buuctf-re

1.findKey

打開是C++而且有點亂,所以找關鍵步驟有一個加密進去是不能反編譯的,有花指令,

請添加圖片描述

這里有重復的部分把下面的NOP掉,重新定義函數’p’

請添加圖片描述

之后分析邏輯,

// positive sp value has been detected, the output may be wrong!
int __userpurge sub_40191F@<eax>(int a1@<ebp>, int a2, int a3, int a4, int a5)
{DWORD v5; // eaxint v6; // ediint v7; // eaxint v8; // eaxconst char *v10; // [esp-458h] [ebp-458h]CHAR *v11; // [esp-454h] [ebp-454h]v5 = strlen(v10);sub_40101E(String1, v5, v11);strcpy((char *)(a1 - 748), "0kk`d1a`55k222k2a776jbfgd`06cjjb");memset((void *)(a1 - 715), 0, 0xDCu);v6 = a1 - 715 + 220;*(_WORD *)v6 = 0;*(_BYTE *)(v6 + 2) = 0;strcpy((char *)(a1 - 760), "SS");*(_DWORD *)(a1 - 757) = 0;*(_WORD *)(a1 - 753) = 0;*(_BYTE *)(a1 - 751) = 0;v7 = strlen((const char *)(a1 - 748));sub_401005((LPCSTR)(a1 - 760), a1 - 748, v7);if ( _strcmpi((const char *)String1, (const char *)(a1 - 748)) ){SetWindowTextA(*(HWND *)(a1 + 8), "flag{}");MessageBoxA(*(HWND *)(a1 + 8), "Are you kidding me?", "^_^", 0);ExitProcess(0);}memcpy((void *)(a1 - 1016), &unk_423030, 0x32u);v8 = strlen((const char *)(a1 - 1016));sub_401005((LPCSTR)(a1 - 492), a1 - 1016, v8);MessageBoxA(*(HWND *)(a1 + 8), (LPCSTR)(a1 - 1016), 0, 0x32u);++dword_428D54;return 0;
}

其中的sub_401005函數一直跟進主要邏輯是:

unsigned int __cdecl sub_401590(LPCSTR lpString, int a2, unsigned int a3)
{unsigned int result; // eaxunsigned int i; // [esp+4Ch] [ebp-Ch]unsigned int v5; // [esp+54h] [ebp-4h]v5 = lstrlenA(lpString);for ( i = 0; ; ++i ){result = i;if ( i >= a3 )break;*(_BYTE *)(i + a2) ^= lpString[i % v5];}return result;
}

可知是異或操作,之后猜測是(a1 - 748)與(a1 - 760)異或之后得到的(a1 - 748)與String1做比較,讓后下面還有一個sub_401005函數操作,我們可以得到unk_423030密文但是沒有密鑰,猜測是我們得到的String1即異或之后的(a1 - 748),可是在12行中有

sub_40101E(String1, v5, v11);

跟進是hash驗證

int __cdecl sub_4013A0(BYTE *pbData, DWORD dwDataLen, LPSTR lpString1)
{DWORD i; // [esp+4Ch] [ebp-24h]CHAR String2[4]; // [esp+50h] [ebp-20h] BYREFBYTE v6[16]; // [esp+54h] [ebp-1Ch] BYREFDWORD pdwDataLen; // [esp+64h] [ebp-Ch] BYREFHCRYPTHASH phHash; // [esp+68h] [ebp-8h] BYREFHCRYPTPROV phProv; // [esp+6Ch] [ebp-4h] BYREFif ( !CryptAcquireContextA(&phProv, 0, 0, 1u, 0xF0000000) )return 0;if ( CryptCreateHash(phProv, 0x8003u, 0, 0, &phHash) ){if ( CryptHashData(phHash, pbData, dwDataLen, 0) ){CryptGetHashParam(phHash, 2u, v6, &pdwDataLen, 0);*lpString1 = 0;for ( i = 0; i < pdwDataLen; ++i ){wsprintfA(String2, "%02X", v6[i]);lstrcatA(lpString1, String2);}CryptDestroyHash(phHash);CryptReleaseContext(phProv, 0);return 1;}else{CryptDestroyHash(phHash);CryptReleaseContext(phProv, 0);return 0;}}else{CryptReleaseContext(phProv, 0);return 0;}
}

我們把得到的String1找網站解決,之后寫代碼即可

請添加圖片描述

代碼:

#include<stdio.h>
#include<string.h>
int main(){char b[] =
{48, 107, 107,  96, 100,  49,  97,  96,  53,  53, 107,  50,  50,  50, 107,  50,  97,  55,  55,  54, 106,  98, 102, 103, 100,  96,  48,  54,  99, 106, 106,  98,   0
};char c[100];	char d[] =
{0x57, 0x5E, 0x52, 0x54, 0x49, 0x5F, 0x01, 0x6D, 0x69, 0x46, 0x02, 0x6E, 0x5F, 0x02, 0x6C, 0x57, 0x5B, 0x54, 0x4C
};int i;for (i=0;i<strlen(b);i++){c[i]='S'^b[i];}puts(c);//hashchar key[] = "123321";//c 's  hashfor (i=0;i<strlen(d);i++){d[i]=key[i%6]^d[i];}puts(d);//flag{n0_Zu0_n0_die}
}

2.SoulLike

有一個關鍵函數sub_83A,之后是顯示太大不可以直接查看源碼,所以調節一下設置即可

去ida文件夾里面的hexrays.cfg,把max_function修改大一些(1024),

請添加圖片描述

之后查看源碼

 v4 = __readfsqword(0x28u);*a1 ^= 0x2Bu;a1[1] ^= 0x6Cu;a1[2] ^= 0x7Eu;a1[3] ^= 0x56u;a1[4] ^= 0x39u;a1[5] ^= 3u;a1[6] ^= 0x2Du;a1[7] ^= 0x28u;a1[8] ^= 8u;++a1[9];a1[10] ^= 0x2Fu;a1[11] ^= 0xAu;++*a1;a1[1] ^= 0xDu;a1[2] ^= 0x73u;a1[3] ^= a1[2];a1[4] ^= 0x37u;++a1[5];a1[6] ^= 0x69u;a1[7] ^= 0x59u;a1[8] ^= 0xCu;a1[9] ^= 0x70u;++a1[10];a1[11] ^= 0x1Fu;++*a1;a1[1] ^= 0x55u;a1[2] ^= a1[1];a1[3] ^= 0x72u;.....

