....d.j 00000820: 00ed 0093 0039 00ba 00f2 00c5 00fc 00a7 .....9.......... 00000830: 00ca 000a 005a 00c1 00e2 00a5 0060 0074 .....Z.......`.t 00000840: 00d7 00b5 00a0 0017 00c4 002d 004a 00c1 ...........-.J.. 00000850: 00b8 0068 000d 00c9 0064 0005 0057 00a4 ...h.....d...W.. 00000860: 00a0 0044 0049 0004 00d9 0053 0047 00ad ...D.I.....S.G.. 00000870: 0060 008e 00cd 002b 0028 0051 0012 00c1 .`.....+.(.Q.... 00000880: 0025 0013 006f 0005 00db 0029 00b8 00a7 .%...o.....).... 00000890: 007e 00ae 000e 0041 00d2 0017 002b 0038 .~.....A.....+.8 000008a0: 0046 00ee 0043 0023 0005 0017 00cc 00fb .F...C.#........ 000008b0: 0026 0011 008c 0086 00ac 0020 00c3 0064 .&......... ...d 000008c0: 00e7 0068 00a7 0060 00fa 005c 000a 00c1 ...h...`...\.... 000008d0: 007c 00c2 000a 005a 00c1 00e2 00a5 0020 .|.....Z....... 000008e0: 00c3 0003 00ac 0060 0044 006b 0005 00d3 .......`.D.k.... 000008f0: 00e7 0052 0008 00e6 0013 0056 00d0 000a ...R.......V.... 00000900: 00e6 00c8 00ed 0017 0041 0030 00a7 00ce .........A.0.... 00000910: 0018 0056 0070 008c 0016 000a 00a6 0028 ...V.p.........( 00000920: 0085 0060 00ec 00e8 00f0 003e 0019 00ef ...`.......>.... 00000930: 0093 00a9 00bb 004f 0006 008e 00b2 00da .......O........ 00000940: 000a 005a 00c1 0089 0019 002f 0058 000a ...Z......./.X.. 00000950: 0046 00d7 005d 000b 00e6 00f0 0082 0038 .F...].........8 00000960: 0047 0029 0004 00c7 009b 00ad 00a0 0015 .G.)............ 00000970: 002c 00bb 0020 0066 0087 008e 005a 00c1 .,... .f.....Z.. 00000980: 001c 00a5 0014 001c 00a2 0008 0082 004c ...............L 00000990: 004c 00bc 0015 006c 00ad 00e0 000e 00fd .L.....l........ 000009a0: 005c 0035 0082 0071 009b 0015 009c 00ea .\.5...q........ 000009b0: 0043 0053 0005 0027 00e6 007d 00f3 0008 .C.S...'...}.... 000009c0: 0046 00a3 0056 0070 008c 00d6 000a 004a .F...V.p.......J 000009d0: 0094 0044 0070 00ea 0006 002b 00d8 005a ...D.p.....+...Z 000009e0: 0041 0089 0092 0008 00e6 00e1 00b6 0082 .A.............. 000009f0: 0056 0030 00a2 006c 0029 0098 00bf 0058 .V.0...l.).....X 00000a00: 0041 002b 0098 00db 002f 0088 00e0 0078 .A.+...../.....x 00000a10: 00c2 000a 004e 000e 00d6 00f0 00b9 00ac .....N.......... 00000a20: 0082 00e9 0073 0029 0004 000f 005e 00b7 .....s.).....^.. 00000a30: 00a3 0000 00bc 004f 00e6 00f5 002f 00ef .......O...../.. 00000a40: 0093 00d9 00fe 003e 0019 0080 0057 005e .......>.....W.^ 00000a50: 003b 006b 0005 00ad 00e0 00a8 00e0 00c4 .;.k............ 00000a60: 00d9 00cd 0097 0082 00a4 0064 0072 002d ...........d.r.- 00000a70: 0018 00e1 0005 0071 00d9 0052 0030 00de .......q...R.0.. 00000a80: 00ac 00a0 0015 006c 00b1 0020 003e 00b6 .......l... .>.. 00000a90: 0095 0099 008e 005a 00c1 001c 0065 0015 .......Z.....e.. 00000aa0: 0094 0028 0089 0020 0069 00e2 00ad 00a0 ...(... .i...... 00000ab0: 0015 002c 005e 000a 00e6 0086 00ac 00a0 ...,.^.......... 00000ac0: 0015 002c 005e 000a 00c6 0003 00ac 0060 ...,.^.........` 00000ad0: 0084 0015 002c 005e 000a 00e6 001b 00ac .....,.^........ 00000ae0: 00a0 0015 002c 005e 000a 00c6 0009 002b .....,.^.......+ 00000af0: 0068 0005 005b 0094 0082 00fb 009a 0078 .h...[.........x 00000b00: 002b 0058 004a 0041 0089 0092 0008 00c6 .+.X.J.A........ 00000b10: 009b 0015 009c 001f 00ac 0076 000a 00ee ...........v.... 00000b20: 0069 00de 0057 0087 0060 00ec 00f4 00f0 .i...W...`...... 