Peter 
Better than last year XD. See you guys at Korea!!!
C0D3Matr1x
Average matrix checker challenge… After reverse a bit, I reimplement it into python like this.
first = [0x00000054, 0x00000012, 0x00000002, 0x00000002, 0x0000004C, 0x00000041, 0x00000033, 0x00000051, 0x0000003F, 0x0000000C, 0x00000006, 0x00000018, 0x00000040, 0x00000043, 0x00000034, 0x00000047, 0x0000005F, 0x00000022, 0x00000062, 0x00000021, 0x0000005E, 0x0000001A, 0x00000027, 0x0000004D, 0x00000033, 0x00000056, 0x00000048, 0x0000002C, 0x00000010, 0x00000004, 0x00000049, 0x00000002, 0x0000001C, 0x00000028, 0x0000004D, 0x0000001C, 0x0000003F, 0x0000002B, 0x00000017, 0x00000019, 0x00000027, 0x00000042, 0x00000052, 0x00000046, 0x0000003C, 0x00000000, 0x00000039, 0x00000041, 0x00000029, 0x00000009, 0x00000062, 0x00000027, 0x00000015, 0x00000017, 0x0000001A, 0x0000001D, 0x00000019, 0x00000048, 0x00000056, 0x00000012, 0x00000000, 0x00000004, 0x00000037, 0x0000004A, 0x0000003F, 0x00000000, 0x0000004B, 0x00000019, 0x0000003F, 0x00000037, 0x00000039, 0x00000024, 0x0000000E, 0x00000059, 0x00000015, 0x000000B8, 0x00000011, 0x0000003D, 0x00000009, 0x00000021, 0x00000046, 0x00000025, 0x00000063, 0x0000003F, 0x00000004, 0x00000017, 0x00000059, 0x0000005F, 0x0000003E, 0x00000061, 0x00000051, 0x0000001E, 0x00000052, 0x00000036, 0x00000001, 0x0000001B, 0x00000025, 0x0000000C, 0x00000013, 0x0000003A, 0x0000008C, 0x00000061, 0x00000044, 0x0000002E, 0x00000022, 0x00000022, 0x0000003E, 0x00000062, 0x00000039, 0x00000056, 0x0000003E, 0x0000001E, 0x0000002C, 0x0000003B, 0x00000032, 0x0000000D, 0x00000032, 0x0000004F, 0x0000004C, 0x00000043, 0x00000060, 0x00000032, 0x0000002D, 0x00000015, 0x00000055, 0x000000AE, 0x00000006, 0x0000005A, 0x00000022, 0x00000011, 0x00000053, 0x00000055, 0x0000002F, 0x0000001B, 0x0000001D, 0x00000013, 0x0000000B, 0x00000026, 0x00000038, 0x00000021, 0x00000059, 0x0000000A, 0x00000033, 0x00000052, 0x00000062, 0x0000000F, 0x00000018, 0x00000053, 0x0000002B, 0x0000002C, 0x0000008A, 0x00000001, 0x00000034, 0x00000049, 0x0000004D, 0x00000003, 0x00000025, 0x00000009, 0x0000003F, 0x00000018, 0x0000005D, 0x0000003C, 0x0000002C, 0x00000024, 0x00000044, 0x00000011, 0x00000001, 0x00000018, 0x00000028, 0x00000038, 0x0000003A, 0x0000004D, 0x0000001F, 0x00000045, 0x0000000F, 0x00000010, 0x00000034, 0x0000000C, 0x0000001A, 0x0000002E, 0x0000005E, 0x00000001, 0x00000031, 0x00000059, 0x00000006, 0x00000033, 0x00000039, 0x00000007, 0x00000005, 0x0000004A, 0x0000000B, 0x00000035, 0x00000062, 0x00000041, 0x0000001B, 0x00000015, 0x00000060, 0x00000031, 0x00000019, 0x00000027, 0x0000009C, 0x0000004D, 0x00000027, 0x0000004F, 0x0000004F, 0x00000021, 0x00000007, 0x00000038, 0x00000063, 0x00000032, 0x0000002A, 0x00000058, 0x0000000F, 0x0000002F, 0x0000005F, 0x00000015, 0x0000003B, 0x00000011, 0x0000004F, 0x0000005E, 0x0000002D, 0x00000005, 0x0000000F, 0x0000000E, 0x00000029, 0x00000042, 0x00000026, 0x0000003C, 0x00000013, 0x0000004F, 0x00000012, 0x0000002B, 0x00000041, 0x00000011, 0x00000009, 0x00000006, 0x00000041, 0x00000038, 0x0000000E, 0x00000007, 0x00000044, 0x0000002B, 0x00000001, 0x0000003E, 0x0000001A, 0x00000053, 0x00000043, 0x0000002C, 0x00000003, 0x0000000C, 0x00000032, 0x00000000, 0x0000004F, 0x0000000F, 0x0000005B, 0x00000060, 0x00000058, 0x00000047, 0x0000004B, 0x00000010, 0x00000006, 0x0000000A, 0x00000031, 0x00000047, 0x00000019, 0x00000010, 0x00000035, 0x0000000A, 0x0000004E, 0x00000006, 0x00000017, 0x00000007, 0x00000056, 0x0000004C, 0x0000003B, 0x00000058, 0x00000018, 0x00000018, 0x0000002E, 0x0000004B, 0x00000050, 0x00000008, 0x00000042, 0x0000001D, 0x0000002E, 0x00000059, 0x00000059, 0x00000034, 0x0000005E, 0x00000016, 0x00000042, 0x00000004, 0x00000012, 0x00000047, 0x00000020, 0x00000021, 0x00000002, 0x00000020, 0x00000034, 0x00000005, 0x00000078, 0x00000044, 0x00000015, 0x00000040, 0x00000060, 0x0000002A, 0x00000059, 0x00000027, 0x00000017, 0x00000062, 0x0000005B, 0x00000060, 0x00000017, 0x0000004B, 0x00000046, 0x00000008, 0x00000027, 0x00000055, 0x00000059, 0x00000042, 0x0000000B, 0x00000060, 0x0000001E, 0x00000058, 0x00000051, 0x00000096, 0x0000003D, 0x00000019, 0x00000032, 0x00000030, 0x00000055, 0x00000056, 0x00000056, 0x00000050, 0x00000041, 0x0000001C, 0x0000004C, 0x00000006, 0x00000000, 0x0000004C, 0x00000005, 0x0000002A, 0x00000018, 0x00000035, 0x00000012, 0x00000051, 0x00000003, 0x00000019, 0x00000052, 0x00000034, 0x00000046, 0x00000008, 0x0000000D, 0x00000056, 0x0000003A, 0x00000036, 0x00000049, 0x0000002B, 0x00000047, 0x00000046, 0x00000047, 0x00000015, 0x00000048, 0x00000053, 0x0000004A, 0x00000018, 0x00000024, 0x00000043, 0x00000009, 0x00000028, 0x00000018, 0x00000026, 0x0000000C, 0x00000036, 0x00000005, 0x00000070, 0x00000061, 0x0000004D, 0x00000011, 0x00000027, 0x00000023, 0x00000039, 0x00000013, 0x00000058, 0x00000043, 0x0000001D, 0x0000000B, 0x00000034, 0x0000000F, 0x00000019, 0x00000036, 0x00000025, 0x00000058, 0x00000043, 0x00000055, 0x00000058, 0x0000003A, 0x00000040, 0x00000053, 0x00000033, 0x00000052, 0x0000000A, 0x00000036, 0x00000059, 0x0000003B, 0x00000009, 0x00000031, 0x00000059, 0x0000004F, 0x00000056, 0x0000004D, 0x00000016, 0x00000054, 0x00000059, 0x0000001F, 0x0000001B, 0x00000041, 0x00000060, 0x0000000A, 0x00000051, 0x0000004C, 0x00000047, 0x00000011, 0x0000004E, 0x00000046, 0x0000007A, 0x0000000C, 0x0000003D, 0x00000019, 0x0000000E, 0x0000002C, 0x00000029, 0x0000004E, 0x00000017, 0x00000019, 0x0000003F, 0x00000007, 0x0000000B, 0x0000002E, 0x00000028, 0x00000052, 0x00000004, 0x0000005E, 0x0000005E, 0x0000005B, 0x00000007, 0x0000001D, 0x0000000C, 0x00000004, 0x00000000, 0x00000012, 0x00000022, 0x0000004E, 0x00000049, 0x00000025, 0x00000034, 0x00000047, 0x00000006, 0x00000037, 0x0000002D, 0x00000029, 0x00000002, 0x0000005E, 0x00000034, 0x00000030, 0x00000016, 0x00000016, 0x00000049, 0x0000003B, 0x00000001, 0x0000004C, 0x00000010, 0x00000041, 0x00000043, 0x0000001E, 0x00000022, 0x00000034, 0x0000005C, 0x00000021, 0x00000002, 0x0000005F, 0x00000018, 0x00000022, 0x0000000B, 0x00000026, 0x00000005, 0x00000002, 0x0000004A, 0x0000003B, 0x0000003C, 0x0000000B, 0x0000001C, 0x0000004B, 0x00000032, 0x0000005B, 0x00000015, 0x00000037, 0x00000022, 0x00000020, 0x0000005C, 0x000000C0, 0x0000005C, 0x00000028, 0x0000004B, 0x00000036, 0x00000010, 0x00000053, 0x0000005C, 0x0000001C, 0x00000051, 0x00000000, 0x0000004F, 0x00000051, 0x0000005B, 0x0000001A, 0x00000021, 0x00000052, 0x00000022, 0x0000003E, 0x0000000C, 0x0000000F, 0x0000001E, 0x00000034, 0x0000000D, 0x00000018, 0x0000001E, 0x0000004B, 0x00000030, 0x0000005C, 0x00000029, 0x00000014, 0x0000005A, 0x00000054, 0x0000002E, 0x00000027, 0x0000000E, 0x0000005F, 0x00000033, 0x0000001F, 0x0000001C, 0x00000036, 0x00000040, 0x0000003D, 0x00000040, 0x00000010, 0x0000005B, 0x00000044, 0x0000000A, 0x00000025, 0x00000042, 0x00000030, 0x00000004, 0x00000004, 0x00000010, 0x00000033, 0x0000005B, 0x00000009, 0x0000002E, 0x0000001A, 0x0000003B, 0x0000002D, 0x00000058, 0x00000059, 0x00000008, 0x0000005B, 0x00000022, 0x00000020, 0x00000000, 0x0000003A, 0x00000043, 0x0000002F, 0x0000002F, 0x0000000B, 0x00000054, 0x00000018, 0x0000008A]
second = [0x000006C6, 0x0000B350, 0x0000FB2A, 0x0000A846, 0x0000ABD5, 0x0000FBBA, 0x00000D20, 0x0000B2C4, 0x00000BD5, 0x0000A4F3, 0x00004064, 0x0000BDCF, 0x00008511, 0x00002911, 0x0000C4BD, 0x000065B6, 0x00007010, 0x00001F43, 0x000020F1, 0x00007268, 0x00006EF8, 0x00001524, 0x0000F6A8, 0x000003A2, 0x000037CB, 0x0000C40F, 0x00009720, 0x000013D2, 0x000003AA, 0x00004671, 0x0000C1FC, 0x00002147, 0x0000F9EF, 0x0000B8AA, 0x000081EF, 0x00001F7A, 0x0000DEAA, 0x000089BF, 0x0000C101, 0x00002992, 0x0000E50D, 0x000080D5, 0x0000A7C2, 0x000005D2, 0x000009DF, 0x0000AE25, 0x0000CB5E, 0x0000A5A9, 0x00009763, 0x0000BAF2, 0x000086F8, 0x00009BFC, 0x00004435, 0x000070B3, 0x0000AB91, 0x000044F4, 0x00004495, 0x0000E241, 0x000043C9, 0x0000CC02, 0x0000A778, 0x00005031, 0x00009994, 0x0000DBE1, 0x0000E6CC, 0x0000F905, 0x00007ED4, 0x0000713A, 0x00001E87, 0x0000A621, 0x0000E3C5, 0x00002DCF, 0x000095C2, 0x0000F961, 0x0000A7E3, 0x0000FAD7, 0x00002244, 0x0000E219, 0x00007FFC, 0x00004CCD, 0x000005B2, 0x00003594, 0x0000F6DD, 0x00006037, 0x00002C8F, 0x000005B3, 0x00003DB5, 0x00005361, 0x00009025, 0x0000DB95, 0x0000B3C9, 0x00006450, 0x0000AE6E, 0x0000F74F, 0x0000B761, 0x0000F9D0, 0x000000A9, 0x0000F10C, 0x0000ECBD, 0x0000C698, 0x00000C22, 0x00007EB8, 0x0000EAA5, 0x0000AB78, 0x0000437F, 0x0000BF50, 0x00009DA0, 0x000070E1, 0x0000DBE8, 0x00009B40, 0x0000B9A5, 0x0000CBF4, 0x0000E492, 0x0000B5F6, 0x0000919F, 0x00004B33, 0x00009EEF, 0x00005E9A, 0x0000FFC0, 0x00000AB7, 0x0000F3BF, 0x00008283, 0x000041DF, 0x00007773, 0x000081B4, 0x0000BA07, 0x00000FD6, 0x00008FD3, 0x00005D0F, 0x000033B1, 0x0000F5B0, 0x0000FFBB, 0x000047B5, 0x0000E9F7, 0x0000D783, 0x0000A9E6, 0x000096C1, 0x00001816, 0x0000C30A, 0x0000A3CD, 0x00007884, 0x0000B1EC, 0x00000C61, 0x00000F77, 0x0000B14A, 0x00008AFF, 0x0000C779, 0x0000626D, 0x0000D759, 0x00006C81, 0x0000CC5D, 0x0000BD1A, 0x000095F5, 0x00005D61, 0x00009C9E, 0x00006293, 0x00002911, 0x00009758, 0x0000B6D0, 0x00005BD4, 0x00003B98, 