可知是一群異或,并且每一位可能與上一位有關系,我們可以一個一個查找,寫代碼即可

#include<stdio.h>int sub_83A(char *a1,int i);
int main(){char flag[12];char flag1[12];int i,j,k;for (i=0;i<=11;i++){for(j=0;j<=256;j++){flag[i]=j;for(k=0;k<=i;k++){flag1[k]=flag[k];}if(sub_83A(flag1,i))break;}}printf("\nthe flag are:\n");
puts(flag);} int sub_83A(char *a1,int i)
{ // [rsp+1Ch] [rbp-44h]int v3[14]; // [rsp+20h] [rbp-40h]unsigned __int64 v4; // [rsp+58h] [rbp-8h]char flaga=a1[i];//v4 = __readfsqword(0x28u);*a1 ^= 0x2Bu;a1[1] ^= 0x6Cu;a1[2] ^= 0x7Eu;a1[3] ^= 0x56u;a1[4] ^= 0x39u;a1[5] ^= 3u;a1[6] ^= 0x2Du;a1[7] ^= 0x28u;a1[8] ^= 8u;++a1[9];a1[10] ^= 0x2Fu;a1[11] ^= 0xAu;++*a1;a1[1] ^= 0xDu;a1[2] ^= 0x73u;a1[3] ^= a1[2];a1[4] ^= 0x37u;++a1[5];a1[6] ^= 0x69u;a1[7] ^= 0x59u;a1[8] ^= 0xCu;a1[9] ^= 0x70u;++a1[10];a1[11] ^= 0x1Fu;++*a1;a1[1] ^= 0x55u;a1[2] ^= a1[1];a1[3] ^= 0x72u;a1[4] ^= 0x1Fu;++a1[5];a1[6] ^= 0x6Du;a1[7] ^= a1[6];a1[8] ^= a1[7];a1[9] ^= 0x6Du;++a1[10];++a1[11];++*a1;a1[1] ^= 0x76u;a1[2] ^= 0x49u;a1[3] ^= 0x29u;a1[4] ^= 0x17u;a1[5] ^= 0x78u;a1[6] ^= 0x6Eu;a1[7] ^= a1[2];a1[8] ^= 0x2Cu;a1[9] ^= 0xEu;a1[10] ^= 0x1Eu;a1[11] ^= 0x52u;*a1 ^= 0x16u;a1[1] ^= 0x22u;a1[2] ^= a1[1];a1[3] ^= *a1;a1[4] ^= 0x72u;a1[5] ^= 0xCu;a1[6] ^= a1[4];a1[7] ^= 0x5Du;a1[8] ^= 0x47u;++a1[9];a1[10] ^= 0x6Eu;a1[11] ^= a1[5];*a1 ^= 0x73u;++a1[1];a1[2] ^= 0x75u;a1[3] ^= 7u;a1[4] ^= 0x68u;++a1[5];a1[6] ^= 0x41u;a1[7] ^= 0x10u;a1[8] ^= 0x3Bu;a1[9] ^= 0x2Bu;a1[10] ^= 0x65u;++a1[11];*a1 ^= 0x73u;a1[1] ^= 0x74u;a1[2] ^= 0x52u;a1[3] ^= 0x66u;a1[4] ^= 0x41u;a1[5] ^= 0x63u;a1[6] ^= 7u;a1[7] ^= 0x61u;a1[8] ^= 0x32u;a1[9] ^= 0x74u;++a1[10];a1[11] ^= 0x22u;*a1 ^= 2u;a1[1] ^= 0x6Fu;++a1[2];a1[3] ^= 5u;a1[4] ^= 4u;a1[5] ^= 0x6Du;a1[6] ^= a1[2];a1[7] ^= 0x57u;a1[8] ^= 0x3Eu;a1[9] ^= 0x1Bu;a1[10] ^= 0x57u;a1[11] ^= 0x27u;*a1 ^= 0x7Cu;a1[1] ^= 0x58u;++a1[2];a1[3] ^= 0x50u;a1[4] ^= 0x27u;a1[5] ^= a1[4];a1[6] ^= 0x67u;a1[7] ^= 0x41u;a1[8] ^= 0x76u;a1[9] ^= 0x7Au;a1[10] ^= 0x7Cu;++a1[11];++*a1;a1[1] ^= 0x7Du;a1[2] ^= 0x5Bu;a1[3] ^= 0x15u;a1[4] ^= 0xBu;++a1[5];a1[6] ^= 0x61u;a1[7] ^= 0x73u;a1[8] ^= 0x19u;a1[9] ^= 0xBu;a1[10] ^= 1u;a1[11] ^= a1[9];*a1 ^= 0x7Cu;a1[1] ^= 0x21u;a1[2] ^= 0x26u;a1[3] ^= 0x73u;a1[4] ^= 0x26u;a1[5] ^= 0x71u;a1[6] ^= 0x67u;a1[7] ^= 0x54u;a1[8] ^= 7u;a1[9] ^= a1[1];a1[10] ^= 0x20u;++a1[11];*a1 ^= 0xFu;a1[1] ^= 0x21u;a1[2] ^= 0x7Du;a1[3] ^= a1[1];a1[4] ^= 0x5Eu;a1[5] ^= 0x44u;a1[6] ^= 0x73u;a1[7] ^= 0x17u;a1[8] ^= 0x34u;a1[9] ^= 0x7Cu;a1[10] ^= a1[2];a1[11] ^= 0x59u;*a1 ^= 0x2Au;a1[1] ^= 0x37u;a1[2] ^= 0x49u;a1[3] ^= 0x22u;a1[4] ^= 0x68u;a1[5] ^= 0x41u;a1[6] ^= 0x61u;a1[7] ^= a1[5];a1[8] ^= 0x29u;++a1[9];a1[10] ^= 0x16u;++a1[11];*a1 ^= 0x29u;a1[1] ^= 0x2Cu;a1[2] ^= 0x47u;a1[3] ^= a1[1];a1[4] ^= 0x3Fu;a1[5] ^= 0x42u;a1[6] ^= 0x62u;++a1[7];a1[8] ^= 0x33u;a1[9] ^= 0x69u;a1[10] ^= 0x5Cu;a1[11] ^= 0x14u;*a1 ^= 1u;a1[1] ^= 0x33u;a1[2] ^= 0x27u;a1[3] ^= 0x29u;a1[4] ^= 0xCu;a1[5] ^= 0x2Fu;a1[6] ^= 0x45u;a1[7] ^= a1[2];a1[8] ^= 0x16u;a1[9] ^= 0x7Eu;a1[10] ^= 0x44u;a1[11] ^= 0x42u;*a1 ^= 0x66u;a1[1] ^= 0x14u;a1[2] ^= 0x33u;a1[3] ^= a1[1];a1[4] ^= 0x26u;a1[5] ^= 0x60u;a1[6] ^= 0x15u;a1[7] ^= 0x4Cu;a1[8] ^= 0x68u;a1[9] ^= 0xCu;a1[10] ^= 0x26u;a1[11] ^= 0x15u;*a1 ^= 0x43u;a1[1] ^= 0x5Cu;a1[2] ^= 0x75u;a1[3] ^= 0x4Eu;a1[4] ^= 0x6Cu;a1[5] ^= 0x73u;a1[6] ^= 0x17u;a1[7] ^= 0x2Bu;a1[8] ^= 0x5Cu;a1[9] ^= 0x1Du;a1[10] ^= a1[4];a1[11] ^= 0x2Au;*a1 ^= 0x7Du;a1[1] ^= 0x2Cu;a1[2] ^= 0x7Du;a1[3] ^= 0x4Cu;a1[4] ^= 0x55u;a1[5] ^= 0x67u;a1[6] ^= 0x69u;a1[7] ^= 0x23u;a1[8] ^= 0x27u;a1[9] ^= 0x66u;a1[10] ^= 0x4Bu;a1[11] ^= 2u;*a1 ^= 0x3Au;++a1[1];a1[2] ^= 0x5Cu;a1[3] ^= 0x68u;a1[4] ^= 0x51u;a1[5] ^= 0x74u;++a1[6];a1[7] ^= 0x23u;a1[8] ^= 0x11u;a1[9] ^= 0x34u;a1[10] ^= 0x2Du;a1[11] ^= 0x26u;*a1 ^= 0x14u;a1[1] ^= *a1;a1[2] ^= 0x20u;a1[3] ^= 0x2Fu;a1[4] ^= 0x33u;a1[5] ^= *a1;a1[6] ^= 0x36u;a1[7] ^= *a1;a1[8] ^= a1[4];a1[9] ^= 0x77u;a1[10] ^= 0x30u;a1[11] ^= 0x50u;++*a1;a1[1] ^= 0x45u;++a1[2];a1[3] ^= 0x53u;a1[4] ^= 0x68u;a1[5] ^= 0x4Au;a1[6] ^= 0x38u;a1[7] ^= 0x18u;a1[8] ^= a1[6];a1[9] ^= 0x2Bu;a1[10] ^= 0x6Au;a1[11] ^= 0x28u;*a1 ^= 0x75u;a1[1] ^= *a1;a1[2] ^= 0x7Cu;a1[3] ^= *a1;a1[4] ^= 0x38u;a1[5] ^= 0x75u;a1[6] ^= a1[5];a1[7] ^= 0x2Bu;++a1[8];a1[9] ^= 0x36u;a1[10] ^= 0x6Eu;a1[11] ^= 0x7Fu;*a1 ^= 0x5Cu;a1[1] ^= 0x16u;a1[2] ^= 0x16u;a1[3] ^= a1[1];a1[4] ^= 0x73u;a1[5] ^= 0x63u;a1[6] ^= 0x5Au;a1[7] ^= 0x35u;a1[8] ^= 0x1Cu;a1[9] ^= 0x43u;a1[10] ^= 0x26u;a1[11] ^= a1[3];*a1 ^= 0x1Au;a1[1] ^= *a1;a1[2] ^= 0x18u;a1[3] ^= 0x40u;++a1[4];a1[5] ^= 9u;a1[6] ^= 0x5Cu;a1[7] ^= 0x3Au;a1[8] ^= 0x68u;a1[9] ^= 