00000b30: 003e 0099 00fc 00f2 003e 0099 005a 00fb .>.......>...Z.. 00000b40: 0064 00f2 0059 002b 0068 0005 0067 00cf .d...Y.+.h...g.. 00000b50: 0096 002a 0005 00f3 0014 00ba 0016 009c ...*............ 00000b60: 000f 002f 0088 0037 008f 0060 007c 00b1 .../...7...`.|.. 00000b70: 0082 0056 0030 0027 0053 00d9 0005 00f1 ...V.0.'.S...... 00000b80: 0092 008e 005a 00c1 001c 002d 0014 0094 .....Z.....-.... 00000b90: 0028 0089 0020 0017 003c 0021 00ac 00e0 .(... ...<.!.... 00000ba0: 007c 0042 00e4 00f6 005d 000a 0046 00ec .|.B.....]...F.. 00000bb0: 000d 00c1 0078 00b3 0082 0056 0030 00cf .....x.....V.0.. 00000bc0: 007b 00d9 0052 0030 001e 0066 0005 00ad .{...R.0...f.... 00000bd0: 0060 008b 0052 00f0 00ff 008e 003e 0056 .`...R.......>.V 00000be0: 00b0 00a1 0082 0012 0025 0011 008c 008b .........%...... 00000bf0: 00d6 0096 00b8 0056 00d0 00a5 00e0 0089 .......V........ 00000c00: 0020 00c8 000e 0013 006f 0005 00cb 002a . .......o.....* 00000c10: 0028 00b1 00be 00c4 00dd 0003 0082 00f3 .(.............. 00000c20: 0037 005b 00c1 0088 0076 000a 00ee 0030 .7.[.....v.....0 00000c30: 00ef 00ab 0046 0030 0076 007d 0078 009f .....F.0.v.}.x.. 00000c40: 008c 00f7 00c9 00d4 00dd 0027 0073 00f4 ...........'.s.. 00000c50: 00ba 00d9 000a 005a 00c1 0046 00a5 0020 .......Z...F... 00000c60: 007b 004a 0088 00fc 0080 0046 00b5 00e0 .{.J.......F.... 00000c70: 00ec 00bd 002e 0005 0023 0056 0084 0060 .........#.V...` 00000c80: 009c 00b0 0082 0056 00b0 00c5 0082 00f8 .......V........ 00000c90: 00d8 00a3 0058 00c1 00d7 0047 003b 0005 .....X.....G.;.. 00000ca0: 0025 004a 0022 00c8 0005 0049 0008 002b .%.J.".....I...+ 00000cb0: 0038 009f 0010 00b9 00fd 0055 0028 0038 .8.........U.(.8 00000cc0: 0071 007c 00f3 0008 00c6 00a1 0047 0024 .q.|.........G.$ 00000cd0: 00ac 00e0 0061 00ac 0021 0099 005c 000a .....a...!...\.. 00000ce0: 009e 0008 0082 00f1 0060 002b 0068 0005 .........`.+.h.. 00000cf0: 005b 0094 0082 0053 008d 00e6 004e 0058 .[.....S.....N.X 00000d00: 00c1 003c 00f1 002d 0014 0094 0028 0089 ...<...-.....(.. 00000d10: 0020 00c3 0064 00e7 00b0 0082 004d 0015 . ...d.......M.. 00000d20: 009c 0088 00dc 0087 004d 0022 00c8 0039 .........M."...9 00000d30: 004e 00bc 0015 006c 00a1 00e0 0030 00d7 .N.....l.....0.. 00000d40: 0039 0036 008c 00e0 0078 0091 0015 008c .9.6.....x...... 00000d50: 0068 00ad 00e0 0039 00ce 00fb 0066 0010 .h.....9.....f.. 00000d60: 008c 001d 0020 00de 0027 0043 00fa 007c ..... ...'.C...| 00000d70: 000a 00f0 003e 0099 003a 00fb 0064 0000 .....>...:...d.. 00000d80: 009e 0007 00e0 0036 00ac 00a0 0015 001c .......6........ 00000d90: 0015 0094 0028 0059 000a 00b2 0043 0042 .....(.Y.....C.B 00000da0: 00e4 0007 0034 00ad 0005 0087 0070 0029 .....4.......p.) 00000db0: 0018 00b1 0052 0004 00e3 0022 002b 00b8 .....R.....".+.. 00000dc0: 003c 0021 005a 0028 00b8 0043 003e 00e4 .<.!.Z.(...C.>.. 00000dd0: 00f6 0057 0087 0060 003e 0061 0005 0073 ...W...`.>.a...s 00000de0: 00b4 0056 0050 00a2 0024 0082 009c 0058 ...V.P...$.....X 00000df0: 0042 0058 00c1 00f9 0084 00c8 00ed 00af .B.X............ 00000e00: 004e 00c1 0014 00a5 0010 008c 00d3 0056 .N.............V 00000e10: 0070 000d 00c9 00b4 0022 0005 004f 002c .p......."...O., 00000e20: 001f 00de 0060 0004 00a3 0013 0056 00d0 .....`.......V.. 00000e30: 000a 00b6 0028 0005 00a7 003a 0061 0005 .....(.....:.a.. 00000e40: 00f3 00c4 00b7 0053 0050 00a2 0024 0082 .......S.P...