0x0000DC7F, 0x0000F27C, 0x00009816, 0x0000DE49, 0x00008575, 0x0000D547, 0x00006E36, 0x00008635, 0x00003E95, 0x0000D8C6, 0x000024C7, 0x00006B58, 0x00009CEF, 0x0000EA8C, 0x0000582C, 0x0000C9E0, 0x0000BD3D, 0x0000BC4E, 0x0000D00C, 0x00003C61, 0x0000C9F7, 0x0000E213, 0x00004893, 0x000051C6, 0x0000A72F, 0x0000E1F4, 0x0000F767, 0x00001A78, 0x00008D4F, 0x0000423B, 0x0000DA35, 0x0000ED13, 0x0000228B, 0x0000CD29, 0x00009F34, 0x0000997D, 0x00005D1E, 0x0000C18A, 0x00006159, 0x00006986, 0x00003C38, 0x0000A076, 0x0000FC28, 0x00006FC4, 0x00008751, 0x000096E0, 0x0000FAFD, 0x000052C6, 0x00004906, 0x00001173, 0x0000045C, 0x0000DD70, 0x000045F3, 0x00005044, 0x000092AE, 0x0000428A, 0x000029D8, 0x0000C652, 0x0000679D, 0x0000213F, 0x0000BF03, 0x0000F0C1, 0x00000E6A, 0x0000BDD8, 0x00004591, 0x0000B5B9, 0x00002558, 0x0000A92D, 0x0000C886, 0x0000C02F, 0x000089CF, 0x00005395, 0x0000C578, 0x00002078, 0x00004ADF, 0x0000C6FF, 0x00006EC1, 0x00004A15, 0x00001309, 0x0000FDED, 0x0000468C, 0x00008FEB, 0x0000AEEA, 0x0000D873, 0x00001B87, 0x0000E75B, 0x000080B5, 0x0000236D, 0x00007097, 0x00006857, 0x00006B43, 0x000002BC, 0x000091EA, 0x0000B01D, 0x0000777A, 0x0000B692, 0x00003918, 0x0000D1CF, 0x0000959E, 0x00000572, 0x000059C7, 0x0000D4FA, 0x0000D9AB, 0x0000904F, 0x00005D27, 0x0000396C, 0x00004B82, 0x000085F2, 0x0000A2F0, 0x0000C88A, 0x000088E5, 0x0000F4E2, 0x00006988, 0x00006496, 0x00004035, 0x00003D0E, 0x000015DC, 0x0000B6DD, 0x0000CBE4, 0x00002D92, 0x0000418F, 0x00009AD4, 0x0000AEDC, 0x0000FA46, 0x000025E7, 0x000022A8, 0x0000AEE5, 0x00001798, 0x0000DFBD, 0x0000CD93, 0x0000058E, 0x000027DC, 0x0000EAFF, 0x0000AB5A, 0x000037AB, 0x0000B78F, 0x00005E02, 0x00008E73, 0x00003AEC, 0x0000F80C, 0x0000711A, 0x0000914C, 0x0000DD62, 0x0000E2D3, 0x00006DFE, 0x00003597, 0x000025C5, 0x0000AD18, 0x0000E45F, 0x00003808, 0x0000EB56, 0x000033EA, 0x00006D19, 0x0000FBCC, 0x0000A388, 0x0000B0FD, 0x0000C271, 0x0000ED90, 0x00004095, 0x0000440F, 0x0000262D, 0x0000B512, 0x0000623A, 0x00006410, 0x000062A5, 0x00006995, 0x0000A000, 0x0000BAF9, 0x0000E445, 0x00002465, 0x0000A65E, 0x0000B603, 0x0000C209, 0x0000B159, 0x00006C32, 0x0000011D, 0x00003C2E, 0x0000B23D, 0x0000B479, 0x00009D4F, 0x0000EF2F, 0x0000833E, 0x0000FE0F, 0x00002EB3, 0x00008B7B, 0x000061DB, 0x00001DC6, 0x00006534, 0x000037F1, 0x0000908F, 0x00000D7D, 0x0000D25A, 0x0000C690, 0x00000B29, 0x00003220, 0x0000097F, 0x0000321A, 0x0000CAC4, 0x000007AB, 0x000073AE, 0x0000DB4E, 0x00004A65, 0x000096A0, 0x000064F0, 0x00005F45, 0x00001E77, 0x00002DE3, 0x0000DD0C, 0x0000A4C8, 0x000033DF, 0x0000FACF, 0x000029B1, 0x000007CB, 0x000024AB, 0x00002A19, 0x000043F2, 0x00003293, 0x0000C952, 0x000083EE, 0x00000E01, 0x0000424C, 0x00002CCC, 0x000021CB, 0x0000701F, 0x00004A27, 0x00004E30, 0x00004ADC, 0x00000846, 0x0000DA65, 0x0000E1F1, 0x0000D6CF, 0x000015C1, 0x0000ED78, 0x0000CFF2, 0x00001C69, 0x0000EF05, 0x0000DD53, 0x00002BB9, 0x00001401, 0x00000EFD, 0x00007031, 0x0000EFD9, 0x00005790, 0x000014B8, 0x0000A5C6, 0x0000FA73, 0x00001F8C, 0x00006171, 0x0000A46B, 0x0000C524, 0x00008A78, 0x00002DC3, 0x000061BC, 0x000004A2, 0x0000DDC4, 0x000073C4, 0x00008C50, 0x0000CFBC, 0x00003388, 0x000073F0, 0x0000E94C, 0x000085CE, 0x000020BC, 0x00008F08, 0x000067E7, 0x0000E5C8, 0x000069BD, 0x000046BF, 0x000069E4, 0x0000F024, 0x0000F5BB, 0x0000AB91, 0x00000C32, 0x000057E8, 0x0000CC30, 0x0000C68A, 0x0000A5F3, 0x0000EFBF, 0x00005F74, 0x00000E7F, 0x0000397F, 0x0000F02B, 0x00002E51, 0x00000FFE, 0x000032CE, 0x0000F66A, 0x0000A69D, 0x000093B1, 0x0000E53F, 0x0000F854, 0x000060B8, 0x0000A7A2, 0x0000EF57, 0x00006A86, 0x0000C3CA, 0x000093E4, 0x0000B2F1, 0x00000590, 0x00008CC5, 0x0000EEB7, 0x0000663D, 0x00006311, 0x0000DB16, 0x00009294, 0x00008299, 0x000000BD, 0x0000FCA1, 0x0000D53F, 0x00007E60, 0x0000FF44, 0x0000A42C, 0x0000A8F1, 0x00005175, 0x0000E9A0, 0x0000EB14, 0x0000DB64, 0x0000B072, 0x00003179, 0x000059D2, 0x0000B7FF, 0x00002EE0, 0x0000FD00, 0x000042FD, 0x000017FB, 0x0000A871, 0x0000D3CE, 0x000073B9, 0x0000532C, 0x00002449, 0x000045A8, 0x0000E49A, 0x0000C3CB, 0x00004497, 0x00005841, 0x000011D7, 0x00007D08, 0x000046C3, 0x0000CF5E, 0x0000705C, 0x0000C024, 0x0000D07C, 0x00007F16, 0x00009D97, 0x00003E91, 0x0000249F, 0x0000E9A7, 0x000014E5, 0x00008C35, 0x00007A6D, 0x0000F3E9, 0x0000B8F6, 0x0000DCDD, 0x0000449D, 0x0000A524, 0x00000F38, 0x00004510, 0x0000589D, 0x000078A1, 0x00004ABA, 0x0000A3E5, 0x000009D3, 0x0000F34B, 0x00005705, 0x0000DA4D, 0x00003330, 0x00001949, 0x00002949, 0x0000CE6C, 0x00005299, 0x00000340, 0x0000C795, 0x000098C2, 0x0000D611, 0x00006212, 0x0000B043, 0x00003253, 0x0000FCF1, 0x0000593C, 0x00003496, 0x000008D5, 0x0000F597, 0x00007436, 0x0000E146, 0x0000CE9A, 0x0000FDF3, 0x0000B57C, 0x000059AA, 0x00008F34, 0x00006A4E, 0x000022F9, 0x0000DB15, 0x000002CA, 0x00001DE0, 0x00001E5B, 0x00003A0F, 0x0000AB47, 0x00007280, 0x000016BD, 0x0000826B, 0x0000FFEF, 0x000069A4, 0x00000E62, 0x0000674E, 0x0000CDC3, 0x00002381, 0x00001187, 0x000012CC, 0x0000D668, 0x00004DCF, 0x000089AC, 0x000075B6, 0x000095CD, 0x00001915, 0x0000D51E, 0x000078B2]
third = [-115, 0, 15, 1, -21, 49, -24, 5, 42, -2, -16, -9, 40, 46, 56, -34, 16, -25, 39, 26, 23, 42, -56, 0, -31, -15, 7, -14, 11, 22, 13, -33, -9, 40, 31, 54, -19, -26, -20, 12, 30, 14, 44, -14, 49, -4, -4, 25, 53, 8, -45, 20, -5, 58, 16, -15, 18, 59, 45, 23, 50, 51, -33, 11, 46, -34, -15, -9, -46, -50, 3, -35, 9, 39, -13, -127, 19, -40, 30, 21, -40, 32, 37, -20, 30, 30, 29, 25, 3, 18, -12, -58, -44, -76, 39, -55, -18, -34, 4, -16, -19, -9, -4, -35, 31, -32, 0, 59, 5, 23, 29, -40, -30, -1, 54, -13, -1, -31, 36, 56, 17, 16, -40, 18, 9, -129, 36, -33, 0, -23, 23, 43, 3, 30, 10, -4, -40, 3, -42, -40, 10, -22, 28, -36, 24, -6, -20, -2, -25, 17, -53, -6, -18, 49, -16, 14, -1, 27, -12, -72, -10, -38, -4, 0, 53, 26, 23, -28, 56, 26, 2, 57, -38, -18, 14, -123, 48, 38, -29, -12, -12, 18, -38, 31, 59, -27, -44, -56, 27, -33, -29, 19, 54, 22, -14, -29, 16, -31, 46, 30, -34, 72, -94, 24, 41, 52, -9, -13, -33, -9, 56, -5, 25, 54, 3, 43, -13, 49, 56, 36, 43, -27, 53, -15, 7, -94, 83, -28, -28, 31, 23, -29, 44, -40, -31, 3, 0, 58, 60, -42, -40, -27, 55, 46, -36, -22, -45, 25, -9, 22, 24, -2, 12, -30, 35, 32, 11, -2, 29, -32, -33, 42, -53, 22, -34, -30, 33, -2, 2, 23, -28, 58, -95, -7, 20, 23, -16, 57, -12, -75, -3, 19, -26, 58, 49, -19, 45, 33, 57, 21, 47, 16, 18, 15, -22, 6, 59, -12, -25, 45, 39, 1, 27, -2, 41, -73, 25, 6, 8, -24, 9, 11, -29, 40, -26, 26, -77, -45, -88, -30, -95, 34, -28, 1, -40, -113, 2, 6, -6, -4, -34, 27, -37, -12, -11, 35, 27, 2, 9, 13, -31, -6, 12, -14, -16, -10, 34, -9, 25, -19, -115, -9, -22, -1, 9, 41, -46, -53, -60, 28, -36, -22, 18, 34, 25, 48, 50, 27, -51, -24, 45, 71, -38, -15, 32, 51, -24, 15, 45, 5, -55, 23, 8, 38, 43, 19, 22, -39, -37, -14, -4, -34, 8, -19, -13, 43, -36, -39, 28, 24, 63, -54, 8, -23, -27, -50, 34, 36, 38, -5, 40, -3, -8, -6, 35, -17, 26, 35, 30, -19, -37, 8, 0, -29, -57, -61, -54, 0, -16, 59, -13, -39, -14, -26, 55, 0, 58, 24, 39, 21, 44, -22, 22, -38, -17, 3, 57, -20, -10, 2, 14, -10, 21, -40, 8, 21, -30, -18, -35, -21, -3, -3, -8, 45, -28, 8, 20, -38, -29, -40, -40, 69, 20, -19, 28, 22, 15, 13, -34, -26, -29, -19, -32, -14, 38, -37, 27, 54, -30, -38, 56, 39, -15, 43, -35, -3, 31, -53, -9, -47, -58, 3, 12, 25, 45, 52, -38, -10, 14, -17, -29, 12, 41, 23, -39, 16, -30, 5, 3, 27, 5, 21, 16, 41, 33, -128, 17, 23, 34, 51, 23, 22, 20, -2, 39, 55, 14, 40, 48, 56, 57, 4, 37, -23, 27, 2, 5, 35, 27, -16, -66, -39, 15, 40, -24, -29, -2, -5, 54, -25, 20, 59, -8, 8, -11, -4, 15, 58, 42, -38, -11, 31, 50, 6, 37, -56]
fourth = [-147, 0, 15, 1, -21, 49, -24, 5, 42, -2, -16, -9, 40, 46, 56, -34, 16, -25, 39, 26, 23, 42, -16, -2, -29, -62, 17, -14, 11, 22, 13, -33, -9, 40, 31, 54, -19, -26, -20, 12, 30, 14, 44, -14, 49, 54, 43, 23, 48, -39, -43, 22, -53, 58, 16, -15, 18, 59, 45, 23, 50, 51, -33, 11, 46, -34, -15, 46, 1, -3, 8, -30, -49, 41, -60, -125, -28, -68, -21, 21, -40, 32, 37, -20, 30, 30, 29, 25, 3, -3, 35, -11, 3, -29, 37, -2, -18, -67, 6, -63, -66, -7, -51, -63, -11, -32, 0, 59, 5, 23, 29, 14, -36, 46, 52, -8, -3, 10, 36, 56, 17, 16, -40, 11, -38, -134, 31, -31, -5, -26, 23, 43, 3, 30, 57, -6, 7, 8, 5, -12, 50, -22, 28, -36, 24, -6, -65, -49, -72, 12, -51, -11, -19, 49, 4, -42, -1, 27, -12, -37, 37, -33, 43, -2, 58, 57, 23, -28, 8, 28, -45, 10, -43, -12, -23, -123, 48, 1, -26, -84, -59, 17, -38, 31, 55, -29, -39, -9, 25, -35, -26, 23, 56, -25, -61, -76, 13, -31, 46, 6, -44, 49, -85, -6, -6, 5, -7, -32, -33, -9, 34, 42, 23, 52, 1, 41, -18, 51, 51, -16, 43, -52, -2, -34, -65, -166, 53, -35, -22, 33, -24, -76, -3, -19, -31, 3, 7, 56, 58, 5, -45, -43, 55, -8, -16, 36, -36, -47, 0, 33, 23, -2, 12, -77, -12, 55, 2, 0, 1, -39, -33, 42, -19, 50, -34, -30, 37, -27, -23, -2, 28, 44, -37, -7, 20, 23, -16, 57, -12, -34, -17, 31, -11, 58, 49, -19, 45, 33, 57, 21, 27, -6, -9, 4, 11, -39, 11, -39, -48, 22, 16, -22, 4, -1, -7, -49, 2, -14, -15, -24, 9, 11, -29, 40, -26, 26, -57, -59, -55, 3, -62, -14, -57, -27, -63, -136, -21, 36, 17, -27, -64, 27, -37, -12, 9, 45, 27, 2, 9, 13, -31, 14, 56, -34, -36, 23, -14, -57, 5, -42, -128, -15, -35, -1, 9, 41, -16, -33, -40, 12, -36, -22, 18, 34, 25, 48, 50, 27, -24, -2, -3, 34, -61, -37, 32, 51, -24, 15, 33, 28, -32, 46, 31, 22, 43, 19, 22, -39, -37, -14, -4, -34, 8, -7, -53, 11, -59, -84, 28, 24, 39, -31, 31, 0, -4, -30, 19, 36, 36, -28, 17, -26, -31, -29, 12, -46, 26, 47, 7, -30, -37, 8, 25, -9, -34, -41, -31, 23, 28, 59, -13, -39, -16, -49, 32, -23, 35, 1, 16, -8, 44, -30, 22, -38, -17, 3, 39, 3, 13, 25, 37, 13, 46, -40, 8, 21, -30, -18, -55, -44, -26, -26, -31, 31, -28, 8, 20, -38, -29, -40, -40, 49, 46, 11, 51, 45, 38, 36, 16, -26, -52, -42, -55, -37, 15, -67, 27, 54, -30, -38, 56, 39, -15, 43, -35, -3, 31, -14, 14, -24, -35, 26, 35, 48, 22, 29, -58, -30, -29, -17, -29, 12, 41, 23, -39, 16, -30, 5, 3, 27, 5, 21, 16, 18, 56, -105, 40, 46, 11, 28, 45, 22, 20, -2, 39, 55, 14, 40, 48, 56, 57, 4, 37, -23, 27, 2, 5, 35, 27, -35, -43, -16, -19, 40, -24, -29, -2, -5, 54, -25, 20, 59, -8, 8, -11, -4, 15, 58, 42, -38, -11, 31, 50, 6, 37, -7]