0x2Eu;++a1[10];++a1[11];*a1 ^= 0x6Cu;a1[1] ^= *a1;a1[2] ^= *a1;a1[3] ^= 6u;a1[4] ^= 0x76u;a1[5] ^= 0x29u;a1[6] ^= 8u;a1[7] ^= 0x7Au;a1[8] ^= 0x58u;a1[9] ^= 0x31u;++a1[10];a1[11] ^= 0x24u;*a1 ^= 0x42u;a1[1] ^= 0x1Fu;a1[2] ^= 0x72u;++a1[3];a1[4] ^= 0x11u;a1[5] ^= 0x72u;a1[6] ^= a1[2];a1[7] ^= 0x56u;a1[8] ^= 0x16u;a1[9] ^= 0x15u;a1[10] ^= 0x30u;a1[11] ^= a1[1];*a1 ^= 0x7Fu;a1[1] ^= 0x7Eu;a1[2] ^= 0x49u;++a1[3];a1[4] ^= 0x72u;++a1[5];a1[6] ^= 6u;a1[7] ^= 0x61u;a1[8] ^= a1[2];a1[9] ^= 0x44u;a1[10] ^= 0x25u;a1[11] ^= 0x13u;*a1 ^= 0x7Eu;a1[1] ^= 7u;a1[2] ^= 0x1Bu;a1[3] ^= 0x62u;a1[4] ^= 0x34u;a1[5] ^= 0x2Cu;a1[6] ^= 0xEu;a1[7] ^= 0x52u;a1[8] ^= 0x7Bu;a1[9] ^= 0x6Fu;a1[10] ^= 0x7Au;a1[11] ^= 0x7Du;++*a1;a1[1] ^= 0x6Fu;++a1[2];++a1[3];a1[4] ^= 0x67u;a1[5] ^= 0x16u;a1[6] ^= 0xBu;a1[7] ^= 0x7Bu;a1[8] ^= 0x4Au;a1[9] ^= 0x2Eu;a1[10] ^= 0x37u;a1[11] ^= 0xBu;*a1 ^= 0x3Eu;a1[1] ^= 0x2Cu;a1[2] ^= *a1;a1[3] ^= 0x7Au;++a1[4];a1[5] ^= 0x74u;a1[6] ^= 0x6Du;a1[7] ^= 0x6Bu;a1[8] ^= 0x1Eu;a1[9] ^= 0x25u;a1[10] ^= 0x19u;++a1[11];*a1 ^= 0x3Au;a1[1] ^= 0x4Eu;a1[2] ^= 0x27u;a1[3] ^= 0xAu;a1[4] ^= 0x3Eu;a1[5] ^= 0x7Fu;a1[6] ^= 0x20u;a1[7] ^= 0x3Cu;a1[8] ^= 0x5Eu;a1[9] ^= 0x56u;a1[10] ^= a1[1];a1[11] ^= 0x48u;*a1 ^= 0x3Fu;++a1[1];a1[2] ^= 0x72u;++a1[3];++a1[4];++a1[5];a1[6] ^= 0x44u;a1[7] ^= 0x2Eu;a1[8] ^= 0x44u;a1[9] ^= 0x74u;a1[10] ^= 0x7Eu;a1[11] ^= 0x30u;*a1 ^= 0x66u;a1[1] ^= *a1;a1[2] ^= 0x63u;a1[3] ^= 0x5Du;a1[4] ^= 0x55u;a1[5] ^= 0x1Au;a1[6] ^= a1[1];a1[7] ^= 0x68u;a1[8] ^= 0x46u;++a1[9];++a1[10];a1[11] ^= 0x75u;++*a1;a1[1] ^= 0x23u;a1[2] ^= 0x48u;a1[3] ^= 0x3Du;a1[4] ^= a1[2];a1[5] ^= 0x14u;a1[6] ^= 0x7Du;a1[7] ^= 0x67u;++a1[8];a1[9] ^= 0x4Fu;a1[10] ^= 0x56u;a1[11] ^= a1[4];*a1 ^= 0x30u;++a1[1];a1[2] ^= 0x3Bu;a1[3] ^= *a1;a1[4] ^= 0x7Bu;a1[5] ^= 0x38u;++a1[6];a1[7] ^= 4u;a1[8] ^= 0x2Eu;a1[9] ^= a1[1];a1[10] ^= a1[4];a1[11] ^= 0x20u;*a1 ^= 0x4Bu;++a1[1];++a1[2];a1[3] ^= 0x7Eu;a1[4] ^= 0x65u;a1[5] ^= 0x14u;a1[6] ^= 0x5Eu;a1[7] ^= 0x3Au;++a1[8];a1[9] ^= 0x7Fu;++a1[10];a1[11] ^= 0xBu;*a1 ^= 0x6Bu;a1[1] ^= 0x4Fu;a1[2] ^= *a1;a1[3] ^= 0x6Au;a1[4] ^= 0x6Fu;a1[5] ^= 0x3Bu;++a1[6];a1[7] ^= 0x2Eu;a1[8] ^= a1[6];a1[9] ^= 0x39u;a1[10] ^= 0x13u;a1[11] ^= 0x59u;*a1 ^= 0x4Fu;a1[1] ^= 0x54u;a1[2] ^= 0x33u;++a1[3];a1[4] ^= 0x1Eu;a1[5] ^= 0x76u;a1[6] ^= 0x77u;a1[7] ^= 4u;a1[8] ^= 0x45u;++a1[9];a1[10] ^= 0x20u;a1[11] ^= 0x58u;++*a1;a1[1] ^= 0x4Bu;a1[2] ^= 0x44u;++a1[3];a1[4] ^= 0x3Cu;a1[5] ^= 0x21u;a1[6] ^= a1[5];a1[7] ^= 2u;a1[8] ^= 0x5Bu;a1[9] ^= 0x3Cu;a1[10] ^= 0x70u;a1[11] ^= 0x3Bu;*a1 ^= 0x20u;a1[1] ^= 0x15u;a1[2] ^= 0x17u;a1[3] ^= 0x20u;a1[4] ^= 0x39u;a1[5] ^= a1[4];a1[6] ^= 0x3Fu;a1[7] ^= a1[4];a1[8] ^= 0x4Bu;a1[9] ^= 0x58u;a1[10] ^= 0x55u;a1[11] ^= 0x4Bu;*a1 ^= 0x2Cu;a1[1] ^= 0x6Eu;a1[2] ^= 0x27u;a1[3] ^= a1[1];a1[4] ^= 4u;++a1[5];++a1[6];a1[7] ^= 0x1Bu;a1[8] ^= 0x3Cu;a1[9] ^= 0x65u;a1[10] ^= 0x53u;a1[11] ^= 8u;*a1 ^= 0x79u;a1[1] ^= 0x2Cu;a1[2] ^= 0xCu;a1[3] ^= 0x11u;a1[4] ^= 0x11u;++a1[5];a1[6] ^= 0x5Cu;a1[7] ^= 0x1Du;a1[8] ^= 0x2Fu;a1[9] ^= a1[2];a1[10] ^= 0x12u;a1[11] ^= a1[2];*a1 ^= 0x36u;a1[1] ^= 0x7Fu;++a1[2];a1[3] ^= 0x2Du;a1[4] ^= 0x78u;a1[5] ^= 8u;a1[6] ^= 0x6Fu;a1[7] ^= 0x51u;a1[8] ^= 0x36u;a1[9] ^= 0x64u;++a1[10];a1[11] ^= 0x4Cu;++*a1;a1[1] ^= 0x49u;a1[2] ^= 9u;a1[3] ^= 0x50u;a1[4] ^= 0x13u;a1[5] ^= 0x64u;a1[6] ^= 0x5Eu;a1[7] ^= a1[3];a1[8] ^= 0x34u;a1[9] ^= 0x39u;a1[10] ^= a1[9];a1[11] ^= 7u;++*a1;a1[1] ^= 0x48u;a1[2] ^= 0x7Cu;a1[3] ^= 0x50u;a1[4] ^= 0x55u;a1[5] ^= 0x48u;a1[6] ^= 0x6Du;a1[7] ^= 0x7Cu;a1[8] ^= 0x46u;a1[9] ^= 0x72u;a1[10] ^= 0x77u;a1[11] ^= a1[6];*a1 ^= 0x71u;a1[1] ^= *a1;a1[2] ^= 0x52u;a1[3] ^= 0x38u;a1[4] ^= 0x4Du;a1[5] ^= 0xAu;a1[6] ^= 0x4Cu;a1[7] ^= a1[2];a1[8] ^= 0x3Cu;a1[9] ^= 0x4Au;a1[10] ^= 0x37u;++a1[11];*a1 ^= 0x43u;++a1[1];++a1[2];a1[3] ^= 0x29u;a1[4] ^= a1[2];a1[5] ^= 0x4Au;a1[6] ^= 0x32u;++a1[7];a1[8] ^= 0x27u;a1[9] ^= 0x4Eu;a1[10] ^= 0x16u;a1[11] ^= 0x73u;*a1 ^= 0x22u;a1[1] ^= 0x59u;a1[2] ^= *a1;a1[3] ^= 0x29u;a1[4] ^= 1u;a1[5] ^= 0x1Bu;a1[6] ^= 0x35u;++a1[7];a1[8] ^= 0xDu;a1[9] ^= 0x20u;a1[10] ^= 0x42u;a1[11] ^= 0x29u;*a1 ^= 0x77u;++a1[1];a1[2] ^= 0x36u;a1[3] ^= 0x30u;a1[4] ^= 0x60u;a1[5] ^= 0x52u;a1[6] ^= 0x3Cu;a1[7] ^= 0xAu;a1[8] ^= a1[2];a1[9] ^= 0x78u;++a1[10];++a1[11];*a1 ^= 0x5Du;a1[1] ^= *a1;a1[2] ^= a1[1];a1[3] ^= 0x4Bu;a1[4] ^= 0x1Eu;a1[5] ^= *a1;a1[6] ^= 0xFu;++a1[7];a1[8] ^= 0x64u;++a1[9];++a1[10];++a1[11];*a1 ^= 0x17u;++a1[1];a1[2] ^= 0x78u;a1[3] ^= a1[2];a1[4] ^= 0x5Eu;a1[5] ^= 0x53u;a1[6] ^= a1[2];a1[7] ^= 0x2Du;a1[8] ^= 4u;a1[9] ^= 0x3Du;++a1[10];a1[11] ^= 1u;*a1 ^= 0x41u;a1[1] ^= 0x31u;a1[2] ^= 