$.. 00000e50: 0063 0043 0056 00d0 000a 004e 00f5 0061 .c.C.V.....N...a 00000e60: 00f3 0008 00b2 0060 00e2 00ad 0060 003b .......`.....`.; 00000e70: 0005 0087 0028 0082 0060 00bc 0059 00c1 .....(...`...Y.. 00000e80: 0008 002b 0058 00bc 0014 008c 00dd 0020 ...+.X......... 00000e90: 00de 0027 0073 000a 00f0 003e 0099 009a ...'.s.....>.... 00000ea0: 00fb 0064 0000 009e 0078 00ed 00e7 00b2 ...d.....x...... 00000eb0: 0082 0056 0070 0054 0050 00a2 0064 0029 ...V.p.T.P...d.) 00000ec0: 0078 00ec 00ac 00cf 0024 0044 007e 0080 .x.......$.D.~.. 00000ed0: 006b 00c1 0008 0097 0082 0011 001b 0040 .k.............@ 00000ee0: 0030 006e 00b8 0069 00a2 0021 002b 0018 .0.n...i...!.+.. 00000ef0: 00d1 004e 00c1 0073 00cc 0087 00dc 00fe ...N...s........ 00000f00: 00aa 0011 00cc 005f 00ac 00a0 0015 002c ......._......., 00000f10: 005e 000a 001e 00a4 0002 00ff 000c 0070 .^.............p 00000f20: 00b8 0010 003c 003d 0094 00ff 00a4 0023 .....<.=.......# 00000f30: 00e3 0059 00ff 0047 00c4 00f9 00e5 0005 ...Y...G........ 00000f40: 00f1 005a 0017 00c4 0056 00d0 000a 008e ...Z.....V...... 00000f50: 000a 00ee 0035 001f 0056 0054 000a 0046 .....5...V.T...F 00000f60: 0087 005c 000b 007a 0041 00dc 00a2 0014 ...\...z.A...... 00000f70: 0024 0075 00c2 000a 00e6 0089 006f 00ad .$.u.........o.. 00000f80: 00a0 0044 0049 0004 00e3 00cd 000a 005a ...D.I.........Z 00000f90: 00c1 00a9 003e 0094 0042 0090 0089 0089 .....>...B...... 00000fa0: 00b7 0082 00ad 0015 0094 0028 0089 0060 ...........(...` 00000fb0: 007c 00b1 0082 0063 00b4 0056 0070 0062 .|.....c...V.p.b 00000fc0: 00de 0037 008f 00e0 0041 00fa 0095 008d ...7.....A...... 00000fd0: 007f 002d 00e8 005f 000b 0056 00dc 0027 ...-..._...V...' 00000fe0: 0003 00f0 0019 0000 00de 006a 0005 00ad ...........j.... 00000ff0: 0060 00a3 0052 0070 0049 0042 00e4 0007 .`...R.p.I.B.... 00001000: 00b8 0016 008c 00f0 0082 0038 0062 0063 ...........8.b.c 00001010: 0008 008e 000d 0059 00c1 0088 00d6 000a .......Y........ 00001020: 002e 00c8 0087 00dc 00fe 0066 0010 003c ...........f...< 00001030: 00f6 008a 00b3 00c2 000a 00b6 0053 0070 .............S.p 00001040: 0088 0022 0008 00c6 00e2 00cc 00fb 0064 ..."...........d 00001050: 00bc 0020 00ee 00b1 0020 00b6 0082 0056 ... ..... .....V 00001060: 0070 0054 0070 00e7 007c 0058 0069 0029 .p.T.p...|.X.i.) 00001070: 0018 009d 0073 002d 00b8 00bc 009f 005e .....s.-.......^ 00001080: 0010 00e7 00d8 0018 0082 00b9 00d3 006b ...............k 00001090: 004b 0026 002b 00e8 0005 0071 006e 007f .K.&.+.....q.n.. 000010a0: 000f 0008 00c6 0017 002b 0048 001a 003e .........+.H...> 000010b0: 002b 0058 00b6 0014 0024 004d 00bc 0015 .+.X.....$.M.... 000010c0: 00b4 0082 00c5 004b 00c1 0038 0061 0005 .......K...8.a.. 000010d0: 0023 00ac 0060 00f1 0052 0030 006e 00b3 .#...`...R.0.n.. 000010e0: 0082 0056 00b0 0045 0029 0038 000e 0096 ...V...E.).8.... 000010f0: 0015 00b4 0082 0065 004b 00c1 0063 008f .......e.K...c.. 00001100: 0062 0005 008f 008b 0046 000a 000e 0063 .b.......F.....c 00001110: 0055 0004 00c1 0078 00b3 0082 0011 0056 .U.....x.......V 00001120: 0070 003e 001f 0072 00fb 009b 0044 00f0 .p.>...r.....D.. 00001130: 00d8 00ab 00b1 0082 00cd 0015 0094 0028 ...............( 00001140: 0089 0060 00ec 00df 00f0 003e 0019 00ef ...`.......>.... 00001150: 0093 00a9 00bb 004f 00e6 00e8 00f8 000d .......O........ 00001160: 0058 0041 002b 0038 002a 0078 005e 00f9 .X.A.