def matrix_multiply(a1, a2, a3):
for i in range(24):
for j in range(24):
v4 = 0
for k in range(24):
v4 += a2[24 * k + j] * a1[24 * i + k]
a3[24 * i + j] = v4 % 0xFFFF
return a3
def modular_matrix(a1, a2, a3):
for i in range(24):
for j in range(24):
a3[i * 0x18 + j] = (a1[i * 0x18 + j] + a2[i * 0x18 + j]) % 0xffff
return a3
def rotate_matrix_counter_clockwise(buf):
size = 24
for i in range(12):
for j in range(i, 24 - i - 1):
temp = buf[size * j + i]
buf[size * j + i] = buf[size * i + (size - 1 - j)]
buf[size * i + (size - 1 - j)] = buf[size * (size - 1 - j) + (size - 1 - i)]
buf[size * (size - 1 - j) + (size - 1 - i)] = buf[size * (size - 1 - i) + j]
buf[size * (size - 1 - i) + j] = temp
return buf
def rotate_matrix_clockwise(buf):
size = 24
for i in range(12):
for j in range(i, size - i - 1):
temp = buf[24 * j + i]
buf[24 * j + i] = buf[24 * (size - i - 1) + j]
buf[24 * (size - i - 1) + j] = buf[24 * (size - j - 1) + (size - i - 1)]
buf[24 * (size - j - 1) + (size - i - 1)] = buf[24 * i + (size - j - 1)]
buf[24 * i + (size - j - 1)] = temp
return buf
def calculate(a1, a2):
for i in range(24):
for j in range(24):
a2[24 * i + j] = a1[26 * i + 53 + j] + a1[26 * i + 52 + j] + a1[26 * i + 28 + j] + a1[26 * i + 27 + j] + a1[26 * i + 26 + j] + a1[26 * i + 2 + j] + a1[26 * i + 1 + j] + a1[26 * i + j] + a1[26 * i + 54 + j]
return a2
buf = [0] * 676
buf1 = [0] * 576
buf2 = [0] * 576
buf3 = [0] * 576
buf4 = [0] * 576
buf5 = [0] * 576
buf6 = [0] * 576
buf7 = [0] * 576
buf8 = [0] * 576
for i in range(12):
if i & 1:
buf1[24 * (23 - i) + i] = 1
v3 = 23 - i
v4 = 24 * i
else:
buf1[25 * i] = 1
v3 = 23 - i
v4 = 24 * v3
buf1[v3 + v4] = 1
flag = b'b' * 484
print(flag)
cnt = 0
for j in range(2, 24, 1):
for k in range(2, 24, 1):
idx = cnt
cnt += 1
buf[26 * j + k] = flag[idx]
codegate = b'C0D3GAT3'
for m in range(1, 25, 1):
for n in range(1, 25, 1):
if buf[26 * m + n] == 0:
buf[26 * m + n] = codegate[(n - 1 + m - 1) % 8]
buf2 = calculate(buf, buf2)
buf2 = rotate_matrix_clockwise(buf2)
buf3 = matrix_multiply(buf2, buf1, buf3)
buf2 = matrix_multiply(buf1, buf3, buf2)
buf2 = rotate_matrix_counter_clockwise(buf2)
buf4 = modular_matrix(buf2, first, buf4)
buf5 = matrix_multiply(buf4, second, buf5)
buf6 = modular_matrix(buf5, third, buf6)
buf7 = modular_matrix(buf5, fourth, buf7)
print((buf6))
cmp = [0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000013, 0x0000003D, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000001, 0x0000000C, 0x0000003D, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000004, 0x0000000C, 0x0000000C, 0x00000036, 0x00000036, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000050, 0x0000000C, 0x0000000C, 0x0000000C, 0x0000000C, 0x0000003D, 0x00000006, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000005, 0x00000041, 0x0000000C, 0x0000003D, 0x00000036, 0x0000003D, 0x00000012, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000000C, 0x0000003D, 0x0000000C, 0x00000036, 0x0000000C, 0x0000001F, 0x00000013, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004F, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000018, 0x0000000C, 0x00000036, 0x0000000C, 0x0000003D, 0x00000036, 0x0000001C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003E, 0x00000054, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003F, 0x0000003D, 0x00000036, 0x0000000C, 0x0000003D, 0x0000003D, 0x00000038, 0x00000037, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000016, 0x00000054, 0x00000003, 0x00000054, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000051, 0x0000000C, 0x0000003D, 0x0000003D, 0x0000003D, 0x0000003D, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000043, 0x00000054, 0x00000054, 0x00000054, 0x00000054, 0x00000044, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000034, 0x0000003D, 0x0000003D, 0x0000000C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000029, 0x00000003, 0x00000003, 0x00000054, 0x00000003, 0x00000032, 0x0000003C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000026, 0x00000046, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000019, 0x0000001F, 0x0000003B, 0x0000003B, 0x00000037, 0x00000054, 0x00000054, 0x00000054, 0x00000003, 0x00000049, 0x00000001, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000012, 0x00000049, 0x0000002F, 0x0000002C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003D, 0x00000042, 0x0000002F, 0x00000003, 0x00000054, 0x00000054, 0x0000003F, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000026, 0x00000054, 0x0000000C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000010, 0x00000032, 0x00000003, 0x00000003, 0x00000003, 0x00000054, 0x00000041, 0x00000040, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000006, 0x00000010, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000027, 0x00000031, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000000D, 0x00000032, 0x00000042, 0x00000003, 0x00000054, 0x00000054, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000001D, 0x00000027, 0x00000027, 0x0000004B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000020, 0x00000032, 0x00000054, 0x00000049, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000047, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x0000004B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004C, 0x00000044, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000053, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000027, 0x0000004A, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000022, 0x00000027, 0x00000024, 0x00000027, 0x00000024, 0x00000024, 0x0000000F, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004D, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000022, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004F, 0x00000021, 0x0000001D, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000009, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000014, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000052, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004E, 0x00000024, 0x00000024, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000000A]
for ii in range(24):
for jj in range(24):
if buf6[24 * ii + jj] != cmp[24 * ii + jj]:
print("Wrong")
exit(1)Remember that the third_buf and fourth_buf are literally negative number arrays. Last step is reverse each step. My solve script
from sage.all import *
buf = [0] * 676
buf1 = [0] * 576
buf2 = [0] * 576
buf3 = [0] * 576
buf4 = [0] * 576
buf5 = [0] * 576
buf6 = [0] * 576
buf7 = [0] * 576
buf8 = [0] * 576
first = [0x00000054, 0x00000012, 0x00000002, 0x00000002, 0x0000004C, 0x00000041, 0x00000033, 0x00000051, 0x0000003F, 0x0000000C, 0x00000006, 0x00000018, 0x00000040, 0x00000043, 0x00000034, 0x00000047, 0x0000005F, 0x00000022, 0x00000062, 0x00000021, 0x0000005E, 0x0000001A, 0x00000027, 0x0000004D, 0x00000033, 0x00000056, 0x00000048, 0x0000002C, 0x00000010, 0x00000004, 0x00000049, 0x00000002, 0x0000001C, 0x00000028, 0x0000004D, 0x0000001C, 0x0000003F, 0x0000002B, 0x00000017, 0x00000019, 0x00000027, 0x00000042, 0x00000052, 0x00000046, 0x0000003C, 0x00000000, 0x00000039, 0x00000041, 0x00000029, 0x00000009, 0x00000062, 0x00000027, 0x00000015, 0x00000017, 0x0000001A, 0x0000001D, 0x00000019, 0x00000048, 0x00000056, 0x00000012, 0x00000000, 0x00000004, 0x00000037, 0x0000004A, 0x0000003F, 0x00000000, 0x0000004B, 0x00000019, 0x0000003F, 0x00000037, 0x00000039, 0x00000024, 0x0000000E, 0x00000059, 0x00000015, 0x000000B8, 0x00000011, 0x0000003D, 0x00000009, 0x00000021, 0x00000046, 0x00000025, 0x00000063, 0x0000003F, 0x00000004, 0x00000017, 0x00000059, 0x0000005F, 0x0000003E, 0x00000061, 0x00000051, 0x0000001E, 0x00000052, 0x00000036, 0x00000001, 0x0000001B, 0x00000025, 0x0000000C, 0x00000013, 0x0000003A, 0x0000008C, 0x00000061, 0x00000044, 0x0000002E, 0x00000022, 0x00000022, 0x0000003E, 0x00000062, 0x00000039, 0x00000056, 0x0000003E, 0x0000001E, 0x0000002C, 0x0000003B, 0x00000032, 0x0000000D, 0x00000032, 0x0000004F, 0x0000004C, 0x00000043, 0x00000060, 0x00000032, 0x0000002D, 0x00000015, 0x00000055, 0x000000AE, 0x00000006, 0x0000005A, 0x00000022, 0x00000011, 0x00000053, 0x00000055, 0x0000002F, 