0x4Au;++a1[3];a1[4] ^= 0x73u;++a1[5];a1[6] ^= 0x5Du;a1[7] ^= 0x11u;++a1[8];a1[9] ^= 3u;++a1[10];++a1[11];*a1 ^= 0x2Cu;a1[1] ^= *a1;a1[2] ^= a1[1];a1[3] ^= 0x53u;a1[4] ^= 0x50u;a1[5] ^= a1[1];a1[6] ^= 0xFu;a1[7] ^= 0x13u;a1[8] ^= 0x21u;a1[9] ^= 0x55u;++a1[10];a1[11] ^= 0x3Cu;++*a1;a1[1] ^= 0x38u;a1[2] ^= 0x2Du;a1[3] ^= 0x7Fu;a1[4] ^= 0x73u;a1[5] ^= 0x56u;a1[6] ^= 0xFu;a1[7] ^= a1[4];a1[8] ^= 0x1Eu;a1[9] ^= 3u;++a1[10];a1[11] ^= 0x64u;*a1 ^= 0x6Eu;a1[1] ^= 0x5Bu;a1[2] ^= 0x4Au;a1[3] ^= 0x4Bu;a1[4] ^= 0x1Eu;a1[5] ^= 0x60u;a1[6] ^= 0xEu;a1[7] ^= a1[4];a1[8] ^= 8u;a1[9] ^= 0x35u;a1[10] ^= a1[8];a1[11] ^= 0x1Bu;*a1 ^= 0x6Eu;a1[1] ^= 0x32u;a1[2] ^= 0x66u;a1[3] ^= 0x7Cu;a1[4] ^= 0x3Au;a1[5] ^= 0x1Eu;a1[6] ^= 0x53u;a1[7] ^= 0x12u;++a1[8];a1[9] ^= 0x64u;a1[10] ^= 0x6Du;a1[11] ^= 0x6Fu;*a1 ^= 0x5Fu;a1[1] ^= 0x3Au;a1[2] ^= *a1;a1[3] ^= 0x58u;a1[4] ^= *a1;a1[5] ^= a1[1];a1[6] ^= 0x7Cu;a1[7] ^= 0x10u;a1[8] ^= a1[7];a1[9] ^= 0x6Cu;a1[10] ^= 0x34u;a1[11] ^= 0x2Fu;*a1 ^= 0xFu;++a1[1];a1[2] ^= 0x42u;a1[3] ^= 0x3Bu;a1[4] ^= *a1;a1[5] ^= 0x66u;a1[6] ^= 6u;a1[7] ^= 0x2Bu;a1[8] ^= 0x78u;a1[9] ^= 0x1Cu;a1[10] ^= 0x27u;a1[11] ^= 0x15u;*a1 ^= 0x14u;++a1[1];a1[2] ^= 2u;a1[3] ^= 0x74u;a1[4] ^= 0x32u;a1[5] ^= 8u;++a1[6];a1[7] ^= 0x5Au;a1[8] ^= a1[1];a1[9] ^= 0x71u;a1[10] ^= 0x62u;a1[11] ^= a1[9];*a1 ^= 0x42u;a1[1] ^= 5u;a1[2] ^= *a1;a1[3] ^= 0x5Au;a1[4] ^= a1[2];a1[5] ^= 0x16u;++a1[6];a1[7] ^= 0x75u;++a1[8];++a1[9];a1[10] ^= 0x5Eu;++a1[11];*a1 ^= 0x49u;++a1[1];a1[2] ^= 0x26u;a1[3] ^= 0x2Bu;a1[4] ^= 0x3Au;a1[5] ^= a1[3];a1[6] ^= 0x59u;a1[7] ^= 0x4Du;++a1[8];a1[9] ^= 0x1Eu;a1[10] ^= *a1;a1[11] ^= 0x25u;++*a1;a1[1] ^= 0x46u;a1[2] ^= 0x40u;a1[3] ^= a1[1];a1[4] ^= 0x21u;a1[5] ^= 0x7Au;++a1[6];a1[7] ^= 0x2Au;a1[8] ^= a1[1];a1[9] ^= a1[1];a1[10] ^= 0x11u;a1[11] ^= 0x72u;*a1 ^= 8u;a1[1] ^= *a1;a1[2] ^= 5u;a1[3] ^= 0x7Bu;++a1[4];++a1[5];a1[6] ^= 0x59u;a1[7] ^= *a1;a1[8] ^= 0x78u;a1[9] ^= 0x4Cu;a1[10] ^= a1[4];a1[11] ^= 0x67u;*a1 ^= 0x5Cu;a1[1] ^= *a1;a1[2] ^= 0x71u;a1[3] ^= *a1;a1[4] ^= 0x2Fu;++a1[5];++a1[6];a1[7] ^= 0x71u;a1[8] ^= 9u;a1[9] ^= a1[1];a1[10] ^= 0x6Au;a1[11] ^= 0x1Bu;*a1 ^= 0xEu;a1[1] ^= 0x2Au;a1[2] ^= 0x3Bu;++a1[3];++a1[4];++a1[5];a1[6] ^= 0x4Cu;++a1[7];a1[8] ^= 0x4Cu;a1[9] ^= 0x5Du;a1[10] ^= 0x47u;a1[11] ^= 0x23u;*a1 ^= 0x63u;a1[1] ^= 0x58u;a1[2] ^= 0x32u;a1[3] ^= *a1;a1[4] ^= 0x57u;++a1[5];a1[6] ^= 0x33u;a1[7] ^= 0x3Du;a1[8] ^= a1[3];a1[9] ^= a1[7];a1[10] ^= 0x16u;a1[11] ^= a1[1];*a1 ^= 0x17u;a1[1] ^= *a1;a1[2] ^= 0x48u;++a1[3];a1[4] ^= 2u;a1[5] ^= 0x4Fu;a1[6] ^= 0x2Eu;a1[7] ^= 0x3Eu;++a1[8];a1[9] ^= 0x26u;a1[10] ^= a1[8];a1[11] ^= a1[9];*a1 ^= 0x54u;a1[1] ^= 0x40u;++a1[2];a1[3] ^= 0x33u;a1[4] ^= 0x7Au;a1[5] ^= 0x40u;a1[6] ^= 0x67u;++a1[7];a1[8] ^= 0x3Du;a1[9] ^= 0x2Du;a1[10] ^= 0x3Bu;a1[11] ^= 0x7Du;*a1 ^= 0x1Bu;++a1[1];a1[2] ^= 0x66u;a1[3] ^= 0x6Eu;a1[4] ^= 0x7Eu;++a1[5];a1[6] ^= 0x59u;a1[7] ^= 0x73u;a1[8] ^= 1u;++a1[9];a1[10] ^= 0x5Du;a1[11] ^= 0x55u;*a1 ^= 0x58u;a1[1] ^= 0x29u;a1[2] ^= a1[1];a1[3] ^= 0x6Du;a1[4] ^= a1[3];a1[5] ^= *a1;a1[6] ^= 0x2Fu;a1[7] ^= 0x66u;a1[8] ^= a1[5];a1[9] ^= 0x6Fu;a1[10] ^= a1[4];a1[11] ^= 0x25u;*a1 ^= 0x5Du;a1[1] ^= 0x73u;++a1[2];a1[3] ^= 0x64u;++a1[4];a1[5] ^= 0x60u;a1[6] ^= 0x5Eu;++a1[7];a1[8] ^= 0xFu;a1[9] ^= 0x5Cu;a1[10] ^= a1[1];a1[11] ^= 0x2Bu;*a1 ^= 0x5Eu;a1[1] ^= 0x69u;a1[2] ^= 0x35u;a1[3] ^= 0x73u;a1[4] ^= a1[2];a1[5] ^= 0x5Cu;a1[6] ^= 0x79u;a1[7] ^= 0x33u;a1[8] ^= 0x20u;a1[9] ^= 0x6Cu;a1[10] ^= 0x23u;a1[11] ^= 0x52u;*a1 ^= 0x39u;++a1[1];a1[2] ^= 0x6Fu;a1[3] ^= 0x23u;a1[4] ^= 0x40u;a1[5] ^= 0x75u;++a1[6];a1[7] ^= 0x5Du;a1[8] ^= a1[4];a1[9] ^= 0x5Eu;a1[10] ^= a1[9];a1[11] ^= 0x20u;*a1 ^= 0xFu;++a1[1];++a1[2];a1[3] ^= 0x10u;a1[4] ^= a1[3];a1[5] ^= a1[3];a1[6] ^= a1[2];a1[7] ^= 0x15u;a1[8] ^= a1[7];a1[9] ^= 0x36u;a1[10] ^= a1[6];a1[11] ^= 0x7Du;*a1 ^= 0x54u;a1[1] ^= *a1;a1[2] ^= 0x6Eu;a1[3] ^= 0x1Bu;a1[4] ^= 0x30u;a1[5] ^= a1[2];a1[6] ^= a1[5];a1[7] ^= 0x3Bu;a1[8] ^= 0x7Eu;a1[9] ^= 0x1Eu;a1[10] ^= 0x29u;a1[11] ^= a1[7];*a1 ^= 6u;a1[1] ^= 0x4Fu;a1[2] ^= a1[1];a1[3] ^= 0x2Du;a1[4] ^= 0x2Fu;a1[5] ^= 0x52u;a1[6] ^= 0x41u;a1[7] ^= 0x4Au;++a1[8];a1[9] ^= 0x54u;a1[10] ^= 0x57u;a1[11] ^= 5u;*a1 ^= 0x35u;a1[1] ^= *a1;a1[2] ^= 0x61u;a1[3] ^= a1[2];a1[4] ^= 3u;a1[5] ^= 0x55u;a1[6] ^= 0x5Fu;++a1[7];a1[8] ^= 0x22u;a1[9] ^= 0x3Bu;++a1[10];++a1[11];*a1 ^= 0x1Eu;a1[1] ^= 0x77u;a1[2] ^= 0x60u;a1[3] ^= 0x4Cu;a1[4] ^= 0x4Fu;a1[5] ^= a1[4];a1[6] ^= 0x7Du;a1[7] ^= *a1;a1[8] ^= 0x2Du;++a1[9];a1[10] ^= 0x26u;a1[11] ^= 0x29u;++*a1;a1[1] ^= 0x1Eu;a1[2] ^= 0x2Fu;a1[3] ^= a1[2];a1[4] ^= 0x54u;a1[5] ^= 0xCu;a1[6] ^= 