+.8.*.x.^.. 00001170: 00b0 0081 0052 0030 003a 00ea 005a 0070 .....R.0.:...Z.p 00001180: 00be 009f 005e 0010 00e7 00d8 0030 0082 .....^.......0.. 00001190: 00f9 00a2 0035 0024 0093 0015 005c 0085 .....5.$.....\.. 000011a0: 0082 0012 0025 0011 0064 00af 001d 00b5 .....%...d...... 000011b0: 0082 0039 0036 00ac 0060 00ba 00a6 0014 ...9.6...`...... 000011c0: 0082 00f9 0001 0056 00d0 000a 0016 002f .......V......./ 000011d0: 0005 0049 0053 006e 0005 00a7 0022 00f7 ...I.S.n.....".. 000011e0: 00a1 0085 0082 008b 00e7 007d 0063 0008 ...........}.c.. 000011f0: 0046 0013 0056 0070 006d 0089 00eb 0052 .F...V.p.m.....R 00001200: 00f0 0044 0010 001c 0007 00ce 000a 005a ...D...........Z 00001210: 00c1 00b2 00a5 0060 003e 0091 001f 0060 .......`.>.....` 00001220: 0005 0023 009a 002a 0038 007c 002e 0082 ...#...*.8.|.... 00001230: 00e0 0078 00c2 000a 005a 00c1 001c 00b9 ...x.....Z...... 00001240: 00fd 00cd 0023 0098 00bf 0058 0041 002b .....#.....X.A.+ 00001250: 0058 00bc 0014 00cc 00ff 0037 0093 00f7 .X.........7.... 00001260: 00c9 0078 009f 004c 00c5 007d 0032 0070 ...x...L...}.2.p 00001270: 00f4 004f 00a8 005a 0041 002b 0038 003b ...O...Z.A.+.8.; 00001280: 00e3 00a5 004a 00c1 00e8 00b4 006b 00c1 .....J.......k.. 00001290: 0031 00bc 0020 00ce 0051 0004 00c1 00a9 .1... ...Q...... 000012a0: 009b 00ad 0060 006b 0005 0025 004a 0022 .....`.k...%.J." 000012b0: 00c8 00ce 001d 00b5 0082 0039 008a 0028 ...........9...( 000012c0: 0038 0071 00ef 00e6 0011 0064 0076 00e2 .8.q.......d.v.. 000012d0: 00ad 0060 0053 0005 0077 00ee 00e7 004a ...`.S...w.....J 000012e0: 0011 008c 001b 00ac 00e0 0018 00b9 000f ................ 000012f0: 00ed 0014 009c 009d 00f7 000d 0023 0018 .............#.. 00001300: 00cd 0059 00c1 0035 0024 00ee 008a 0014 ...Y...5.$...... 00001310: 0094 0028 0089 0060 007c 00b1 0082 0056 ...(...`.|.....V 00001320: 00b0 0045 0029 0048 007a 0080 0015 008c ...E.).H.z...... 00001330: 00b0 0082 0011 0005 0011 008c 0037 002b .............7.+ 00001340: 0068 0005 0073 00e4 00f6 004b 0021 0038 .h...s.....K.!.8 00001350: 0075 00c2 000a 001e 0033 0058 0013 009f .u.......3.X.... 00001360: 000b 002a 0028 0051 0012 00c1 00d8 00d7 ...*.(.Q........ 00001370: 00e1 007d 0032 00de 0027 0093 005f 00b5 ...}.2...'..._.. 00001380: 00f6 00c9 001c 00bd 005e 00b1 0082 0056 .........^.....V 00001390: 00b0 0051 0029 0038 0026 0093 006b 00c1 ...Q.).8.&...k.. 000013a0: 0008 002f 0088 000b 0022 0098 006f 00b6 .../....."...o.. 000013b0: 0082 0056 00b0 00f8 0082 0098 00f3 00ea ...V............ 000013c0: 00a8 0015 00cc 0051 0050 00c1 0014 00a5 .......Q.P...... 000013d0: 0010 008c 00a5 00d5 00a7 0001 00b8 0007 ................ 000013e0: 0080 00c7 0001 00b8 0003 0080 007b 00d3 .............{.. 000013f0: 00f1 00fb 00d3 0022 0023 0097 00ff 0067 .......".#.....g 00001400: 0000 00ff 0047 00c4 005e 0010 006f 0063 .....G...^...o.c 00001410: 0041 006c 0005 00ad 00e0 0082 0079 002f .A.l.........y./ 00001420: 0052 000a 0046 00d3 00ae 0005 0073 0078 .R...F.......s.x 00001430: 0041 005c 00b6 0014 001c 006f 00b0 0082 .A.\.......o.... 00001440: 0056 00b0 00ec 0082 0038 000e 0059 0041 .V.......8...Y.A 00001450: 002b 0018 0051 00bc 0014 008c 002f 0056 .+...Q......./.V 00001460: 00d0 000a 00e6 00f6 00cb 0096 0082 00f9 ................ 