0x0000001B, 0x0000001D, 0x00000013, 0x0000000B, 0x00000026, 0x00000038, 0x00000021, 0x00000059, 0x0000000A, 0x00000033, 0x00000052, 0x00000062, 0x0000000F, 0x00000018, 0x00000053, 0x0000002B, 0x0000002C, 0x0000008A, 0x00000001, 0x00000034, 0x00000049, 0x0000004D, 0x00000003, 0x00000025, 0x00000009, 0x0000003F, 0x00000018, 0x0000005D, 0x0000003C, 0x0000002C, 0x00000024, 0x00000044, 0x00000011, 0x00000001, 0x00000018, 0x00000028, 0x00000038, 0x0000003A, 0x0000004D, 0x0000001F, 0x00000045, 0x0000000F, 0x00000010, 0x00000034, 0x0000000C, 0x0000001A, 0x0000002E, 0x0000005E, 0x00000001, 0x00000031, 0x00000059, 0x00000006, 0x00000033, 0x00000039, 0x00000007, 0x00000005, 0x0000004A, 0x0000000B, 0x00000035, 0x00000062, 0x00000041, 0x0000001B, 0x00000015, 0x00000060, 0x00000031, 0x00000019, 0x00000027, 0x0000009C, 0x0000004D, 0x00000027, 0x0000004F, 0x0000004F, 0x00000021, 0x00000007, 0x00000038, 0x00000063, 0x00000032, 0x0000002A, 0x00000058, 0x0000000F, 0x0000002F, 0x0000005F, 0x00000015, 0x0000003B, 0x00000011, 0x0000004F, 0x0000005E, 0x0000002D, 0x00000005, 0x0000000F, 0x0000000E, 0x00000029, 0x00000042, 0x00000026, 0x0000003C, 0x00000013, 0x0000004F, 0x00000012, 0x0000002B, 0x00000041, 0x00000011, 0x00000009, 0x00000006, 0x00000041, 0x00000038, 0x0000000E, 0x00000007, 0x00000044, 0x0000002B, 0x00000001, 0x0000003E, 0x0000001A, 0x00000053, 0x00000043, 0x0000002C, 0x00000003, 0x0000000C, 0x00000032, 0x00000000, 0x0000004F, 0x0000000F, 0x0000005B, 0x00000060, 0x00000058, 0x00000047, 0x0000004B, 0x00000010, 0x00000006, 0x0000000A, 0x00000031, 0x00000047, 0x00000019, 0x00000010, 0x00000035, 0x0000000A, 0x0000004E, 0x00000006, 0x00000017, 0x00000007, 0x00000056, 0x0000004C, 0x0000003B, 0x00000058, 0x00000018, 0x00000018, 0x0000002E, 0x0000004B, 0x00000050, 0x00000008, 0x00000042, 0x0000001D, 0x0000002E, 0x00000059, 0x00000059, 0x00000034, 0x0000005E, 0x00000016, 0x00000042, 0x00000004, 0x00000012, 0x00000047, 0x00000020, 0x00000021, 0x00000002, 0x00000020, 0x00000034, 0x00000005, 0x00000078, 0x00000044, 0x00000015, 0x00000040, 0x00000060, 0x0000002A, 0x00000059, 0x00000027, 0x00000017, 0x00000062, 0x0000005B, 0x00000060, 0x00000017, 0x0000004B, 0x00000046, 0x00000008, 0x00000027, 0x00000055, 0x00000059, 0x00000042, 0x0000000B, 0x00000060, 0x0000001E, 0x00000058, 0x00000051, 0x00000096, 0x0000003D, 0x00000019, 0x00000032, 0x00000030, 0x00000055, 0x00000056, 0x00000056, 0x00000050, 0x00000041, 0x0000001C, 0x0000004C, 0x00000006, 0x00000000, 0x0000004C, 0x00000005, 0x0000002A, 0x00000018, 0x00000035, 0x00000012, 0x00000051, 0x00000003, 0x00000019, 0x00000052, 0x00000034, 0x00000046, 0x00000008, 0x0000000D, 0x00000056, 0x0000003A, 0x00000036, 0x00000049, 0x0000002B, 0x00000047, 0x00000046, 0x00000047, 0x00000015, 0x00000048, 0x00000053, 0x0000004A, 0x00000018, 0x00000024, 0x00000043, 0x00000009, 0x00000028, 0x00000018, 0x00000026, 0x0000000C, 0x00000036, 0x00000005, 0x00000070, 0x00000061, 0x0000004D, 0x00000011, 0x00000027, 0x00000023, 0x00000039, 0x00000013, 0x00000058, 0x00000043, 0x0000001D, 0x0000000B, 0x00000034, 0x0000000F, 0x00000019, 0x00000036, 0x00000025, 0x00000058, 0x00000043, 0x00000055, 0x00000058, 0x0000003A, 0x00000040, 0x00000053, 0x00000033, 0x00000052, 0x0000000A, 0x00000036, 0x00000059, 0x0000003B, 0x00000009, 0x00000031, 0x00000059, 0x0000004F, 0x00000056, 0x0000004D, 0x00000016, 0x00000054, 0x00000059, 0x0000001F, 0x0000001B, 0x00000041, 0x00000060, 0x0000000A, 0x00000051, 0x0000004C, 0x00000047, 0x00000011, 0x0000004E, 0x00000046, 0x0000007A, 0x0000000C, 0x0000003D, 0x00000019, 0x0000000E, 0x0000002C, 0x00000029, 0x0000004E, 0x00000017, 0x00000019, 0x0000003F, 0x00000007, 0x0000000B, 0x0000002E, 0x00000028, 0x00000052, 0x00000004, 0x0000005E, 0x0000005E, 0x0000005B, 0x00000007, 0x0000001D, 0x0000000C, 0x00000004, 0x00000000, 0x00000012, 0x00000022, 0x0000004E, 0x00000049, 0x00000025, 0x00000034, 0x00000047, 0x00000006, 0x00000037, 0x0000002D, 0x00000029, 0x00000002, 0x0000005E, 0x00000034, 0x00000030, 0x00000016, 0x00000016, 0x00000049, 0x0000003B, 0x00000001, 0x0000004C, 0x00000010, 0x00000041, 0x00000043, 0x0000001E, 0x00000022, 0x00000034, 0x0000005C, 0x00000021, 0x00000002, 0x0000005F, 0x00000018, 0x00000022, 0x0000000B, 0x00000026, 0x00000005, 0x00000002, 0x0000004A, 0x0000003B, 0x0000003C, 0x0000000B, 0x0000001C, 0x0000004B, 0x00000032, 0x0000005B, 0x00000015, 0x00000037, 0x00000022, 0x00000020, 0x0000005C, 0x000000C0, 0x0000005C, 0x00000028, 0x0000004B, 0x00000036, 0x00000010, 0x00000053, 0x0000005C, 0x0000001C, 0x00000051, 0x00000000, 0x0000004F, 0x00000051, 0x0000005B, 0x0000001A, 0x00000021, 0x00000052, 0x00000022, 0x0000003E, 0x0000000C, 0x0000000F, 0x0000001E, 0x00000034, 0x0000000D, 0x00000018, 0x0000001E, 0x0000004B, 0x00000030, 0x0000005C, 0x00000029, 0x00000014, 0x0000005A, 0x00000054, 0x0000002E, 0x00000027, 0x0000000E, 0x0000005F, 0x00000033, 0x0000001F, 0x0000001C, 0x00000036, 0x00000040, 0x0000003D, 0x00000040, 0x00000010, 0x0000005B, 0x00000044, 0x0000000A, 0x00000025, 0x00000042, 0x00000030, 0x00000004, 0x00000004, 0x00000010, 0x00000033, 0x0000005B, 0x00000009, 0x0000002E, 0x0000001A, 0x0000003B, 0x0000002D, 0x00000058, 0x00000059, 0x00000008, 0x0000005B, 0x00000022, 0x00000020, 0x00000000, 0x0000003A, 0x00000043, 0x0000002F, 0x0000002F, 0x0000000B, 0x00000054, 0x00000018, 0x0000008A]
second = [0x000006C6, 0x0000B350, 0x0000FB2A, 0x0000A846, 0x0000ABD5, 0x0000FBBA, 0x00000D20, 0x0000B2C4, 0x00000BD5, 0x0000A4F3, 0x00004064, 0x0000BDCF, 0x00008511, 0x00002911, 0x0000C4BD, 0x000065B6, 0x00007010, 0x00001F43, 0x000020F1, 0x00007268, 0x00006EF8, 0x00001524, 0x0000F6A8, 0x000003A2, 0x000037CB, 0x0000C40F, 0x00009720, 0x000013D2, 0x000003AA, 0x00004671, 0x0000C1FC, 0x00002147, 0x0000F9EF, 0x0000B8AA, 0x000081EF, 0x00001F7A, 0x0000DEAA, 0x000089BF, 0x0000C101, 0x00002992, 0x0000E50D, 0x000080D5, 0x0000A7C2, 0x000005D2, 0x000009DF, 0x0000AE25, 0x0000CB5E, 0x0000A5A9, 0x00009763, 0x0000BAF2, 0x000086F8, 0x00009BFC, 0x00004435, 0x000070B3, 0x0000AB91, 0x000044F4, 0x00004495, 0x0000E241, 0x000043C9, 0x0000CC02, 0x0000A778, 0x00005031, 0x00009994, 0x0000DBE1, 0x0000E6CC, 0x0000F905, 0x00007ED4, 0x0000713A, 0x00001E87, 0x0000A621, 0x0000E3C5, 0x00002DCF, 0x000095C2, 0x0000F961, 0x0000A7E3, 0x0000FAD7, 0x00002244, 0x0000E219, 0x00007FFC, 0x00004CCD, 0x000005B2, 0x00003594, 0x0000F6DD, 0x00006037, 0x00002C8F, 0x000005B3, 0x00003DB5, 0x00005361, 0x00009025, 0x0000DB95, 0x0000B3C9, 0x00006450, 0x0000AE6E, 0x0000F74F, 0x0000B761, 0x0000F9D0, 0x000000A9, 0x0000F10C, 0x0000ECBD, 0x0000C698, 0x00000C22, 0x00007EB8, 0x0000EAA5, 0x0000AB78, 0x0000437F, 0x0000BF50, 0x00009DA0, 0x000070E1, 0x0000DBE8, 0x00009B40, 0x0000B9A5, 0x0000CBF4, 0x0000E492, 0x0000B5F6, 0x0000919F, 0x00004B33, 0x00009EEF, 0x00005E9A, 0x0000FFC0, 0x00000AB7, 0x0000F3BF, 0x00008283, 0x000041DF, 0x00007773, 0x000081B4, 0x0000BA07, 0x00000FD6, 0x00008FD3, 0x00005D0F, 0x000033B1, 0x0000F5B0, 0x0000FFBB, 0x000047B5, 0x0000E9F7, 0x0000D783, 0x0000A9E6, 0x000096C1, 0x00001816, 0x0000C30A, 0x0000A3CD, 0x00007884, 0x0000B1EC, 0x00000C61, 0x00000F77, 0x0000B14A, 0x00008AFF, 0x0000C779, 0x0000626D, 0x0000D759, 0x00006C81, 0x0000CC5D, 0x0000BD1A, 0x000095F5, 0x00005D61, 0x00009C9E, 0x00006293, 0x00002911, 0x00009758, 0x0000B6D0, 0x00005BD4, 0x00003B98, 0x0000DC7F, 0x0000F27C, 0x00009816, 0x0000DE49, 0x00008575, 0x0000D547, 0x00006E36, 0x00008635, 0x00003E95, 0x0000D8C6, 0x000024C7, 0x00006B58, 0x00009CEF, 0x0000EA8C, 0x0000582C, 0x0000C9E0, 0x0000BD3D, 0x0000BC4E, 0x0000D00C, 0x00003C61, 0x0000C9F7, 0x0000E213, 0x00004893, 0x000051C6, 0x0000A72F, 0x0000E1F4, 0x0000F767, 0x00001A78, 0x00008D4F, 0x0000423B, 0x0000DA35, 0x0000ED13, 0x0000228B, 0x0000CD29, 0x00009F34, 0x0000997D, 0x00005D1E, 0x0000C18A, 0x00006159, 0x00006986, 0x00003C38, 0x0000A076, 0x0000FC28, 0x00006FC4, 0x00008751, 0x000096E0, 0x0000FAFD, 0x000052C6, 0x00004906, 0x00001173, 0x0000045C, 0x0000DD70, 0x000045F3, 0x00005044, 0x000092AE, 0x0000428A, 0x000029D8, 0x0000C652, 0x0000679D, 0x0000213F, 0x0000BF03, 0x0000F0C1, 0x00000E6A, 0x0000BDD8, 0x00004591, 0x0000B5B9, 0x00002558, 0x0000A92D, 0x0000C886, 0x0000C02F, 0x000089CF, 0x00005395, 0x0000C578, 0x00002078, 0x00004ADF, 0x0000C6FF, 0x00006EC1, 0x00004A15, 0x00001309, 0x0000FDED, 0x0000468C, 0x00008FEB, 0x0000AEEA, 0x0000D873, 0x00001B87, 0x0000E75B, 0x000080B5, 0x0000236D, 0x00007097, 0x00006857, 0x00006B43, 0x000002BC, 0x000091EA, 0x0000B01D, 0x0000777A, 0x0000B692, 0x00003918, 0x0000D1CF, 0x0000959E, 0x00000572, 0x000059C7, 0x0000D4FA, 0x0000D9AB, 0x0000904F, 0x00005D27, 0x0000396C, 0x00004B82, 0x000085F2, 0x0000A2F0, 0x0000C88A, 0x000088E5, 0x0000F4E2, 0x00006988, 0x00006496, 0x00004035, 0x00003D0E, 0x000015DC, 0x0000B6DD, 0x0000CBE4, 0x00002D92, 0x0000418F, 0x00009AD4, 0x0000AEDC, 0x0000FA46, 0x000025E7, 0x000022A8, 0x0000AEE5, 0x00001798, 0x0000DFBD, 0x0000CD93, 0x0000058E, 0x000027DC, 0x0000EAFF, 0x0000AB5A, 0x000037AB, 0x0000B78F, 0x00005E02, 0x00008E73, 0x00003AEC, 0x0000F80C, 0x0000711A, 0x0000914C, 0x0000DD62, 0x0000E2D3, 0x00006DFE, 0x00003597, 0x000025C5, 