0x24u;a1[7] ^= 0x25u;++a1[8];a1[9] ^= 0x75u;a1[10] ^= 0x2Au;a1[11] ^= 0x54u;*a1 ^= 0x37u;a1[1] ^= 0x47u;a1[2] ^= 9u;a1[3] ^= 0x75u;a1[4] ^= 0x1Eu;a1[5] ^= 0x5Du;a1[6] ^= 0x21u;a1[7] ^= 0x58u;a1[8] ^= 0x60u;a1[9] ^= 0x3Cu;a1[10] ^= 0x2Du;a1[11] ^= 0x7Cu;++*a1;a1[1] ^= 6u;a1[2] ^= 7u;++a1[3];a1[4] ^= 0x3Bu;a1[5] ^= 0x1Bu;a1[6] ^= a1[1];a1[7] ^= 0x26u;a1[8] ^= 0x3Du;++a1[9];a1[10] ^= 0x7Fu;++a1[11];*a1 ^= 0x2Cu;a1[1] ^= 0x1Eu;a1[2] ^= 0x1Du;a1[3] ^= 0x3Au;a1[4] ^= 0x1Bu;a1[5] ^= 0x7Bu;a1[6] ^= 0x44u;a1[7] ^= a1[2];a1[8] ^= 0x38u;++a1[9];a1[10] ^= 0x3Eu;++a1[11];++*a1;++a1[1];a1[2] ^= 0xAu;a1[3] ^= 0xFu;a1[4] ^= 0xBu;a1[5] ^= a1[1];a1[6] ^= 0x25u;++a1[7];a1[8] ^= 0x54u;a1[9] ^= 0x70u;a1[10] ^= 6u;a1[11] ^= 6u;*a1 ^= 0x3Du;a1[1] ^= 0xEu;a1[2] ^= 0x19u;a1[3] ^= 0x61u;a1[4] ^= a1[2];a1[5] ^= 0x7Fu;a1[6] ^= 0x65u;a1[7] ^= 0x44u;a1[8] ^= 0x61u;a1[9] ^= 0x79u;++a1[10];++a1[11];*a1 ^= 0x3Fu;a1[1] ^= 0x54u;a1[2] ^= a1[1];a1[3] ^= 9u;a1[4] ^= a1[2];a1[5] ^= a1[2];a1[6] ^= 0x59u;a1[7] ^= a1[6];a1[8] ^= a1[4];a1[9] ^= 0x61u;a1[10] ^= 0x6Eu;++a1[11];*a1 ^= 0x46u;++a1[1];++a1[2];a1[3] ^= 0x1Cu;a1[4] ^= 0x6Au;a1[5] ^= 5u;a1[6] ^= 0x74u;a1[7] ^= 0x10u;a1[8] ^= a1[1];a1[9] ^= 0x4Bu;a1[10] ^= 0x1Du;a1[11] ^= 0x51u;++*a1;++a1[1];a1[2] ^= 0x3Bu;++a1[3];++a1[4];a1[5] ^= 0x37u;a1[6] ^= 0x41u;a1[7] ^= a1[4];a1[8] ^= a1[6];a1[9] ^= *a1;a1[10] ^= 0x11u;a1[11] ^= a1[2];*a1 ^= 0x21u;a1[1] ^= 9u;a1[2] ^= a1[1];a1[3] ^= 0x19u;++a1[4];a1[5] ^= 0x37u;a1[6] ^= 0x6Bu;++a1[7];a1[8] ^= 0xCu;++a1[9];a1[10] ^= 0x28u;a1[11] ^= 0x5Eu;*a1 ^= 0x24u;a1[1] ^= *a1;a1[2] ^= 0x7Cu;a1[3] ^= 0x4Cu;a1[4] ^= 0x39u;a1[5] ^= 0x34u;a1[6] ^= 0x4Du;a1[7] ^= 0x55u;a1[8] ^= a1[3];a1[9] ^= 0x4Bu;a1[10] ^= 0x7Du;++a1[11];*a1 ^= 0x1Au;a1[1] ^= 0x69u;a1[2] ^= 0x72u;++a1[3];a1[4] ^= 0x7Cu;++a1[5];a1[6] ^= 0x7Du;++a1[7];a1[8] ^= 0x7Eu;a1[9] ^= 0x6Au;a1[10] ^= 0x11u;a1[11] ^= *a1;*a1 ^= 0x7Cu;a1[1] ^= 0x5Au;a1[2] ^= *a1;a1[3] ^= 0xFu;a1[4] ^= 0x5Bu;a1[5] ^= 0x50u;a1[6] ^= a1[4];a1[7] ^= 0x28u;a1[8] ^= 0xFu;a1[9] ^= 0x15u;a1[10] ^= 0x4Au;a1[11] ^= 0xAu;++*a1;a1[1] ^= 0x11u;a1[2] ^= 0x39u;a1[3] ^= 0x65u;++a1[4];a1[5] ^= 0x71u;a1[6] ^= 0x66u;a1[7] ^= a1[6];a1[8] ^= 0x4Au;a1[9] ^= 0x27u;++a1[10];++a1[11];*a1 ^= 0x1Du;a1[1] ^= 0x68u;a1[2] ^= 0x6Eu;a1[3] ^= 0x28u;a1[4] ^= 6u;++a1[5];a1[6] ^= 0x30u;++a1[7];a1[8] ^= 0x5Du;a1[9] ^= a1[7];a1[10] ^= 0x61u;++a1[11];*a1 ^= 0x15u;++a1[1];a1[2] ^= 0x2Du;a1[3] ^= 0x24u;++a1[4];a1[5] ^= 0x5Fu;a1[6] ^= a1[2];a1[7] ^= 0x23u;a1[8] ^= 0x10u;++a1[9];a1[10] ^= 0x7Eu;a1[11] ^= *a1;*a1 ^= 0x32u;a1[1] ^= 2u;a1[2] ^= a1[1];a1[3] ^= a1[2];a1[4] ^= 0x39u;a1[5] ^= 0x59u;a1[6] ^= 0x69u;a1[7] ^= *a1;a1[8] ^= 0x32u;a1[9] ^= 0x17u;++a1[10];a1[11] ^= 9u;*a1 ^= 0x6Du;a1[1] ^= *a1;a1[2] ^= a1[1];a1[3] ^= *a1;a1[4] ^= 0x6Du;a1[5] ^= 0x7Cu;a1[6] ^= 5u;++a1[7];a1[8] ^= 0x23u;a1[9] ^= a1[4];a1[10] ^= 0x5Au;++a1[11];*a1 ^= 0x29u;a1[1] ^= 0x13u;a1[2] ^= 0x5Fu;a1[3] ^= *a1;a1[4] ^= 0x11u;a1[5] ^= 0x32u;++a1[6];a1[7] ^= 0x3Au;a1[8] ^= a1[1];a1[9] ^= 0x3Du;a1[10] ^= *a1;a1[11] ^= a1[4];*a1 ^= 0x2Du;a1[1] ^= *a1;a1[2] ^= a1[1];a1[3] ^= a1[2];a1[4] ^= 0x27u;a1[5] ^= 0x20u;a1[6] ^= 0x7Fu;a1[7] ^= 0x53u;a1[8] ^= a1[4];a1[9] ^= a1[1];a1[10] ^= 0x44u;a1[11] ^= 0x74u;*a1 ^= 0x2Eu;a1[1] ^= 7u;a1[2] ^= 3u;++a1[3];a1[4] ^= 0x32u;a1[5] ^= 0x16u;a1[6] ^= 0x1Cu;a1[7] ^= 6u;++a1[8];a1[9] ^= 0x5Du;a1[10] ^= 0x2Fu;a1[11] ^= 0x31u;*a1 ^= 0xFu;a1[1] ^= *a1;a1[2] ^= *a1;a1[3] ^= a1[2];a1[4] ^= 0x40u;a1[5] ^= 0x14u;a1[6] ^= 0x64u;a1[7] ^= 0x47u;a1[8] ^= a1[7];a1[9] ^= 0x57u;a1[10] ^= a1[2];a1[11] ^= 0x20u;*a1 ^= 0x59u;a1[1] ^= 0x74u;a1[2] ^= *a1;a1[3] ^= 0x7Du;a1[4] ^= 0x23u;a1[5] ^= 0x25u;a1[6] ^= 0x11u;a1[7] ^= a1[1];a1[8] ^= 0x53u;a1[9] ^= 0x49u;a1[10] ^= 0x78u;a1[11] ^= 0x68u;*a1 ^= 0x4Du;a1[1] ^= 0x70u;a1[2] ^= 4u;a1[3] ^= 0x2Eu;a1[4] ^= 0x35u;a1[5] ^= 0x78u;a1[6] ^= 0x53u;a1[7] ^= 0x66u;a1[8] ^= 0xCu;a1[9] ^= a1[2];a1[10] ^= 0x1Bu;++a1[11];*a1 ^= 2u;a1[1] ^= 0x2Du;a1[2] ^= a1[1];a1[3] ^= 0x54u;a1[4] ^= 7u;++a1[5];++a1[6];a1[7] ^= 2u;a1[8] ^= 0x47u;a1[9] ^= a1[5];a1[10] ^= 0x6Eu;a1[11] ^= a1[2];*a1 ^= 6u;a1[1] ^= 0x4Cu;a1[2] ^= *a1;a1[3] ^= *a1;a1[4] ^= 0x76u;a1[5] ^= a1[3];a1[6] ^= a1[3];a1[7] ^= a1[2];a1[8] ^= 0x24u;++a1[9];a1[10] ^= 0x7Cu;a1[11] ^= 0x20u;*a1 ^= 2u;a1[1] ^= *a1;a1[2] ^= 0x58u;++a1[3];a1[4] ^= 0x5Cu;a1[5] ^= a1[2];a1[6] ^= 0x6Au;a1[7] ^= 9u;a1[8] ^= *a1;a1[9] ^= 0x55u;a1[10] ^= 0x57u;a1[11] ^= 0x15u;*a1 ^= 0x16u;a1[1] ^= 0x7Cu;a1[2] ^= 0x7Du;a1[3] ^= a1[2];a1[4] ^= a1[2];a1[5] ^= 0x6Cu;a1[6] ^= 0x31u;a1[7] ^= 0x4Cu;++a1[8];a1[9] ^= 0x45u;a1[10] ^= 0x5Eu;a1[11] ^= 0x6Bu;*a1 ^= 0xEu;++a1[1];a1[2] ^= 0x59u;a1[3] ^= *a1;a1[4] ^= 0xDu;a1[5] ^= 0x57u;a1[6] ^= 0x61u;a1[7] ^= 0x58u;a1[8] ^= 0x27u;a1[9] ^= 0x71u;a1[10] ^= 0x3Au;a1[11] ^= a1[3];*a1 ^= 0x7Fu;a1[1] ^= *a1;a1[2] ^= 0x3Eu;a1[3] ^= 0x3Au;a1[4] ^= a1[1];a1[5] ^= 0x1Fu;a1[6] ^= 0x28u;a1[7] ^= 0x65u;a1[8] ^= 0x40u;a1[9] ^= a1[8];a1[10] ^= 0x75u;a1[11] ^= 0x15u;*a1 ^= 0x2Au;a1[1] ^= 5u;++a1[2];++a1[3];a1[4] ^= 0x2Du;a1[5] ^= 0x2Au;++a1[6];a1[7] ^= 0x40u;a1[8] ^= 0x4Bu;a1[9] ^= a1[5];a1[10] ^= a1[9];a1[11] ^= 0x47u;*a1 ^= 0x3Au;a1[1] ^= 0x4Eu;a1[2] ^= *a1;a1[3] ^= 8u;++a1[4];++a1[5];a1[6] ^= 0x2Du;a1[7] ^= 0x7Fu;a1[8] ^= 4u;++a1[9];++a1[10];a1[11] ^= 0x7Fu;++*a1;++a1[1];a1[2] ^= 0x28u;a1[3] ^= 0x56u;a1[4] ^= 0x13u;a1[5] ^= 0x42u;a1[6] ^= 0x78u;a1[7] ^= a1[5];a1[8] ^= 0x23u;a1[9] ^= 0x52u;++a1[10];a1[11] ^= 6u;*a1 ^= 0x47u;++a1[1];a1[2] ^= 0x43u;a1[3] ^= 0x1Eu;a1[4] ^= a1[1];a1[5] ^= 0x7Bu;a1[6] ^= 0x55u;a1[7] ^= 0x48u;a1[8] ^= 0x4Eu;++a1[9];++a1[10];++a1[11];*a1 ^= 0x35u;a1[1] ^= 0x38u;a1[2] ^= 0x4Au;a1[3] ^= 0x6Fu;++a1[4];++a1[5];a1[6] ^= 0x4Du;a1[7] ^= 0x14u;a1[8] ^= 0x40u;a1[9] ^= 0x62u;a1[10] ^= 0x7Bu;a1[11] ^= 4u;*a1 ^= 0x3Cu;a1[1] ^= *a1;a1[2] ^= 0x75u;a1[3] ^= 0x24u;++a1[4];a1[5] ^= 0x6Fu;a1[6] ^= 0x6Cu;a1[7] ^= 0x3Eu;a1[8] ^= 0x5Eu;a1[9] ^= 0x22u;++a1[10];a1[11] ^= 0x79u;*a1 ^= 0x7Du;a1[1] ^= 0x48u;++a1[2];a1[3] ^= 0x4Au;a1[4] ^= a1[2];a1[5] ^= 0xFu;a1[6] ^= 0xBu;a1[7] ^= 0x16u;a1[8] ^= 0x56u;a1[9] ^= a1[1];a1[10] ^= 0x42u;a1[11] ^= 0x16u;*a1 ^= 0x7Du;a1[1] ^= 0x4Du;a1[2] ^= 0x45u;a1[3] ^= *a1;a1[4] ^= 0x59u;++a1[5];a1[6] ^= 0x77u;++a1[7];a1[8] ^= 0x19u;a1[9] ^= 0x74u;a1[10] ^= 0x66u;a1[11] ^= 0x3Fu;++*a1;a1[1] ^= 0x68u;a1[2] ^= 0x4Bu;++a1[3];a1[4] ^= 0x30u;a1[5] ^= a1[2];a1[6] ^= a1[4];a1[7] ^= 0x52u;a1[8] ^= 0x4Fu;a1[9] ^= 0x4Fu;a1[10] ^= 0x75u;a1[11] ^= 0x4Au;*a1 ^= 0x2Cu;a1[1] ^= 0x3Eu;++a1[2];a1[3] ^= 0x11u;a1[4] ^= 0x41u;a1[5] ^= 0x4Du;a1[6] ^= 2u;a1[7] ^= 0x7Du;a1[8] ^= a1[4];a1[9] ^= 0x79u;++a1[10];a1[11] ^= 0x48u;*a1 ^= 0x6Du;a1[1] ^= 0x68u;++a1[2];a1[3] ^= 0x65u;a1[4] ^= *a1;a1[5] ^= 0x33u;a1[6] ^= 0x49u;++a1[7];a1[8] ^= 0x4Fu;a1[9] ^= 0x38u;++a1[10];a1[11] ^= 0x58u;*a1 ^= 0x45u;++a1[1];a1[2] ^= 0x3Fu;a1[3] ^= 0x3Fu;++a1[4];a1[5] ^= 0x74u;a1[6] ^= 0x6Eu;a1[7] ^= 0x1Fu;a1[8] ^= 0x7Cu;++a1[9];a1[10] ^= 0x21u;a1[11] ^= 0x4Bu;++*a1;a1[1] ^= 0x47u;a1[2] ^= 0x2Bu;++a1[3];a1[4] ^= 0x6Eu;++a1[5];a1[6] ^= 0x23u;a1[7] ^= 0x75u;a1[8] ^= 0x6Cu;a1[9] ^= 0x69u;a1[10] ^= 0x3Fu;a1[11] ^= 0x41u;*a1 ^= 0x52u;a1[1] ^= *a1;a1[2] ^= 0x61u;++a1[3];++a1[4];a1[5] ^= 0x3Cu;++a1[6];a1[7] ^= 0x73u;a1[8] ^= 0x64u;++a1[9];a1[10] ^= 0x36u;a1[11] ^= 0x62u;*a1 ^= 0x7Eu;a1[1] ^= 0x11u;a1[2] ^= a1[1];a1[3] ^= 0x53u;a1[4] ^= a1[2];a1[5] ^= 0xFu;a1[6] ^= 0x23u;a1[7] ^= *a1;a1[8] ^= 0x50u;a1[9] ^= 0x54u;a1[10] ^= 0x78u;a1[11] ^= a1[9];*a1 ^= 0x4Fu;a1[1] ^= 0x13u;a1[2] ^= 0x78u;a1[3] ^= 0x1Au;a1[4] ^= 0x70u;a1[5] ^= 0xCu;++a1[6];a1[7] ^= 0x4Bu;a1[8] ^= 0x2Eu;a1[9] ^= 0x26u;a1[10] ^= 0x67u;a1[11] ^= 0xAu;*a1 ^= 0x7Bu;a1[1] ^= 0x11u;a1[2] ^= 0x47u;++a1[3];a1[4] ^= 0x35u;a1[5] ^= 0x7Cu;a1[6] ^= 0xCu;a1[7] ^= 0x36u;++a1[8];a1[9] ^= 0x49u;a1[10] ^= 0x38u;++a1[11];*a1 ^= 0x37u;a1[1] ^= 0x79u;a1[2] ^= 0x64u;a1[3] ^= 0x59u;++a1[4];a1[5] ^= 0x40u;a1[6] ^= 0x22u;++a1[7];a1[8] ^= 0x2Au;++a1[9];a1[10] ^= 0xCu;a1[11] ^= 0x4Cu;*a1 ^= 0x20u;++a1[1];++a1[2];++a1[3];a1[4] ^= 0x4Cu;++a1[5];a1[6] ^= 0x21u;a1[7] ^= 0xCu;a1[8] ^= 0x33u;a1[9] ^= 0x5Du;a1[10] ^= 0x6Eu;a1[11] ^= 0x1Du;*a1 ^= 0xBu;a1[1] ^= 0x1Cu;a1[2] ^= 0x6Du;a1[3] ^= 0xAu;a1[4] ^= 0x5Cu;a1[5] ^= 0x12u;++a1[6];a1[7] ^= 0x20u;a1[8] ^= 0x5Cu;a1[9] ^= 0x36u;a1[10] ^= 0x68u;a1[11] ^= 6u;*a1 ^= 0x1Bu;a1[1] ^= 0x67u;a1[2] ^= 6u;++a1[3];a1[4] ^= 0x58u;a1[5] ^= a1[1];a1[6] ^= 0x74u;++a1[7];a1[8] ^= 0x79u;a1[9] ^= 0x45u;++a1[10];a1[11] ^= 0xEu;*a1 ^= 0x1Bu;a1[1] ^= 0x55u;a1[2] ^= 0x7Bu;a1[3] ^= 0x5Bu;a1[4] ^= *a1;a1[5] ^= 0x38u;a1[6] ^= a1[2];a1[7] ^= 6u;a1[8] ^= 0x7Bu;a1[9] ^= 0x16u;a1[10] ^= 5u;++a1[11];*a1 ^= 0x1Cu;a1[1] ^= 0x5Fu;a1[2] ^= 0x1Fu;a1[3] ^= 0x2Du;a1[4] ^= 0xDu;a1[5] ^= 0x6Au;a1[6] ^= a1[4];a1[7] ^= 0x64u;a1[8] ^= 0xBu;a1[9] ^= 0x7Bu;a1[10] ^= 0x7Bu;a1[11] ^= 0x28u;*a1 ^= 0x64u;++a1[1];a1[2] ^= 0x12u;a1[3] ^= 0x51u;a1[4] ^= 0x10u;a1[5] ^= 0x40u;a1[6] ^= 0x10u;a1[7] ^= a1[3];a1[8] ^= 0x51u;a1[9] ^= 0x5Bu;a1[10] ^= 0x7Au;a1[11] ^= 0x61u;*a1 ^= 0x78u;a1[1] ^= *a1;a1[2] ^= 0x56u;a1[3] ^= 0x59u;a1[4] ^= 8u;a1[5] ^= 0x31u;a1[6] ^= 0x37u;a1[7] ^= 0x25u;a1[8] ^= 0x1Cu;++a1[9];a1[10] ^= 0x71u;a1[11] ^= 0x61u;*a1 ^= 0x76u;a1[1] ^= 0x6Du;a1[2] ^= 0x65u;++a1[3];a1[4] ^= 3u;a1[5] ^= 0x1Cu;a1[6] ^= 0x6Cu;++a1[7];a1[8] ^= 