00001470: 0084 0015 009c 001f 00ac 0046 000a 004a ...........F...J 00001480: 0094 0044 0030 00ff 003b 0033 00fe 00b5 ...D.0...;.3.... 00001490: 0060 007e 00f9 00d7 0082 0055 00f6 00c9 .`.~.......U.... 000014a0: 00e4 00b3 0056 00d0 000a 002e 0038 005b .....V.......8.[ 000014b0: 00a4 0014 008c 001f 00c6 00b5 0060 0084 .............`.. 000014c0: 0017 00c4 00c5 004b 00c1 0078 00b3 0082 .......K...x.... 000014d0: 00fb 004a 0088 0022 000a 004a 0094 0044 ...J..."...J...D 000014e0: 0070 0079 0047 00ad 0060 008e 00e2 000a .p.y.G...`...... 000014f0: 004a 0094 0044 0030 004e 005b 0041 002b .J...D.0.N.[.A.+ 00001500: 00d8 00a2 0014 0024 000d 009f 0015 00b4 .......$........ 00001510: 0082 0079 00de 000b 0022 0048 00ea 00ba ...y.....".H.... 00001520: 0015 00b4 0082 00c5 004b 00c1 0078 00b3 .........K...x.. 00001530: 0082 0056 00b0 0045 0029 0098 00a7 0073 ...V...E.).....s 00001540: 006d 0089 006b 0005 005d 000a 00ee 0019 .m...k...]...... 00001550: 00c1 00dd 0027 00de 000a 0016 0054 0030 .....'.......T.0 00001560: 008d 00e7 00da 0012 0077 0027 0004 0049 .........w.'...I 00001570: 0043 003c 0015 0056 0030 00a2 0091 0082 .C.<...V.0...... 00001580: 003b 00cf 00fb 004a 0011 008c 00fd 001e .;.....J........ 00001590: 00de 0027 0013 002f 00ef 0093 00a9 00b8 ...'.../........ 000015a0: 004f 0026 009f 00b5 0082 0056 0070 00e2 .O.&.......V.p.. 000015b0: 006c 00c1 0052 0090 00bd 0026 0044 007e .l...R.....&.D.~ 000015c0: 0040 008b 005a 0030 000d 00f1 0054 00b8 .@...Z.0.....T.. 000015d0: 0014 008c 0058 0005 0082 0071 00c8 000a .....X.....q.... 000015e0: 005a 00c1 0016 000b 00e2 00f9 008e 005a .Z.............Z 000015f0: 00c1 001c 008d 0014 0094 0028 0089 0020 ...........(... 00001600: 0017 0030 0021 00ac 00e0 007c 0042 00e4 ...0.!.....|.B.. 00001610: 00f6 005d 000a 0046 00ec 0019 00c1 00f8 ...]...F........ 00001620: 0062 0005 00ad 0060 008b 0052 0030 001e .b.....`...R.0.. 00001630: 0069 0005 00ad 0020 0069 00f4 00ca 0096 .i..... .i...... 00001640: 0082 00f3 0013 0090 003b 0061 0005 00f3 .........;.a.... 00001650: 00c4 0017 0057 0050 00a2 0024 0082 00f9 .....W.P...$.... 00001660: 0086 0035 0024 00ae 0015 005c 0085 0082 ...5.$.....\.... 00001670: 00b3 0091 00fb 00b0 0031 0004 0039 00af .........1...9.. 00001680: 0089 00b7 0082 00c5 0015 004c 00d7 00af ...........L.... 00001690: 0021 0071 00f7 0086 00e0 00d4 00cd 0056 .!.q...........V 000016a0: 0030 00a2 00a9 0082 00e7 0035 00ef 001b .0.........5.... 000016b0: 0040 0030 00f6 007e 0078 009f 008c 00f7 .@.0...~.x...... 000016c0: 00c9 00d4 00dd 0027 0003 0070 0033 0000 .......'...p.3.. 000016d0: 00cf 0063 0005 00ad 00e0 00a8 00a0 0044 ...c...........D 000016e0: 00c9 0052 0090 009d 0013 0022 003f 00a0 ...R.......".?.. 000016f0: 005d 002d 0038 0011 002e 0005 0023 0056 .].-.8.......#.V 00001700: 0087 0060 009c 00b6 0082 0056 00b0 00c5 ...`.......V.... 00001710: 0082 0078 003c 0061 0005 0073 0034 0055 ...x.<.a...s.4.U 00001720: 0050 00a2 0024 0082 009c 0070 0042 0058 .P...$.....p.B.X 00001730: 00c1 00f9 0084 00c8 00ed 00af 0048 00c1 .............H.. 00001740: 0021 008a 0020 0018 0027 00ac 0060 00c4 .!... ...'...`.. 00001750: 001a 0092 0069 0015 000a 009e 0070 003e .....i.......p.> 00001760: 00bc 0061 0008 00c6 00e3 00ad 00a0 0015 ...a............ 00001770: 006c 0051 000a 008e 0017 00e5 004e 0058 .l.Q.........N.X 00001780: 00c1 003c 00f1 008d 0014 0094 0028 0089 ...<.........(.. 