0x0000AD18, 0x0000E45F, 0x00003808, 0x0000EB56, 0x000033EA, 0x00006D19, 0x0000FBCC, 0x0000A388, 0x0000B0FD, 0x0000C271, 0x0000ED90, 0x00004095, 0x0000440F, 0x0000262D, 0x0000B512, 0x0000623A, 0x00006410, 0x000062A5, 0x00006995, 0x0000A000, 0x0000BAF9, 0x0000E445, 0x00002465, 0x0000A65E, 0x0000B603, 0x0000C209, 0x0000B159, 0x00006C32, 0x0000011D, 0x00003C2E, 0x0000B23D, 0x0000B479, 0x00009D4F, 0x0000EF2F, 0x0000833E, 0x0000FE0F, 0x00002EB3, 0x00008B7B, 0x000061DB, 0x00001DC6, 0x00006534, 0x000037F1, 0x0000908F, 0x00000D7D, 0x0000D25A, 0x0000C690, 0x00000B29, 0x00003220, 0x0000097F, 0x0000321A, 0x0000CAC4, 0x000007AB, 0x000073AE, 0x0000DB4E, 0x00004A65, 0x000096A0, 0x000064F0, 0x00005F45, 0x00001E77, 0x00002DE3, 0x0000DD0C, 0x0000A4C8, 0x000033DF, 0x0000FACF, 0x000029B1, 0x000007CB, 0x000024AB, 0x00002A19, 0x000043F2, 0x00003293, 0x0000C952, 0x000083EE, 0x00000E01, 0x0000424C, 0x00002CCC, 0x000021CB, 0x0000701F, 0x00004A27, 0x00004E30, 0x00004ADC, 0x00000846, 0x0000DA65, 0x0000E1F1, 0x0000D6CF, 0x000015C1, 0x0000ED78, 0x0000CFF2, 0x00001C69, 0x0000EF05, 0x0000DD53, 0x00002BB9, 0x00001401, 0x00000EFD, 0x00007031, 0x0000EFD9, 0x00005790, 0x000014B8, 0x0000A5C6, 0x0000FA73, 0x00001F8C, 0x00006171, 0x0000A46B, 0x0000C524, 0x00008A78, 0x00002DC3, 0x000061BC, 0x000004A2, 0x0000DDC4, 0x000073C4, 0x00008C50, 0x0000CFBC, 0x00003388, 0x000073F0, 0x0000E94C, 0x000085CE, 0x000020BC, 0x00008F08, 0x000067E7, 0x0000E5C8, 0x000069BD, 0x000046BF, 0x000069E4, 0x0000F024, 0x0000F5BB, 0x0000AB91, 0x00000C32, 0x000057E8, 0x0000CC30, 0x0000C68A, 0x0000A5F3, 0x0000EFBF, 0x00005F74, 0x00000E7F, 0x0000397F, 0x0000F02B, 0x00002E51, 0x00000FFE, 0x000032CE, 0x0000F66A, 0x0000A69D, 0x000093B1, 0x0000E53F, 0x0000F854, 0x000060B8, 0x0000A7A2, 0x0000EF57, 0x00006A86, 0x0000C3CA, 0x000093E4, 0x0000B2F1, 0x00000590, 0x00008CC5, 0x0000EEB7, 0x0000663D, 0x00006311, 0x0000DB16, 0x00009294, 0x00008299, 0x000000BD, 0x0000FCA1, 0x0000D53F, 0x00007E60, 0x0000FF44, 0x0000A42C, 0x0000A8F1, 0x00005175, 0x0000E9A0, 0x0000EB14, 0x0000DB64, 0x0000B072, 0x00003179, 0x000059D2, 0x0000B7FF, 0x00002EE0, 0x0000FD00, 0x000042FD, 0x000017FB, 0x0000A871, 0x0000D3CE, 0x000073B9, 0x0000532C, 0x00002449, 0x000045A8, 0x0000E49A, 0x0000C3CB, 0x00004497, 0x00005841, 0x000011D7, 0x00007D08, 0x000046C3, 0x0000CF5E, 0x0000705C, 0x0000C024, 0x0000D07C, 0x00007F16, 0x00009D97, 0x00003E91, 0x0000249F, 0x0000E9A7, 0x000014E5, 0x00008C35, 0x00007A6D, 0x0000F3E9, 0x0000B8F6, 0x0000DCDD, 0x0000449D, 0x0000A524, 0x00000F38, 0x00004510, 0x0000589D, 0x000078A1, 0x00004ABA, 0x0000A3E5, 0x000009D3, 0x0000F34B, 0x00005705, 0x0000DA4D, 0x00003330, 0x00001949, 0x00002949, 0x0000CE6C, 0x00005299, 0x00000340, 0x0000C795, 0x000098C2, 0x0000D611, 0x00006212, 0x0000B043, 0x00003253, 0x0000FCF1, 0x0000593C, 0x00003496, 0x000008D5, 0x0000F597, 0x00007436, 0x0000E146, 0x0000CE9A, 0x0000FDF3, 0x0000B57C, 0x000059AA, 0x00008F34, 0x00006A4E, 0x000022F9, 0x0000DB15, 0x000002CA, 0x00001DE0, 0x00001E5B, 0x00003A0F, 0x0000AB47, 0x00007280, 0x000016BD, 0x0000826B, 0x0000FFEF, 0x000069A4, 0x00000E62, 0x0000674E, 0x0000CDC3, 0x00002381, 0x00001187, 0x000012CC, 0x0000D668, 0x00004DCF, 0x000089AC, 0x000075B6, 0x000095CD, 0x00001915, 0x0000D51E, 0x000078B2]
third = [-115, 0, 15, 1, -21, 49, -24, 5, 42, -2, -16, -9, 40, 46, 56, -34, 16, -25, 39, 26, 23, 42, -56, 0, -31, -15, 7, -14, 11, 22, 13, -33, -9, 40, 31, 54, -19, -26, -20, 12, 30, 14, 44, -14, 49, -4, -4, 25, 53, 8, -45, 20, -5, 58, 16, -15, 18, 59, 45, 23, 50, 51, -33, 11, 46, -34, -15, -9, -46, -50, 3, -35, 9, 39, -13, -127, 19, -40, 30, 21, -40, 32, 37, -20, 30, 30, 29, 25, 3, 18, -12, -58, -44, -76, 39, -55, -18, -34, 4, -16, -19, -9, -4, -35, 31, -32, 0, 59, 5, 23, 29, -40, -30, -1, 54, -13, -1, -31, 36, 56, 17, 16, -40, 18, 9, -129, 36, -33, 0, -23, 23, 43, 3, 30, 10, -4, -40, 3, -42, -40, 10, -22, 28, -36, 24, -6, -20, -2, -25, 17, -53, -6, -18, 49, -16, 14, -1, 27, -12, -72, -10, -38, -4, 0, 53, 26, 23, -28, 56, 26, 2, 57, -38, -18, 14, -123, 48, 38, -29, -12, -12, 18, -38, 31, 59, -27, -44, -56, 27, -33, -29, 19, 54, 22, -14, -29, 16, -31, 46, 30, -34, 72, -94, 24, 41, 52, -9, -13, -33, -9, 56, -5, 25, 54, 3, 43, -13, 49, 56, 36, 43, -27, 53, -15, 7, -94, 83, -28, -28, 31, 23, -29, 44, -40, -31, 3, 0, 58, 60, -42, -40, -27, 55, 46, -36, -22, -45, 25, -9, 22, 24, -2, 12, -30, 35, 32, 11, -2, 29, -32, -33, 42, -53, 22, -34, -30, 33, -2, 2, 23, -28, 58, -95, -7, 20, 23, -16, 57, -12, -75, -3, 19, -26, 58, 49, -19, 45, 33, 57, 21, 47, 16, 18, 15, -22, 6, 59, -12, -25, 45, 39, 1, 27, -2, 41, -73, 25, 6, 8, -24, 9, 11, -29, 40, -26, 26, -77, -45, -88, -30, -95, 34, -28, 1, -40, -113, 2, 6, -6, -4, -34, 27, -37, -12, -11, 35, 27, 2, 9, 13, -31, -6, 12, -14, -16, -10, 34, -9, 25, -19, -115, -9, -22, -1, 9, 41, -46, -53, -60, 28, -36, -22, 18, 34, 25, 48, 50, 27, -51, -24, 45, 71, -38, -15, 32, 51, -24, 15, 45, 5, -55, 23, 8, 38, 43, 19, 22, -39, -37, -14, -4, -34, 8, -19, -13, 43, -36, -39, 28, 24, 63, -54, 8, -23, -27, -50, 34, 36, 38, -5, 40, -3, -8, -6, 35, -17, 26, 35, 30, -19, -37, 8, 0, -29, -57, -61, -54, 0, -16, 59, -13, -39, -14, -26, 55, 0, 58, 24, 39, 21, 44, -22, 22, -38, -17, 3, 57, -20, -10, 2, 14, -10, 21, -40, 8, 21, -30, -18, -35, -21, -3, -3, -8, 45, -28, 8, 20, -38, -29, -40, -40, 69, 20, -19, 28, 22, 15, 13, -34, -26, -29, -19, -32, -14, 38, -37, 27, 54, -30, -38, 56, 39, -15, 43, -35, -3, 31, -53, -9, -47, -58, 3, 12, 25, 45, 52, -38, -10, 14, -17, -29, 12, 41, 23, -39, 16, -30, 5, 3, 27, 5, 21, 16, 41, 33, -128, 17, 23, 34, 51, 23, 22, 20, -2, 39, 55, 14, 40, 48, 56, 57, 4, 37, -23, 27, 2, 5, 35, 27, -16, -66, -39, 15, 40, -24, -29, -2, -5, 54, -25, 20, 59, -8, 8, -11, -4, 15, 58, 42, -38, -11, 31, 50, 6, 37, -56]
fourth = [-147, 0, 15, 1, -21, 49, -24, 5, 42, -2, -16, -9, 40, 46, 56, -34, 16, -25, 39, 26, 23, 42, -16, -2, -29, -62, 17, -14, 11, 22, 13, -33, -9, 40, 31, 54, -19, -26, -20, 12, 30, 14, 44, -14, 49, 54, 43, 23, 48, -39, -43, 22, -53, 58, 16, -15, 18, 59, 45, 23, 50, 51, -33, 11, 46, -34, -15, 46, 1, -3, 8, -30, -49, 41, -60, -125, -28, -68, -21, 21, -40, 32, 37, -20, 30, 30, 29, 25, 3, -3, 35, -11, 3, -29, 37, -2, -18, -67, 6, -63, -66, -7, -51, -63, -11, -32, 0, 59, 5, 23, 29, 14, -36, 46, 52, -8, -3, 10, 36, 56, 17, 16, -40, 11, -38, -134, 31, -31, -5, -26, 23, 43, 3, 30, 57, -6, 7, 8, 5, -12, 50, -22, 28, -36, 24, -6, -65, -49, -72, 12, -51, -11, -19, 49, 4, -42, -1, 27, -12, -37, 37, -33, 43, -2, 58, 57, 23, -28, 8, 28, -45, 10, -43, -12, -23, -123, 48, 1, -26, -84, -59, 17, -38, 31, 55, -29, -39, -9, 25, -35, -26, 23, 56, -25, -61, -76, 13, -31, 46, 6, -44, 49, -85, -6, -6, 5, -7, -32, -33, -9, 34, 42, 23, 52, 1, 41, -18, 51, 51, -16, 43, -52, -2, -34, -65, -166, 53, -35, -22, 33, -24, -76, -3, -19, -31, 3, 7, 56, 58, 5, -45, -43, 55, -8, -16, 36, -36, -47, 0, 33, 23, -2, 12, -77, -12, 55, 2, 0, 1, -39, -33, 42, -19, 50, -34, -30, 37, -27, -23, -2, 28, 44, -37, -7, 20, 23, -16, 57, -12, -34, -17, 31, -11, 58, 49, -19, 45, 33, 57, 21, 27, -6, -9, 4, 11, -39, 11, -39, -48, 22, 16, -22, 4, -1, -7, -49, 2, -14, -15, -24, 9, 11, -29, 40, -26, 26, -57, -59, -55, 3, -62, -14, -57, -27, -63, -136, -21, 36, 17, -27, -64, 27, -37, -12, 9, 45, 27, 2, 9, 13, -31, 14, 56, -34, -36, 23, -14, -57, 5, -42, -128, -15, -35, -1, 9, 41, -16, -33, -40, 12, -36, -22, 18, 34, 25, 48, 50, 27, -24, -2, -3, 34, -61, -37, 32, 51, -24, 15, 33, 28, -32, 46, 31, 22, 43, 19, 22, -39, -37, -14, -4, -34, 8, -7, -53, 11, -59, -84, 28, 24, 39, -31, 31, 0, -4, -30, 19, 36, 36, -28, 17, -26, -31, -29, 12, -46, 26, 47, 7, -30, -37, 8, 25, -9, -34, -41, -31, 23, 28, 59, -13, -39, -16, -49, 32, -23, 35, 1, 16, -8, 44, -30, 22, -38, -17, 3, 39, 3, 13, 25, 37, 13, 46, -40, 8, 21, -30, -18, -55, -44, -26, -26, -31, 31, -28, 8, 20, -38, -29, -40, -40, 49, 46, 11, 51, 45, 38, 36, 16, -26, -52, -42, -55, -37, 15, -67, 27, 54, -30, -38, 56, 39, -15, 43, -35, -3, 31, -14, 14, -24, -35, 26, 35, 48, 22, 29, -58, -30, -29, -17, -29, 12, 41, 23, -39, 16, -30, 5, 3, 27, 5, 21, 16, 18, 56, -105, 40, 46, 11, 28, 45, 22, 20, -2, 39, 55, 14, 40, 48, 56, 57, 4, 37, -23, 27, 2, 5, 35, 27, -35, -43, -16, -19, 40, -24, -29, -2, -5, 54, -25, 20, 59, -8, 8, -11, -4, 15, 58, 42, -38, -11, 31, 50, 6, 37, -7]
F = Zmod(0xFFFF)
first = matrix(F,24,24, first)
second = matrix(F,24, 24, second)
third = matrix(F,24, 24, third)
fourth = matrix(F,24, 24, fourth)
def rotate_matrix_counter_clockwise(buf):
for i in range(12):
for j in range(24):
v4 = buf[24 * j + i]
buf[24 * j + i] = buf[24 * i + (23 - j)]
buf[24 * i + (23 - j)] = buf[24 * (23 - j) + (23 - i)]
buf[24 * (23 - j) + (23 - i)] = buf[24 * (23 - i) + j]
buf[24 * (23 - i) + j] = v4
return buf
def rotate_matrix_manner_clockwise(buf):
for i in range(12):
for j in range(24):
v4 = buf[24 * j + i]
buf[24 * j + i] = buf[24 * (23 - i) + j]
buf[24 * (23 - i) + j] = buf[24 * (23 - j) + 23 - i]
buf[24 * (23 - j) + 23 - i] = buf[24 * i + 23 - j]
buf[24 * i + 23 - j] = v4
return buf
for i in range(12):
if i & 1:
buf1[24 * (23 - i) + i] = 1
v3 = 23 - i
v4 = 24 * i
else:
buf1[25 * i] = 1