9u;a1[9] ^= 0x29u;++a1[10];a1[11] ^= 0x16u;*a1 ^= 0x63u;a1[1] ^= 0x35u;a1[2] ^= 0x79u;a1[3] ^= 0x1Cu;a1[4] ^= a1[2];a1[5] ^= a1[1];a1[6] ^= 0x4Fu;a1[7] ^= 0x75u;a1[8] ^= 0x6Du;a1[9] ^= 3u;++a1[10];++a1[11];*a1 ^= 0x24u;a1[1] ^= 0x5Cu;++a1[2];a1[3] ^= 4u;++a1[4];a1[5] ^= 0xEu;a1[6] ^= 0x69u;a1[7] ^= 0x18u;++a1[8];++a1[9];a1[10] ^= 0x4Fu;a1[11] ^= 0x3Cu;*a1 ^= 0x38u;a1[1] ^= 0x55u;a1[2] ^= 0x49u;a1[3] ^= 0x71u;a1[4] ^= 0x78u;++a1[5];a1[6] ^= 0x78u;a1[7] ^= 0xFu;a1[8] ^= 0x5Bu;a1[9] ^= 0x77u;a1[10] ^= 0x6Au;a1[11] ^= 0x4Bu;++*a1;a1[1] ^= 0x7Fu;a1[2] ^= 0x62u;a1[3] ^= 0x21u;a1[4] ^= 0x44u;a1[5] ^= 0x53u;a1[6] ^= 0x32u;a1[7] ^= 0x63u;a1[8] ^= 0x42u;a1[9] ^= 0x72u;a1[10] ^= a1[5];a1[11] ^= 0x3Fu;*a1 ^= 0x4Bu;++a1[1];a1[2] ^= 0x43u;++a1[3];a1[4] ^= 0x4Fu;a1[5] ^= 0x68u;a1[6] ^= a1[2];a1[7] ^= 0xBu;a1[8] ^= 3u;a1[9] ^= 0x27u;a1[10] ^= 0x14u;a1[11] ^= 0x57u;++*a1;a1[1] ^= 0x21u;++a1[2];a1[3] ^= 0x79u;a1[4] ^= 0x22u;a1[5] ^= 0x54u;++a1[6];a1[7] ^= 4u;a1[8] ^= 0x4Cu;a1[9] ^= a1[1];a1[10] ^= 0x2Au;a1[11] ^= 0x3Au;*a1 ^= 0x60u;a1[1] ^= 0x19u;a1[2] ^= 0x2Du;a1[3] ^= 0x67u;a1[4] ^= 0x6Bu;a1[5] ^= *a1;a1[6] ^= 0x7Bu;a1[7] ^= 0x71u;a1[8] ^= 0x37u;a1[9] ^= 0x21u;a1[10] ^= 0x6Eu;a1[11] ^= 0xDu;*a1 ^= 0x6Cu;a1[1] ^= 0x50u;a1[2] ^= a1[1];a1[3] ^= a1[2];a1[4] ^= 0x57u;a1[5] ^= 0x51u;a1[6] ^= 0x7Fu;a1[7] ^= 0x4Au;a1[8] ^= 0x3Bu;a1[9] ^= 0x47u;a1[10] ^= 0x71u;a1[11] ^= a1[2];*a1 ^= 0x1Au;a1[1] ^= *a1;a1[2] ^= 7u;a1[3] ^= 0x1Bu;a1[4] ^= 0x24u;++a1[5];a1[6] ^= 0x4Cu;a1[7] ^= 0x74u;a1[8] ^= 0x71u;++a1[9];a1[10] ^= 0x4Du;++a1[11];*a1 ^= 0x69u;a1[1] ^= 0x75u;a1[2] ^= 0x18u;a1[3] ^= 0x50u;a1[4] ^= 0x1Cu;a1[5] ^= a1[3];a1[6] ^= 0x1Eu;a1[7] ^= 0x38u;a1[8] ^= 0x13u;a1[9] ^= 0x41u;++a1[10];++a1[11];*a1 ^= 9u;a1[1] ^= *a1;a1[2] ^= 0x28u;a1[3] ^= a1[1];a1[4] ^= 0x21u;a1[5] ^= 0x4Du;a1[6] ^= 0x4Au;a1[7] ^= 0x5Eu;a1[8] ^= a1[2];a1[9] ^= 0x1Bu;a1[10] ^= *a1;a1[11] ^= a1[7];*a1 ^= 0x37u;++a1[1];a1[2] ^= 0x10u;a1[3] ^= 0x41u;++a1[4];a1[5] ^= 8u;a1[6] ^= 0xDu;a1[7] ^= *a1;a1[8] ^= a1[3];a1[9] ^= 0x21u;++a1[10];a1[11] ^= 0x75u;*a1 ^= 0x5Au;a1[1] ^= 0x6Fu;a1[2] ^= 3u;a1[3] ^= a1[1];a1[4] ^= 0x5Du;a1[5] ^= 0x73u;a1[6] ^= 0x54u;a1[7] ^= a1[6];a1[8] ^= 0x46u;a1[9] ^= 0x6Au;a1[10] ^= 0x6Eu;a1[11] ^= 0x24u;++*a1;++a1[1];a1[2] ^= 0x38u;++a1[3];++a1[4];a1[5] ^= 0x54u;a1[6] ^= a1[5];a1[7] ^= 0x6Du;a1[8] ^= 0x3Au;a1[9] ^= 0x17u;a1[10] ^= 0x43u;++a1[11];*a1 ^= 0xAu;a1[1] ^= 0x58u;++a1[2];++a1[3];a1[4] ^= 0x4Cu;a1[5] ^= 0x7Cu;a1[6] ^= 0x6Cu;a1[7] ^= 0x5Bu;a1[8] ^= 0x21u;a1[9] ^= 0x57u;a1[10] ^= 0x3Bu;a1[11] ^= a1[5];*a1 ^= 1u;++a1[1];a1[2] ^= 0x58u;a1[3] ^= *a1;a1[4] ^= 0x3Eu;++a1[5];a1[6] ^= 0x43u;a1[7] ^= 0x59u;a1[8] ^= 0x37u;++a1[9];a1[10] ^= 0x20u;a1[11] ^= a1[1];*a1 ^= 0x5Fu;a1[1] ^= 0x65u;a1[2] ^= 0x6Cu;++a1[3];a1[4] ^= 0x4Eu;a1[5] ^= 0x4Cu;a1[6] ^= 0x2Du;a1[7] ^= 0x11u;a1[8] ^= 0x6Du;a1[9] ^= 0x61u;a1[10] ^= 0x4Fu;++a1[11];*a1 ^= 0x7Du;a1[1] ^= 0x1Du;++a1[2];a1[3] ^= 0x1Au;a1[4] ^= *a1;a1[5] ^= 0x59u;a1[6] ^= a1[3];a1[7] ^= 0x15u;a1[8] ^= *a1;a1[9] ^= 0x14u;a1[10] ^= 0x35u;a1[11] ^= 0x7Du;*a1 ^= 0x2Bu;a1[1] ^= 0x1Fu;a1[2] ^= 2u;a1[3] ^= 0x1Du;a1[4] ^= 0x66u;a1[5] ^= 0x57u;++a1[6];a1[7] ^= 0x79u;a1[8] ^= 0x1Cu;a1[9] ^= 0x42u;a1[10] ^= 0x50u;a1[11] ^= 0x47u;*a1 ^= 0x73u;a1[1] ^= 0x27u;++a1[2];a1[3] ^= 0x3Au;a1[4] ^= 0x6Fu;a1[5] ^= 7u;a1[6] ^= 0x15u;a1[7] ^= 0x21u;a1[8] ^= 0x69u;a1[9] ^= 0x5Bu;a1[10] ^= 0x71u;a1[11] ^= 0x38u;*a1 ^= 0x5Au;a1[1] ^= 0x1Cu;a1[2] ^= 0x20u;a1[3] ^= 0x4Cu;a1[4] ^= 0x32u;a1[5] ^= 0x77u;a1[6] ^= 0x10u;a1[7] ^= 0x5Au;a1[8] ^= 0x5Au;a1[9] ^= 0x47u;a1[10] ^= 0x4Cu;a1[11] ^= 0xAu;*a1 ^= 0x44u;a1[1] ^= 0x14u;a1[2] ^= 0x49u;a1[3] ^= 0x73u;a1[4] ^= 0x3Au;a1[5] ^= a1[1];a1[6] ^= 0x17u;a1[7] ^= 0x6Bu;a1[8] ^= 0x31u;a1[9] ^= 0x2Eu;a1[10] ^= a1[2];a1[11] ^= 0x11u;++*a1;a1[1] ^= 0x17u;++a1[2];a1[3] ^= 0x22u;a1[4] ^= 4u;a1[5] ^= 0xFu;a1[6] ^= 0x4Eu;a1[7] ^= a1[3];a1[8] ^= 0x59u;a1[9] ^= *a1;a1[10] ^= 0x36u;a1[11] ^= 5u;*a1 ^= 0x3Au;a1[1] ^= *a1;a1[2] ^= a1[1];a1[3] ^= 0x1Au;a1[4] ^= *a1;a1[5] ^= 0x4Cu;++a1[6];a1[7] ^= 0x72u;a1[8] ^= a1[6];a1[9] ^= 0x78u;a1[10] ^= 1u;a1[11] ^= a1[6];*a1 ^= 0x46u;a1[1] ^= 0x6Bu;++a1[2];++a1[3];a1[4] ^= 0x6Du;a1[5] ^= *a1;a1[6] ^= a1[1];a1[7] ^= a1[3];a1[8] ^= a1[5];a1[9] ^= 0x3Eu;a1[10] ^= 0x51u;++a1[11];*a1 ^= 0x77u;a1[1] ^= 0x7Fu;a1[2] ^= 0x15u;a1[3] ^= 0x16u;a1[4] ^= a1[2];a1[5] ^= 0x60u;a1[6] ^= 0x63u;a1[7] ^= 2u;a1[8] ^= 0x1Eu;++a1[9];a1[10] ^= 0x59u;a1[11] ^= 0x40u;*a1 ^= 0x7Fu;a1[1] ^= 0x31u;++a1[2];a1[3] ^= 0x5Eu;a1[4] ^= a1[2];a1[5] ^= 0x1Du;++a1[6];++a1[7];++a1[8];a1[9] ^= 0x7Du;a1[10] ^= 0x57u;++a1[11];++*a1;a1[1] ^= 