00001790: 00e0 00b1 00ad 0060 0005 009b 002b 0038 .......`.....+.8 000017a0: 00db 0087 000d 0023 00c8 00e2 0089 00b7 .......#........ 000017b0: 0082 008d 0014 009c 0068 0067 00f3 0008 .........h.g.... 000017c0: 00e6 002f 0056 0030 00c2 000a 0096 002d .../.V.0.......- 000017d0: 0005 0063 001f 0088 00f7 00c9 0078 009f ...c.........x.. 000017e0: 004c 00dd 007d 0032 0000 00b7 0001 00f0 .L...}.2........ 000017f0: 0004 0056 00d0 000a 008e 000a 004a 0094 ...V.........J.. 00001800: 002c 0005 0039 00af 0084 00c8 000f 0068 .,...9.........h 00001810: 005d 000b 00a6 0070 0029 0018 00b1 006a .].....p.).....j 00001820: 0004 00e3 0052 002b 00b8 0024 0021 001a .....R.+...$.!.. 00001830: 0029 0078 005e 00f9 0090 00db 005f 0029 .).x.^......._.) 00001840: 0082 00a4 001f 003b 00c2 000a 005a 00c1 .......;.....Z.. 00001850: 00b2 00a5 00e0 00c1 0050 00e0 009f 0001 .........P...... 00001860: 000e 0017 0082 00a7 0087 00b3 00a4 0023 ...............# 00001870: 00e3 0059 00ff 0047 00c4 00f9 00e5 0005 ...Y...G........ 00001880: 00f1 00fa 0016 00c4 0056 00d0 000a 008e .........V...... 00001890: 000a 009e 0040 003e 00ac 00a2 0014 008c .....@.>........ 000018a0: 00ae 00b8 0016 00f4 0082 00f8 0011 0089 ................ 000018b0: 00f2 00a5 00e0 00d8 0009 002b 0098 0027 ...........+...' 000018c0: 00be 00a9 0082 0012 0025 0011 00cc 000d .........%...... 000018d0: 0059 0041 002b 0038 00d5 0087 0022 0008 .Y.A.+.8.....".. 000018e0: 0032 003b 00f1 0056 00b0 00a9 0082 0029 .2.;...V.......) 000018f0: 004a 0021 0018 006f 0056 00d0 000a 00b6 .J.!...o.V...... 00001900: 0028 0005 00e3 0022 002b 0068 0005 0073 .(.....".+.h...s 00001910: 0094 002d 0005 0097 000c 0096 0015 006c ...-...........l 00001920: 00a7 00a0 0044 0049 0004 0097 0027 0044 .....D.I.....'.D 00001930: 007e 0080 0015 008c 0028 00ab 00e0 0082 .~.......(...... 00001940: 00b1 00da 0024 0082 0053 009d 00b0 0082 .....$...S...... 00001950: 0011 004d 0015 005c 009c 000f 00b9 00fd ...M...\........ 00001960: 000d 0020 0018 005f 00ac 00a0 0015 006c ... ..._.......l 00001970: 0051 000a 00c6 006e 000d 00ef 0093 00f1 .Q.....n........ 00001980: 003e 0099 00ba 00fb 0064 00e0 00e8 002f .>.......d...../ 00001990: 008e 0058 0041 002b 0038 002a 00b8 00a7 ...X.A.+.8.*.... 000019a0: 007c 0058 005d 0029 0018 00dd 0072 002d .|.X.].).....r.- 000019b0: 0078 00ae 00fd 00f4 0082 0038 00c7 0066 .x.........8...f 000019c0: 0010 00cc 0003 0061 0005 00ad 0060 00f1 .......a.....`.. 000019d0: 0005 0071 00bc 0059 0041 002b 0038 00f6 ...q...Y.A.+.8.. 000019e0: 00a1 0020 0082 000c 0013 006f 0005 00ad ... .......o.... 000019f0: 0060 00d9 0052 0030 000e 0059 00c1 001c .`...R.0...Y.... 00001a00: 0056 00b0 006c 0029 0018 0037 0058 0041 .V...l.)...7.X.A 00001a10: 002b 00d8 00a2 0014 009c 001a 002c 002b .+...........,.+ 00001a20: 00d8 005a 0041 0089 0092 0008 00ce 0027 ...Z.A.........' 00001a30: 0044 007e 0080 0015 008c 0068 00a1 00e0 .D.~.......h.... 00001a40: 00c4 0058 006d 001e 00c1 00dc 0090 0015 ...X.m.......... 00001a50: 008c 00b0 0082 00f3 00f9 0090 00db 00df ................ 00001a60: 0018 0082 00c7 005e 0077 0056 00ea 008c .......^.w.V.... 00001a70: 0061 0005 00e7 00c7 006a 00f3 000a 00a6 .a.......j...... 00001a80: 0028 0085 0060 00ec 00dc 00f0 003e 0019 .(...`.......>.. 00001a90: 00ef 0093 0079 0001 00a8 00b9 004f 0006 .....y.......O.. 00001aa0: 008e 00fe 0081 0055 002b 0068 0005 0047 .......U.