v3 = 23 - i
v4 = 24 * v3
buf1[v3 + v4] = 1
# cmp = [730, 25324, 35144, 36450, 22875, 54873, 19942, 39102, 21103, 10238, 62095, 56170, 14711, 34747, 9130, 63737, 17289, 45978, 58977, 39188, 35677, 652, 43300, 50538, 41108, 55588, 56307, 30453, 6228, 41275, 9243, 13799, 11013, 11301, 50547, 38292, 9102, 14156, 2287, 16955, 27598, 14867, 19785, 4529, 5475, 45062, 24977, 56264, 63233, 49026, 57502, 16738, 49346, 64210, 43195, 24008, 57017, 24487, 54769, 50836, 5262, 17061, 16186, 45012, 39008, 46428, 60834, 4075, 35547, 29039, 18771, 39486, 64079, 919, 55495, 53761, 37526, 9932, 30210, 47014, 62139, 13581, 58007, 9906, 59296, 24366, 15611, 39389, 57141, 2953, 14405, 59873, 12424, 34936, 31913, 21641, 22292, 17449, 5673, 61675, 16182, 16300, 44770, 53283, 34477, 30128, 16785, 40836, 51558, 328, 52420, 43833, 64282, 44988, 47449, 44171, 55755, 23089, 36312, 58341, 22421, 62102, 43469, 24876, 11318, 1092, 16661, 63176, 57497, 37300, 27611, 56569, 29482, 5486, 44421, 16618, 41330, 21521, 51234, 21914, 11810, 31765, 65163, 57348, 63545, 47824, 17395, 444, 62740, 39057, 41605, 30661, 5608, 32361, 8049, 14321, 35317, 60242, 53072, 54454, 33705, 9606, 54047, 3560, 61016, 21859, 35849, 55517, 12074, 10797, 40815, 5516, 33266, 64783, 46967, 62240, 51032, 15296, 63219, 46624, 34700, 51062, 31124, 8405, 55331, 62521, 617, 60008, 56399, 1471, 12648, 40385, 31418, 47397, 50371, 62471, 28146, 19323, 61247, 8792, 3086, 26349, 38926, 36575, 37120, 51582, 45666, 51789, 53787, 32937, 10222, 10151, 23572, 61974, 60306, 44875, 30013, 16868, 1878, 54893, 51178, 46736, 34645, 5531, 20893, 41006, 49411, 38167, 14461, 5663, 38402, 95, 12227, 20041, 4305, 47138, 2525, 5872, 19798, 46355, 6854, 30863, 12030, 61065, 41957, 34160, 26584, 59309, 22042, 57806, 34434, 42780, 19650, 10067, 12007, 17019, 48482, 49309, 2291, 16279, 45109, 40350, 43863, 840, 54055, 62600, 9168, 52569, 39435, 40523, 30295, 29497, 47009, 46988, 17176, 31590, 29987, 26186, 26702, 37472, 46738, 26441, 7035, 35099, 232, 28905, 11124, 54670, 39582, 19379, 63097, 59396, 47145, 56109, 14473, 18515, 17718, 31072, 35226, 31835, 46755, 13107, 52910, 32185, 56684, 30045, 26291, 2316, 13170, 3255, 3640, 35866, 424, 48521, 16456, 57664, 45989, 42905, 9807, 12302, 3310, 25372, 14713, 58731, 10478, 52411, 53304, 52011, 18321, 7962, 12943, 53910, 10041, 2095, 12029, 11835, 47563, 21905, 15400, 58650, 42562, 4331, 21121, 57535, 5826, 36606, 40514, 59837, 64362, 39444, 4764, 43487, 63077, 47805, 34270, 18338, 9193, 9050, 31382, 50822, 16936, 30443, 38641, 33035, 58840, 55861, 63227, 50763, 41893, 31781, 53605, 24017, 53764, 37206, 46398, 38248, 22600, 26256, 25065, 44683, 35959, 46255, 3594, 22204, 30821, 47324, 21690, 38127, 9898, 56151, 50799, 36629, 27416, 34493, 6754, 17657, 62792, 38139, 19635, 22564, 40476, 7353, 24268, 26130, 10885, 18117, 16911, 1100, 13317, 58031, 4756, 27150, 29951, 542, 47416, 59404, 29023, 35861, 49748, 32867, 48802, 46824, 57188, 314, 32510, 11344, 12210, 2248, 40174, 21388, 57470, 61657, 14114, 46043, 1403, 28409, 12314, 4299, 23627, 20477, 23575, 54429, 25920, 22777, 57396, 39561, 27046, 5140, 45711, 45289, 62867, 35400, 43892, 40860, 56224, 62340, 16782, 10295, 41623, 63652, 25221, 56584, 24780, 52513, 42182, 3641, 36366, 17661, 11449, 45564, 56581, 37111, 28941, 59197, 51885, 42623, 59304, 52076, 24993, 19471, 43658, 23010, 57884, 55781, 39692, 38850, 35745, 25643, 52027, 36314, 6622, 17281, 62856, 19279, 12027, 56560, 63846, 35338, 65146, 6600, 25004, 4696, 58711, 44044, 27558, 55987, 40552, 18950, 10298, 15423, 5072, 45779, 46590, 56948, 42065, 8240, 7431, 10164, 46066, 63241, 28570, 26299, 31422, 36797, 61379, 34860, 25379, 5260, 15041, 42823, 63063, 28113, 43398, 3297, 20708, 52045, 20512, 45045, 34896, 5424, 32646, 21027, 15269, 44815, 33780, 58545, 36959, 24015, 62939, 61316, 37201, 21046, 20710, 25997, 23155, 43449, 32136, 48822, 44444, 27390, 64193, 61870, 11184, 45037, 28818, 34590, 55146, 3298, 20146, 50199, 5041, 44832, 3407, 46283, 26510, 28043]
cmp = [0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000013, 0x0000003D, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000001, 0x0000000C, 0x0000003D, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000004, 0x0000000C, 0x0000000C, 0x00000036, 0x00000036, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000050, 0x0000000C, 0x0000000C, 0x0000000C, 0x0000000C, 0x0000003D, 0x00000006, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000005, 0x00000041, 0x0000000C, 0x0000003D, 0x00000036, 0x0000003D, 0x00000012, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000000C, 0x0000003D, 0x0000000C, 0x00000036, 0x0000000C, 0x0000001F, 0x00000013, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004F, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000018, 0x0000000C, 0x00000036, 0x0000000C, 0x0000003D, 0x00000036, 0x0000001C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003E, 0x00000054, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003F, 0x0000003D, 0x00000036, 0x0000000C, 0x0000003D, 0x0000003D, 0x00000038, 0x00000037, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000016, 0x00000054, 0x00000003, 0x00000054, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000051, 0x0000000C, 0x0000003D, 0x0000003D, 0x0000003D, 0x0000003D, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000043, 0x00000054, 0x00000054, 0x00000054, 0x00000054, 0x00000044, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000034, 0x0000003D, 0x0000003D, 0x0000000C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000029, 0x00000003, 0x00000003, 0x00000054, 0x00000003, 0x00000032, 0x0000003C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000026, 0x00000046, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000019, 0x0000001F, 0x0000003B, 0x0000003B, 0x00000037, 0x00000054, 0x00000054, 0x00000054, 0x00000003, 0x00000049, 0x00000001, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000012, 0x00000049, 0x0000002F, 0x0000002C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003D, 0x00000042, 0x0000002F, 0x00000003, 0x00000054, 0x00000054, 0x0000003F, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000026, 0x00000054, 0x0000000C, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000010, 0x00000032, 0x00000003, 0x00000003, 0x00000003, 0x00000054, 0x00000041, 0x00000040, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000006, 0x00000010, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000027, 0x00000031, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000000D, 0x00000032, 0x00000042, 0x00000003, 0x00000054, 0x00000054, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000001D, 0x00000027, 0x00000027, 0x0000004B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000020, 0x00000032, 0x00000054, 0x00000049, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000047, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x0000004B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004C, 0x00000044, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000053, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000027, 0x0000004A, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000022, 0x00000027, 0x00000024, 0x00000027, 0x00000024, 0x00000024, 0x0000000F, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004D, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000022, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004F, 0x00000021, 0x0000001D, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000009, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000014, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x00000052, 0x00000024, 0x00000024, 0x00000024, 0x00000024, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000004E, 0x00000024, 0x00000024, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000003B, 0x0000000A]
buf6 = matrix(F, 24, 24, cmp)
buf1 = matrix(F, 24, 24,buf1)
# a2[i,j] = target[i+2, j+2] + target[i+2, j+1] + target[i+2, j] + target[i+1, j+2] + target[i+1, j+1] + target[i+1, j] + target[i, j+2] + target[i, j+1] + target[i,j]
buf5 = buf6 - third
buf4 = buf5 * second.inverse()
buf2 = buf4 - first
buf2 = rotate_matrix_manner_clockwise(buf2.list())
buf2 = matrix(F, 24,24, buf2)
buf3 = buf1.inverse() * buf2
buf2 = buf3 * buf1.inverse()
buf2 = rotate_matrix_manner_clockwise(buf2.list())
buf2 = list(map(int, buf2))
print(matrix(24,24,buf2))
target = [0] * 676
codegate = b'C0D3GAT3'
for m in range(1, 25, 1):
for n in range(1, 25, 1):
if m == 1 or n == 1 or m == 24 or n == 24:
if target[26 * m + n] == 0:
target[26 * m + n] = codegate[(n - 1 + m - 1) % 8]
flag = []
for i in range(22):
for j in range(22):
assert target[26*i + 54+j] == 0
target[26*i + 54 + j] = buf2[24*i + j] - (target[26 * i +j] + target[26 * i + 53 + j] + target[26 * i + 52 + j] + target[26 * i + 28 + j] + target[26 * i + 27 + j] + target[26 * i + 26 + j] + target[26 * i + 2 + j] + target[26 * i + 1 + j])
print(chr(target[26*i + 54 + j]), end="")Sound out for my crypto brother for help me cook this challenge @tvdat20004.
-> codegate2025{01194af52dd977b3db288b1b8ce2be42b7a18ab86ea403843c346dd14af83767}
cha’s ELF
Control Flow Flattening + Crypto gogo bruhhh XD. This challenge uses technique CFF but only one single dispatcher which means it’s not that hard to cook. The program requires us to input 65 chars and than return encrypted text
Why 65 chars ? This is because at 0x000000000404210 and 0x0000000000404C10 will use last byte to generate key and nonce which can rewrite like this.
from pwn import *
sbox = b'c|w{\xf2ko\xc50\x01g+\xfe\xd7\xabv\xca\x82\xc9}\xfaYG\xf0\xad\xd4\xa2\xaf\x9c\xa4r\xc0\xb7\xfd\x93&6?\xf7\xcc4\xa5\xe5\xf1q\xd81\x15\x04\xc7#\xc3\x18\x96\x05\x9a\x07\x12\x80\xe2\xeb\'\xb2u\t\x83,\x1a\x1bnZ\xa0R;\xd6\xb3)\xe3/\x84S\xd1\x00\xed \xfc\xb1[j\xcb\xbe9JLX\xcf\xd0\xef\xaa\xfbCM3\x85E\xf9\x02\x7fP<\x9f\xa8Q\xa3@\x8f\x92\x9d8\xf5\xbc\xb6\xda!\x10\xff\xf3\xd2\xcd\x0c\x13\xec_\x97D\x17\xc4\xa7~=d]\x19s`\x81O\xdc"*\x90\x88F\xee\xb8\x14\xde^\x0b\xdb\xe02:\nI\x06$\\\xc2\xd3\xacb\x91\x95\xe4y\xe7\xc87m\x8d\xd5N\xa9lV\xf4\xeaez\xae\x08\xbax%.\x1c\xa6\xb4\xc6\xe8\xddt\x1fK\xbd\x8b\x8ap>\xb5fH\x03\xf6\x0ea5W\xb9\x86\xc1\x1d\x9e\xe1\xf8\x98\x11i\xd9\x8e\x94\x9b\x1e\x87\xe9\xceU(\xdf\x8c\xa1\x89\r\xbf\xe6BhA\x99-\x0f\xb0T\xbb\x16'
for seed in range(0xff):
last = seed
wtf = 0
buf = []
for i in range(32):
index = last
buf.append(sbox[index])
if i == 0:
wtf = index
if (index % 8) != 7:
tmp = index + 9
else:
tmp = index + 1
last = tmp % 256
print(bytearray(buf).hex())
buf2 = []
for i in range(12):
index = wtf
buf2.append(sbox[index])
if (index % 21) != 20:
tmp = index + 22
else:
tmp = index + 1
wtf = tmp % 252
print(bytearray(buf2).hex())This is only the first stage is generate key and nonce. So how does it encrypt our input? If you remember in main function after all it will excute shellcode at this.
if ( n115935838 != 0xDC1083A7 )
break;
v9 = 0;
n115935838 = 0x6546E9C1;
encrypt();Set breakpoint and step into it, you will see that you can’t make function because IDA is flow decompiler, it can’t find where will return back. To fix this just patch ret at here.
And then you’re good to go. This function is just ChaCha20 custom with const Codegate2025 Pre. Since we only need to brute last bytes to generate key and nonce, it’s quite fast to get flag. My finals script
#! /usr/bin/python3
# by pts@fazekas.hu at Thu May 24 18:44:15 CEST 2018
"""Pure Python 3 implementation of the ChaCha20 stream cipher.
It works with Python 3.5 (and probably also earler Python 3.x).
Based on https://gist.github.com/cathalgarvey/0ce7dbae2aa9e3984adc
Based on Numpy implementation: https://gist.github.com/chiiph/6855750
Based on http://cr.yp.to/chacha.html
More info about ChaCha20: https://en.wikipedia.org/wiki/Salsa20
"""
import struct
def yield_chacha20_xor_stream(key, iv, position=0):
"""Generate the xor stream with the ChaCha20 cipher."""
if not isinstance(position, int):
raise TypeError
if position & ~0xffffffff:
raise ValueError('Position is not uint32.')
if not isinstance(key, bytes):
raise TypeError
if not isinstance(iv, bytes):
raise TypeError
if len(key) != 32:
raise ValueError
def rotate(v, c):
return ((v << c) & 0xffffffff) | v >> (32 - c)
def quarter_round(x, a, b, c, d):
x[a] = (x[a] + x[b]) & 0xffffffff
x[d] = rotate(x[d] ^ x[a], 16)
x[c] = (x[c] + x[d]) & 0xffffffff
x[b] = rotate(x[b] ^ x[c], 12)
x[a] = (x[a] + x[b]) & 0xffffffff
x[d] = rotate(x[d] ^ x[a], 8)
x[c] = (x[c] + x[d]) & 0xffffffff
x[b] = rotate(x[b] ^ x[c], 7)
ctx = [0] * 16
ctx[:4] = (1701080899, 1702125927, 892481586, 1701990432) # Codegate2025 Pre
ctx[4 : 12] = struct.unpack('<8L', key)
ctx[12] = position
ctx[13 : 16] = struct.unpack('<LLL', iv)
while 1:
x = list(ctx)
for i in range(10):
quarter_round(x, 0, 4, 8, 12)
quarter_round(x, 1, 5, 9, 13)
quarter_round(x, 2, 6, 10, 14)
quarter_round(x, 3, 7, 11, 15)
quarter_round(x, 0, 5, 10, 15)
quarter_round(x, 1, 6, 11, 12)
quarter_round(x, 2, 7, 8, 13)
quarter_round(x, 3, 4, 9, 14)
for c in struct.pack('<16L', *(
(x[i] + ctx[i]) & 0xffffffff for i in range(16))):
yield c
ctx[12] = (ctx[12] + 1) & 0xffffffff
if ctx[12] == 0:
ctx[13] = (ctx[13] + 1) & 0xffffffff
def chacha20_encrypt(data, key, iv=None, position=0):
"""Encrypt (or decrypt) with the ChaCha20 cipher."""
if not isinstance(data, bytes):
raise TypeError
if iv is None:
iv = b'\0' * 8
if isinstance(key, bytes):
if not key:
raise ValueError('Key is empty.')
if len(key) < 32:
# TODO(pts): Do key derivation with PBKDF2 or something similar.
key = (key * (32 // len(key) + 1))[:32]
if len(key) > 32:
raise ValueError('Key too long.')
return bytes(a ^ b for a, b in
zip(data, yield_chacha20_xor_stream(key, iv, position)))
# assert chacha20_encrypt(
# b'Hello World', b'chacha20!') == b'\xeb\xe78\xad\xd5\xab\x18R\xe2O~'
# assert chacha20_encrypt(
# b'\xeb\xe78\xad\xd5\xab\x18R\xe2O~', b'chacha20!') == b'Hello World'
# # ---
from pwn import *
if __name__ == "__main__":
# key = bytes.fromhex("1a29fc588545a3daec642a0b5cc2c8f42e4b031d949ba12d7bfe5972cc34c780")
# nonce = bytes.fromhex("1acba89714c8c6c10dd72612")
# data_ = bytes.fromhex("837cab3f0d88479e9a3fb1f9d084e8d4ce678595b112daeafea0fbe4bc8c3e5a077878535b84dd467d0d0f1f5fdbb29b7c88904663ea91bd257374a62c78eea0")
# print(chacha20_encrypt(data_, key, nonce))
data_ = bytes.fromhex("147274ff36e71d07cfad08e75f0352799d0081c6862fd96aebb08566f49ca86f15528c5121940ddc3ee92b816b1147be934d03389ee0cfad5b539ebf35feb969")
sbox = b'c|w{\xf2ko\xc50\x01g+\xfe\xd7\xabv\xca\x82\xc9}\xfaYG\xf0\xad\xd4\xa2\xaf\x9c\xa4r\xc0\xb7\xfd\x93&6?\xf7\xcc4\xa5\xe5\xf1q\xd81\x15\x04\xc7#\xc3\x18\x96\x05\x9a\x07\x12\x80\xe2\xeb\'\xb2u\t\x83,\x1a\x1bnZ\xa0R;\xd6\xb3)\xe3/\x84S\xd1\x00\xed \xfc\xb1[j\xcb\xbe9JLX\xcf\xd0\xef\xaa\xfbCM3\x85E\xf9\x02\x7fP<\x9f\xa8Q\xa3@\x8f\x92\x9d8\xf5\xbc\xb6\xda!\x10\xff\xf3\xd2\xcd\x0c\x13\xec_\x97D\x17\xc4\xa7~=d]\x19s`\x81O\xdc"*\x90\x88F\xee\xb8\x14\xde^\x0b\xdb\xe02:\nI\x06$\\\xc2\xd3\xacb\x91\x95\xe4y\xe7\xc87m\x8d\xd5N\xa9lV\xf4\xeaez\xae\x08\xbax%.\x1c\xa6\xb4\xc6\xe8\xddt\x1fK\xbd\x8b\x8ap>\xb5fH\x03\xf6\x0ea5W\xb9\x86\xc1\x1d\x9e\xe1\xf8\x98\x11i\xd9\x8e\x94\x9b\x1e\x87\xe9\xceU(\xdf\x8c\xa1\x89\r\xbf\xe6BhA\x99-\x0f\xb0T\xbb\x16'
for seed in range(0xff):
last = seed
wtf = 0
buf = []
for i in range(32):
index = last
buf.append(sbox[index])
if i == 0:
wtf = index
if (index % 8) != 7:
tmp = index + 9
else:
tmp = index + 1
last = tmp % 256
key = bytes(bytearray(buf))
buf2 = []
for i in range(12):
index = wtf
buf2.append(sbox[index])
if (index % 21) != 20:
tmp = index + 22
else:
tmp = index + 1
wtf = tmp % 252
nonce = bytes(bytearray(buf2))
print(seed)
print(key)
print(nonce)
print(chacha20_encrypt(data_, key, nonce))-> codegate2025{C0py_@nd_P4tch?_N0_7hi$_1s_Ch@s_Tr1ck!_W3lc0m3_tO_ChA_W0rld_haha!}
protoss_58
Golang gRPC
This challenge the rev part is easy, the hard part is find a way to communicate with the gRPC…
In main function there is a sus function named main_for_test_have_to_delete, lets take a look on what is it doing. It (loads?) two sus function
.rodata:000000000099FF18 off_99FF18 dq offset protoss_58_internal_auth_VerifyFlag
.rodata:000000000099FF18 ; DATA XREF: main_for_test_have_to_delete+35↑o
.rodata:000000000099FF20 off_99FF20 dq offset protoss_58_internal_auth_VerifyTokenWhen we run the client file our level is just 2 which mean we can’t read where the flag is.
Idx Secret Titles Access Level
00. Xel'Naga's First Experiment 2
01. Dark Templar's Origin 3
02. Colossus Controversy 3
03. Mothership Relics 4
04. Immortals and Dragoons 4
05. Psionic Matrix Vulnerability 2
06. Hidden Guardianship of Lesser Races 3
07. Void Ray Pilots 5
08. Tal'darim's Secrets 3
09. Protoss-Zerg Hybrids 2
10. The location of the flag 1
What secret do you want to read?The goal is maybe find someway to get level 1.
// protoss_58/internal/auth.VerifyToken
// local variable allocation has failed, the output may be wrong!
int32 __golang protoss_58_internal_auth_VerifyToken(string authData)
{
__int64 v1; // r14
int64 i; // rcx
uint8 *b_1; // rax
int32_0 Flag; // edx
int32_0 Flag_1; // edx
size_t len_1; // rdx
char *ptr; // rcx
int cap; // [rsp+8h] [rbp-30h]
int len; // [rsp+10h] [rbp-28h]
____User *p_____User; // [rsp+18h] [rbp-20h]
uint8 *b; // [rsp+20h] [rbp-18h]
uint8 *b_8; // [rsp+28h] [rbp-10h]
void *retaddr; // [rsp+38h] [rbp+0h] BYREF
google_golang_org_protobuf_reflect_protoreflect_ProtoMessage m; // 0:rdi.16
string input; // 0:rax.8,8:rbx.8
string sep; // 0:rcx.8,8:rdi.8
_slice_string v18; // 0:rax.8,8:rbx.8,16:rcx.8
retval_4B2160 v19; // 0:rax.8,8:rbx.8,16:rcx.8
retval_80F6C0 v20; // 0:rax.8,8:rbx.8,16:rcx.8,24:rdi.16 OVERLAPPED
if ( (unsigned __int64)&retaddr <= *(_QWORD *)(v1 + 16) )
{
runtime_morestack_noctxt();
JUMPOUT(0x8101BFLL);
}
sep.str = (uint8 *)".";
sep.len = 1LL;
v18 = strings_genSplit(authData, sep, 0LL, -1LL);
if ( !v18.len )
runtime_panicIndex();
if ( v18.len <= 1uLL )
runtime_panicIndex();
len = v18.array->len;
b_8 = v18.array->str;
v19 = strconv_ParseInt(v18.array[1], 16LL, 64LL);
if ( v19.err.tab )
return 0;
input.len = len;
i = v19.i;
input.str = b_8;
v20 = protoss_58_pkg_utils_DecodeBase58(input, i);
if ( v20._r1.tab )
return 0;
cap = v20._r0.cap;
b = v20._r0.array;
p_____User = (____User *)runtime_newobject((internal_abi_Type *)&RTYPE_____User);
v20._r0.cap = cap;
m.tab = (internal_abi_ITab *)&go_itab__ptr_protoss_58_pkg_api_v1_User_comma_google_golang_org_protobuf_reflect_protoreflect_ProtoMessage;
m.data = p_____User;
b_1 = b;
if ( (unsigned __int64)google_golang_org_protobuf_proto_Unmarshal(v20._r0, m).tab )
return 0;
if ( p_____User )
Flag = p_____User->Flag;
else
Flag = 0;
if ( Flag == 1 )
return 2;
if ( p_____User )
Flag_1 = p_____User->Flag;
else
Flag_1 = 0;
if ( Flag_1 == 57005
&& (!p_____User ? (len_1 = 0LL, ptr = 0LL) : (len_1 = p_____User->Name.len, ptr = p_____User->Name.ptr),
len_1 == 9 && *(_QWORD *)ptr == 0x65646E616D6D6F63LL && ptr[8] == 114) )
{
return 1;
}
else
{
return 3;
}
}In VerifyToken, clearly that we need our username is commander and flag is 0xdead, return back to main we can see our client is just guest and flag 1 to solve this just patch it.
lea rax, aPathkindenumIn+24h ; username
mov ebx, 9 ; username
; Keypatch modified this from:
; mov ebx, 5
mov ecx, 0DEADh ; flag
; Keypatch modified this from:
; mov ecx, 1
nop dword ptr [rax+rax+00h]
call protoss_58_internal_auth_GenerateAuthDataWe will have level 1!!! But where is the flag.