+.h...G 00001ab0: 0005 0077 00c8 0087 0055 0097 0082 00d1 ...w.....U...... 00001ac0: 0045 00d7 0082 004b 00fa 00e9 0005 0071 .E.....K.......q 00001ad0: 008e 004d 0022 0018 0027 00d6 0096 004c ...M."...'.....L 00001ae0: 0056 00d0 000b 00e2 00dc 00fe 00de 0010 .V.............. 00001af0: 008c 0043 0056 00d0 000a 00b6 0028 0005 ...C.V.......(.. 00001b00: 00c7 001f 00c6 000a 005a 00c1 00b2 00a5 .........Z...... 00001b10: 0060 009c 00b6 0082 0056 00b0 0045 0029 .`.......V...E.) 00001b20: 0018 0037 005b 0041 002b 00d8 00a2 0014 ...7.[.A.+...... 00001b30: 009c 001a 0038 002b 00d8 005a 0041 0089 .....8.+...Z.A.. 00001b40: 0092 0008 008e 0027 00f2 0003 00ac 0060 .......'.......` 00001b50: 0044 003b 0005 0027 003e 006f 001e 00c1 .D.;...'.>.o.... 00001b60: 00a9 00ce 0059 00c1 00d6 000a 000e 0091 .....Y.......... 00001b70: 00db 00df 0030 0082 00e3 000d 0056 00d0 .....0.......V.. 00001b80: 000a 0096 002d 0005 000f 0086 001d 0011 .....-.......... 00001b90: 00de 0027 00e3 007d 0032 00b5 00f6 00c9 ...'...}.2...... 00001ba0: 001c 005d 00f9 0062 00fe 0053 0065 0005 ...]...b...S.e.. 00001bb0: 00ad 0060 00f1 0052 0030 00ba 00eb 005a ...`...R.0.....Z 00001bc0: 00d0 000b 00e2 0016 00a5 00e0 00ff 0000 ................ 00001bd0: 00a1 0019 004b 00c2 008f 0011 0053 0008 .....K.......S.. 00001be0: 0000 0000 0000 0000 0049 0045 004e 0044 .........I.E.N.D 00001bf0: 00ae 0042 0060 0082 ...B.`.. ``` But it had a null byte in between the two bytes. I wrote a short script to do for me (delete or any things else, if it doesn't delete the byte of this file) ```python file = open('file.data','rb') file_out = open('out.png','wb') data = [] check = 0 for i in file.read(): if(check % 2 == 1): data.append(i) check += 1 bytearray(data) file_out.write(bytes(data)) file.close() file_out.close() ``` A yellow picture was extracted by my script. But one more time, tool can't solve this challenge, zsteg, stegsolve, stegoveritas,... can't do anything with this image. I'm stuck. God come and told to me "How does the machine display color? Can you just show them yellow color and they understand this is yellow?". Anyway, I had wrote another short script to read color per pixel from left to right, top to bottom. ``` └─$ python script2.py (255, 255, 0) (255, 255, 80) (255, 255, 0) (255, 255, 75) (255, 255, 0) (255, 255, 3) (255, 255, 0) (255, 255, 4) (255, 255, 0) (255, 255, 10) (255, 255, 0) (255, 255, 0) (255, 255, 0) (255, 255, 9) (255, 255, 0) (255, 255, 0) (255, 255, 0) (255, 255, 0) (255, 255, 0) (255, 255, 0) (255, 255, 0) (255, 255, 12) (255, 255, 0) (255, 255, 126) (255, 255, 0) (255, 255, 199) (255, 255, 0) (255, 255, 86) (255, 255, 0) (255, 255, 191) ... ``` Easy to see that the blue color is changed each bytes. It's just a zip file? I'm sure about it because of zip file's signature is `50 4B 03 04` (in hex) and there is ``` (255, 255, 80) (255, 255, 75) (255, 255, 3) (255, 255, 4) ``` I mean blue color value. One more time, a null byte in between the two bytes. I wrote a short script to extract this file for me ```python from PIL import Image img = Image.open('out.png') file_out = open('file.zip','wb') width, height = img.size data = [] check = 0 for y in range(height): for x in range(width): if(check % 2 == 1): data.append(img.getpixel((x,y))[2]) check += 1 