0 content : The Protoss were the first successful experiment of the Xel'Naga, created to achieve 'purity of form.' However, they were abandoned after their psionic link fractured due to rising individualism.
1 content : The Dark Templar were rogue Protoss tribes who rejected the Khala, fearing loss of individuality. They severed their nerve cords and were exiled from Aiur.
2 content : Colossi were banned for centuries after causing mass genocide during the Kalath Intercession. They were reactivated only during the Zerg invasion.
3 content : Motherships, once symbols of Protoss prosperity, were retired as relics of a bygone era. They were brought back into service during dire times to protect their dwindling population.
4 content : Immortals are created from crippled veteran warriors who would have previously been placed in Dragoon exoskeletons. After the fall of Aiur, Immortals replaced Dragoons as a necessity.
5 content : The Protoss rely on a psionic matrix to power their structures and warp in reinforcements. While a strength, it is also a critical vulnerability.
6 content : The Protoss secretly protected many lesser species under their stewardship without revealing their presence. This mirrored Xel'Naga traditions but avoided direct interference.
7 content : Void Rays are piloted by Protoss warriors who adopt a samurai-like code, emphasizing precision and honor in battle.
8 content : The Tal'darim possess forbidden knowledge about Xel'Naga technology and rituals that other Protoss factions consider heretical.
9 content : Secret experiments by Samir Duran (a servant of Amon) led to the creation of Protoss-Zerg hybrids, which pose an existential threat to all life in the galaxy.
10 content : You have to explore the whole galaxy to find it. (Find verify flag function... I think you need top-level access and hidden message for this {hint : secretService.Flag})So we need to invoke secretService.Flag so the VerifyFlag is the last step (isn’t it ? XD)
// protoss_58/internal/auth.VerifyFlag
// local variable allocation has failed, the output may be wrong!
bool __golang protoss_58_internal_auth_VerifyFlag(string hiddenValue)
{
__int64 v1; // r14
int n18; // rcx
unsigned __int64 len; // rdx
char *array; // rsi
unsigned __int64 cap; // rdi
bool result; // al
uint8 r; // r8
int pos; // r9
retval_46F320 v9; // kr00_16
signed __int64 i; // rax
char v11; // r8
unsigned __int64 len_2; // rax
char *oldPtr; // rcx
int newLen; // rbx OVERLAPPED
unsigned __int64 oldCap; // rdi
char v16; // r11
char v17; // r12
char v18; // r10
char v19; // r9
char v20; // r8
unsigned __int64 oldCap_1; // rcx
char *oldPtr_1; // rax
int j; // rax
unsigned __int64 n0x3F; // rdx
char v25; // al
char v26; // [rsp+0h] [rbp-38h]
char v27; // [rsp+1h] [rbp-37h]
char v28; // [rsp+3h] [rbp-35h]
uint8 r_1; // [rsp+4h] [rbp-34h]
unsigned __int64 len_1; // [rsp+8h] [rbp-30h]
unsigned __int64 len_3; // [rsp+18h] [rbp-20h]
int pos_1; // [rsp+20h] [rbp-18h]
char *array_1; // [rsp+28h] [rbp-10h]
void *retaddr; // [rsp+38h] [rbp+0h] BYREF
uint8 *hiddenValue_0; // [rsp+40h] [rbp+8h]
runtime_slice v36; // 0:rax.8,8:rbx.8,16:rcx.8
if ( (unsigned __int64)&retaddr <= *(_QWORD *)(v1 + 16) )
{
runtime_morestack_noctxt();
JUMPOUT(0x810645LL);
}
if ( hiddenValue.len != 18 )
return 0;
hiddenValue_0 = hiddenValue.str;
n18 = 0LL;
len = 0LL;
array = 0LL;
cap = 0LL;
while ( 1 )
{
len_1 = len;
array_1 = array;
if ( n18 >= 18 )
break;
r = hiddenValue.str[n18];
if ( r >= 0x80u )
{
v9 = runtime_decoderune(hiddenValue, n18);
len = len_1;
r = v9.r;
pos = v9.pos;
hiddenValue.str = hiddenValue_0;
hiddenValue.len = 18LL;
}
else
{
pos = n18 + 1;
}
if ( cap < ++len )
{
r_1 = r;
pos_1 = pos;
v36 = runtime_growslice(array, len, cap, 1LL, (internal_abi_Type *)&RTYPE_uint8_0);
r = r_1;
pos = pos_1;
len = v36.len;
array = (char *)v36.array;
cap = v36.cap;
hiddenValue.str = hiddenValue_0;
hiddenValue.len = 18LL;
}
array[len - 1] = r;
n18 = pos;
}
for ( i = 0LL; i < (__int64)len; ++i )
{
if ( i == len - 1 )
{
v11 = 0xA5;
}
else
{
if ( len <= i + 1 )
runtime_panicIndex();
v11 = array[i + 1];
}
array[i] = __ROL1__(__ROL1__(array[i] ^ 0x44, 5) ^ v11, 4);
}
len_2 = 0LL;
oldPtr = 0LL;
newLen = 0LL;
oldCap = 0LL;
while ( (__int64)len_2 < (__int64)len )
{
if ( len_2 >= len )
runtime_panicIndex();
if ( len <= len_2 + 1 )
runtime_panicIndex();
if ( len <= len_2 + 2 )
runtime_panicIndex();
v16 = array[len_2];
v17 = array[len_2 + 1];
v18 = (16 * (v16 & 3)) | (4 * (v17 & 3));
v19 = array[len_2 + 2];
newLen += 4LL;
v20 = v18 | v19 & 3;
if ( oldCap < newLen )
{
len_3 = len_2;
v28 = array[len_2];
v27 = array[len_2 + 2];
v26 = v18 | v19 & 3;
*(runtime_slice *)(&newLen - 1) = runtime_growslice(
oldPtr,
newLen,
oldCap,
4LL,
(internal_abi_Type *)&RTYPE_uint8_0);
len = len_1;
array = array_1;
v20 = v26;
v19 = v27;
v16 = v28;
oldCap = oldCap_1;
oldPtr = oldPtr_1;
len_2 = len_3;
}
oldPtr[newLen - 4] = (unsigned __int8)(v16 & 0xFC) >> 2;
oldPtr[newLen - 3] = (unsigned __int8)(v17 & 0xFC) >> 2;
oldPtr[newLen - 2] = (unsigned __int8)(v19 & 0xFC) >> 2;
oldPtr[newLen - 1] = v20;
len_2 += 3LL;
}
for ( j = 0LL; j < newLen; ++j )
{
n0x3F = (unsigned __int8)oldPtr[j];
if ( n0x3F >= 0x3F )
runtime_panicIndex();
oldPtr[j] = a4e6nqpokbcwmif[n0x3F];
}
result = 0;
if ( newLen == 24 )
{
runtime_memequal();
if ( v25 )
return 1;
}
return result;
}The check is quite easy so I’ll talk much about this. My script to find flag.
# cmp = "lScv9oQ6VgELTPBdHnxp9dND"
mapping = "4E6nQpOkBcWmIfXorxGhg_z81qC3sv79DlRSN5PHeUZAwVYuat0TF2djJbKLyMi"
# for i in range(len(cmp)):
# print(mapping.index(cmp[i]),end=", ")
from pwn import *
cmp = [33, 35, 9, 29, 31, 15, 4, 2, 45, 20, 1, 59, 51, 38, 8, 54, 39, 3, 17, 5, 31, 54, 36, 32]
# print(hex(u64(b'\xDE\xAD')))
from z3 import *
s = Solver()
flag = [BitVec(f'flag_{i}', 32) for i in range(18)]
for i in range(len(flag)):
s.add(flag[i] >= 0x20)
s.add(flag[i] <= 0x7f)
rol = lambda val, r_bits, max_bits: \
(val << r_bits%max_bits) & (2**max_bits-1) | \
((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits)))
def transform_flag(flag):
index = 0
len_flag = len(flag)
result = []
while index < len_flag:
if index >= len_flag or index + 1 >= len_flag or index + 2 >= len_flag:
break
v16 = flag[index]
v17 = flag[index + 1]
v18 = (16 * (v16 & 3)) | (4 * (v17 & 3))
v19 = flag[index + 2]
v20 = v18 | (v19 & 3)
result.append((v16 & 0xFC) >> 2)
result.append((v17 & 0xFC) >> 2)
result.append((v19 & 0xFC) >> 2)
result.append(v20)
# Move to next triplet of bytes
index += 3
return result
# flag = bytearray(b'codegate{aaaaaaaaa')
for i in range(len(flag)-1):
flag[i] = rol(rol(flag[i] ^ 0x44, 5, 8) ^ flag[i+1], 4 , 8)
flag[17] = rol(rol(flag[17] ^ 0x44, 5, 8) ^ 0xA5, 4 , 8)
lmao = transform_flag(flag)
print(lmao)
for i in range(len(lmao)):
# print(mapping[lmao[i]],end="")
s.add(lmao[i] == cmp[i])
if s.check() == sat:
model = s.model()
flag_values = {int(str(k).split('_')[-1]): model[k].as_long() for k in model}
flag_string = ''.join(chr(flag_values[i]) for i in sorted(flag_values))
print(f"Flag: {flag_string}")But the annoying part is how to invoke the service. I’ll try to write my own proto but it failed. Spam ChatGPT can’t help…
After that, I remember that I literally forgot to check init function (dumbass moments). The proto file is at protoss_58_pkg_api_v1_init
b'\n\nauth.proto\x12\x04auth",\n\rVerifyRequest\x12\x1b\n\tauth_data\x18\x01 \x01(\tR\x08authData"K\n\x0eVerifyResponse\x12\x16\n\x06status\x18\x01 \x01(\x05R\x06status\x12!\n\x0caccess_level\x18\x02 \x01(\x05R\x0baccessLevel".\n\x04User\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x12\n\x04flag\x18\x02 \x01(\x05R\x04flag2B\n\x0bAuthService\x123\n\x06Verify\x12\x13.auth.VerifyRequest\x1a\x14.auth.VerifyResponseB\x05Z\x03../b\x06proto'b'\n\x0csecret.proto\x12\x06secret"F\n\x0bSecretTitle\x12!\n\x0caccess_level\x18\x01 \x01(\x05R\x0baccessLevel\x12\x14\n\x05title\x18\x02 \x01(\tR\x05title"+\n\x13SecretTitlesRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token"h\n\x14SecretTitlesResponse\x12\x16\n\x06status\x18\x01 \x01(\x05R\x06status\x128\n\rsecret_titles\x18\x02 \x03(\x0b2\x13.secret.SecretTitleR\x0csecretTitles"D\n\rSecretRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12\x1d\n\nsecret_idx\x18\x02 \x01(\x05R\tsecretIdx"B\n\x0eSecretResponse\x12\x16\n\x06status\x18\x01 \x01(\x05R\x06status\x12\x18\n\x07content\x18\x02 \x01(\tR\x07content";\n\x0bFlagRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12\x16\n\x06hidden\x18\x02 \x01(\tR\x06hidden":\n\x0cFlagResponse\x12\x16\n\x06status\x18\x01 \x01(\x05R\x06status\x12\x12\n\x04flag\x18\x02 \x01(\tR\x04flag2\xc6\x01\n\rSecretService\x12I\n\x0cSecretTitles\x12\x1b.secret.SecretTitlesRequest\x1a\x1c.secret.SecretTitlesResponse\x127\n\x06Secret\x12\x15.secret.SecretRequest\x1a\x16.secret.SecretResponse\x121\n\x04Flag\x12\x13.secret.FlagRequest\x1a\x14.secret.FlagResponseB\x05Z\x03../b\x06proto3'Rewrite it to proto file and try again
syntax = "proto3";
package secret;
message SecretTitle {
int32 access_level = 1;
string title = 2;
}
message SecretTitlesRequest {
string token = 1;
}
message SecretTitlesResponse {
int32 status = 1;
repeated SecretTitle secret_titles = 2;
}
message SecretRequest {
string token = 1;
int32 secret_idx = 2;
}
message SecretResponse {
int32 status = 1;
string content = 2;
}
message FlagRequest {
string token = 1;
string hidden = 2;
}
message FlagResponse {
int32 status = 1;
string flag = 2;
}
service SecretService {
rpc SecretTitles(SecretTitlesRequest) returns (SecretTitlesResponse);
rpc Secret(SecretRequest) returns (SecretResponse);
rpc Flag(FlagRequest) returns (FlagResponse);
}=> grpcurl -plaintext -proto secret.proto -d '{"hidden": "My_1ife_F0r_Aiur!!","token":"771uoeGAjueocQHPomNH.78ceb9cb446f0aef"}' 3.37.15.100:50051 secret.SecretService/Flag
-> codegate2025{c04d0a087f91f6a254b607eea68e12b91529f6b0d6f626a3773df31748661243}
Conclusion
I never believed that one day I could qualify for CodeGate Quals. I really appreciate that my team could do that, my dream came true. But we still need to try harder. GG boiz!!!