bytearray(data) file_out.write(bytes(data)) file_out.close() ``` Oh yeah, a zip file was extracted. I can see the flag file inside. But it need a password to unzip, I have tried john to crack but still can't do anything. So I take the comment of the first file to unzip it and successfully get the flag file. ```bash └─$ unzip file.zip Archive: file.zip warning [file.zip]: 31030 extra bytes at beginning or within zipfile (attempting to process anyway) [file.zip] flag.txt password: extracting: flag.txt ``` ```bash └─$ cat flag.txt b1n4ry_1s_f4nt4st1c ``` # :rocket: Math is fun > Author: [Dương Minh Đức](https://www.facebook.com/profile.php?id=100008306595035) > [+] [Source](https://battle.cookiearena.org/challenges/programming/math-is-fun) Challenge này lấy idea từ [Polish Notation](https://vi.wikipedia.org/wiki/K%C3%AD_ph%C3%A1p_Ba_Lan) được học trong môn Toán rời rạc. Nôm na thì bên cạnh cách biểu diễn 1 phép tính thông thường mà chúng ta hay sử dụng là [infix notation](https://en.wikipedia.org/wiki/Infix_notation) (`1+2`), chúng ta còn có các cách biểu diễn như [postfix](https://www.tutorialspoint.com/prefix-and-postfix-expressions-in-data-structure) (`12+`) và [prefix](https://www.tutorialspoint.com/prefix-and-postfix-expressions-in-data-structure) (`+12`). Challenge sẽ đưa ra một loạt các phép tính ngẫu nhiên và yêu cầu chúng ta tính toán. Để tránh trường hợp chúng ta có thể nhẩm hay bấm máy tính thì challenge đã rút ngắn thời gian cho phép chúng ta tính toán xuống còn 2 giây. ![](https://hackmd.io/_uploads/Bk-syWlcn.png) Không những vậy trong các phép tính được sinh ra không chỉ có dạng infix mà còn có prefix và postfix, cho nên chúng ta cần chuyển đổi các phép tính dạng prefix và postfix về dạng infix để có thể sử dụng hàm [eval](https://www.w3schools.com/python/ref_func_eval.asp) trong python mà tính toán. ![](https://hackmd.io/_uploads/By1z-bgqn.png) Sau đây là solution script của mình. ```python= from pwn import * import re HOST = "math-is-fun-5efd670c.dailycookie.cloud" PORT = 31479 # HOST = "3.0.98.230" # PORT= 8888 prefix= r"^[+\-*/].+" postfix= r"^.+[+-*/]$" def postfix_to_infix(expression): stack = [] for char in expression.split(): if char.isalnum(): stack.append(char) else: operand2 = stack.pop() operand1 = stack.pop() infix = '(' + operand1 + char + operand2 + ')' stack.append(infix) return stack.pop() def prefix_to_infix(expression): stack = [] expression = expression.split()[::-1] for char in expression: if char.isalnum(): stack.append(char) else: operand1 = stack.pop() operand2 = stack.pop() infix = '(' + operand1 + char + operand2 + ')' stack.append(infix) return stack.pop() def main(): conn = remote(HOST, PORT) while True: msg = conn.recvline().decode().strip() print(f"Received: {msg}") if re.match(r"[a-zA-Z]",msg): if re.match(r"Type any keys to begin",msg): conn.sendline("\n".encode()) else: result=0 equation = msg[:-2] equation = equation.strip() if equation[-1] == '+' or equation[-1] == '-'or equation[-1] == '*' or equation[-1] == '/':#re.match(postfix,msg): equation= postfix_to_infix(equation) elif re.match(prefix,msg): equation= prefix_to_infix(equation) #print(equation) result = round(eval(equation)) #print("Result: ",result) conn.sendline(str(result).encode()) if 'flag' in msg: print("Final: ",msg) conn.close() break if __name__ == '__main__': main() ```