0x36u;a1[2] ^= 0x16u;a1[3] ^= 0x6Eu;++a1[4];a1[5] ^= 0x57u;a1[6] ^= 0x7Bu;++a1[7];a1[8] ^= 0x1Bu;a1[9] ^= 0x4Eu;++a1[10];a1[11] ^= 0x58u;*a1 ^= 0x1Au;++a1[1];a1[2] ^= 0x19u;a1[3] ^= 0x60u;a1[4] ^= 0x3Cu;a1[5] ^= 0xBu;a1[6] ^= 8u;a1[7] ^= 0x38u;a1[8] ^= *a1;a1[9] ^= a1[7];a1[10] ^= 0x6Cu;a1[11] ^= 0x24u;*a1 ^= 5u;a1[1] ^= 0x2Cu;a1[2] ^= 0x5Fu;a1[3] ^= 0x2Fu;a1[4] ^= a1[2];a1[5] ^= 0x43u;++a1[6];a1[7] ^= 0x6Fu;a1[8] ^= a1[6];a1[9] ^= 0x4Au;a1[10] ^= a1[3];a1[11] ^= a1[4];*a1 ^= 4u;a1[1] ^= 0x4Eu;a1[2] ^= 0x37u;a1[3] ^= a1[2];a1[4] ^= 0x67u;a1[5] ^= 0x61u;a1[6] ^= 0x21u;a1[7] ^= 0x10u;a1[8] ^= 0x26u;a1[9] ^= 0x21u;a1[10] ^= 0x20u;++a1[11];*a1 ^= 0x74u;a1[1] ^= 0x35u;a1[2] ^= 0x3Eu;++a1[3];a1[4] ^= 0xEu;a1[5] ^= 0x59u;a1[6] ^= 0x72u;a1[7] ^= 0x24u;a1[8] ^= 0x39u;a1[9] ^= 0x2Au;a1[10] ^= 0x1Fu;a1[11] ^= 0x75u;*a1 ^= 0x5Bu;a1[1] ^= 0x62u;++a1[2];a1[3] ^= 1u;a1[4] ^= a1[3];a1[5] ^= 0x2Fu;++a1[6];++a1[7];a1[8] ^= 0x65u;a1[9] ^= 0x3Bu;++a1[10];a1[11] ^= 4u;*a1 ^= 0x22u;a1[1] ^= 0x5Bu;++a1[2];a1[3] ^= 0x2Cu;a1[4] ^= 0x48u;a1[5] ^= 0x6Bu;a1[6] ^= *a1;a1[7] ^= 1u;a1[8] ^= 0x2Fu;a1[9] ^= 0x12u;a1[10] ^= 0x43u;a1[11] ^= 0x38u;*a1 ^= 0x3Cu;a1[1] ^= *a1;a1[2] ^= 0x2Cu;a1[3] ^= 0x79u;++a1[4];a1[5] ^= 0x63u;a1[6] ^= 0x31u;a1[7] ^= 0x3Du;a1[8] ^= 0x28u;a1[9] ^= 9u;++a1[10];a1[11] ^= 0x79u;*a1 ^= 0x6Du;a1[1] ^= 0x64u;a1[2] ^= 0x55u;a1[3] ^= *a1;a1[4] ^= 0x16u;a1[5] ^= 0x13u;a1[6] ^= 0x7Au;a1[7] ^= 0x4Bu;a1[8] ^= a1[7];a1[9] ^= a1[4];a1[10] ^= 0x4Eu;a1[11] ^= 0x29u;*a1 ^= 0x25u;++a1[1];a1[2] ^= 0x4Eu;a1[3] ^= 0x60u;a1[4] ^= a1[1];a1[5] ^= a1[3];a1[6] ^= 0x42u;a1[7] ^= 0x27u;++a1[8];a1[9] ^= 8u;a1[10] ^= 0x12u;a1[11] ^= 0x12u;++*a1;a1[1] ^= 0x41u;++a1[2];a1[3] ^= 0x63u;a1[4] ^= 0x4Fu;a1[5] ^= 0x63u;a1[6] ^= 0x79u;a1[7] ^= 0x21u;a1[8] ^= *a1;a1[9] ^= 0x79u;a1[10] ^= a1[6];a1[11] ^= 8u;*a1 ^= 0x7Au;a1[1] ^= 0x6Du;a1[2] ^= *a1;a1[3] ^= 0x5Eu;a1[4] ^= 0x50u;a1[5] ^= 0x67u;a1[6] ^= 0x7Bu;a1[7] ^= 0xAu;a1[8] ^= 0x3Du;++a1[9];a1[10] ^= 0x53u;a1[11] ^= 0x61u;*a1 ^= 0x72u;a1[1] ^= 0x1Cu;a1[2] ^= 0x79u;a1[3] ^= 0xCu;a1[4] ^= 4u;a1[5] ^= 0x10u;a1[6] ^= 0x3Cu;a1[7] ^= 0x50u;a1[8] ^= 0x65u;a1[9] ^= 0x66u;a1[10] ^= 0x2Eu;a1[11] ^= 0x23u;*a1 ^= 0x22u;a1[1] ^= 0x4Cu;a1[2] ^= 0x5Fu;a1[3] ^= 0x45u;++a1[4];a1[5] ^= 0x55u;a1[6] ^= 0xCu;a1[7] ^= 0x57u;a1[8] ^= 0x4Eu;a1[9] ^= 0x43u;a1[10] ^= 0x32u;a1[11] ^= a1[7];*a1 ^= 0x5Eu;a1[1] ^= 0x52u;++a1[2];a1[3] ^= 0x68u;a1[4] ^= a1[3];a1[5] ^= 7u;a1[6] ^= 0x69u;a1[7] ^= 0x6Au;a1[8] ^= 0x1Cu;a1[9] ^= 0x2Eu;a1[10] ^= 0x79u;a1[11] ^= a1[8];*a1 ^= 0x45u;a1[1] ^= 0x30u;a1[2] ^= 0x27u;a1[3] ^= 0x2Eu;a1[4] ^= *a1;a1[5] ^= 0x41u;a1[6] ^= 0x39u;a1[7] ^= 0x51u;++a1[8];a1[9] ^= 0x2Cu;a1[10] ^= 0x38u;++a1[11];*a1 ^= 0x1Cu;a1[1] ^= 0x2Bu;a1[2] ^= 0x11u;a1[3] ^= 0xEu;++a1[4];a1[5] ^= 0x72u;a1[6] ^= 0x65u;a1[7] ^= 0xFu;a1[8] ^= 0x63u;a1[9] ^= 0x5Bu;a1[10] ^= 0x4Eu;a1[11] ^= 0x30u;*a1 ^= 0x15u;a1[1] ^= 7u;a1[2] ^= a1[1];a1[3] ^= 0x6Bu;++a1[4];a1[5] ^= 0x1Du;a1[6] ^= 0x77u;a1[7] ^= a1[5];a1[8] ^= a1[3];a1[9] ^= 0x36u;a1[10] ^= 0x29u;a1[11] ^= 0x60u;*a1 ^= 4u;a1[1] ^= *a1;a1[2] ^= 0x2Fu;a1[3] ^= 0x32u;a1[4] ^= *a1;a1[5] ^= 0xCu;a1[6] ^= 0x73u;a1[7] ^= 0x56u;a1[8] ^= 0x1Bu;a1[9] ^= 6u;a1[10] ^= 0x75u;a1[11] ^= 0x2Du;*a1 ^= 0x40u;a1[1] ^= 0x4Cu;a1[2] ^= 0x35u;++a1[3];a1[4] ^= 0x52u;a1[5] ^= 0x53u;a1[6] ^= 0x6Au;a1[7] ^= 0x11u;a1[8] ^= a1[2];a1[9] ^= 0x39u;a1[10] ^= 0x4Eu;a1[11] ^= 0x17u;*a1 ^= 8u;a1[1] ^= 0x47u;a1[2] ^= 4u;a1[3] ^= 0x5Cu;a1[4] ^= 0x69u;a1[5] ^= *a1;a1[6] ^= 0x3Fu;a1[7] ^= 0x14u;a1[8] ^= 1u;a1[9] ^= 0x77u;a1[10] ^= 0x56u;a1[11] ^= 0x68u;*a1 ^= 0x58u;++a1[1];++a1[2];a1[3] ^= 0x70u;a1[4] ^= 0x1Cu;++a1[5];a1[6] ^= 0xFu;++a1[7];a1[8] ^= 0x62u;a1[9] ^= 0x75u;a1[10] ^= a1[2];a1[11] ^= 0x1Fu;*a1 ^= 5u;a1[1] ^= 8u;a1[2] ^= 0x52u;a1[3] ^= 0x6Eu;a1[4] ^= 0x42u;++a1[5];a1[6] ^= 0x2Au;a1[7] ^= 0x4Eu;a1[8] ^= 0x54u;++a1[9];a1[10] ^= 0x6Eu;a1[11] ^= 0x35u;*a1 ^= 0x35u;a1[1] ^= *a1;a1[2] ^= 0x65u;a1[3] ^= 0x42u;a1[4] ^= 6u;a1[5] ^= 0x58u;a1[6] ^= 0x7Du;a1[7] ^= *a1;a1[8] ^= 5u;a1[9] ^= a1[5];a1[10] ^= 0x12u;a1[11] ^= a1[6];*a1 ^= 0xFu;a1[1] ^= 0x51u;++a1[2];a1[3] ^= 0x70u;a1[4] ^= 0x4Bu;++a1[5];a1[6] ^= 0x2Fu;++a1[7];a1[8] ^= 0x59u;a1[9] ^= a1[5];a1[10] ^= 0x52u;a1[11] ^= 0x18u;*a1 ^= 0x17u;a1[1] ^= 0x28u;a1[2] ^= 0x7Cu;a1[3] ^= a1[1];a1[4] ^= 0x15u;++a1[5];a1[6] ^= 0x37u;a1[7] ^= 0x44u;a1[8] ^= 0x70u;a1[9] ^= a1[4];a1[10] ^= 0x45u;a1[11] ^= a1[4];*a1 ^= 0x63u;a1[1] ^= 0x29u;++a1[2];a1[3] ^= 0x54u;a1[4] ^= 0x1Cu;a1[5] ^= 0xFu;a1[6] ^= 0x22u;a1[7] ^= a1[2];a1[8] ^= 0x27u;++a1[9];++a1[10];a1[11] ^= 0x25u;*a1 ^= 0x45u;a1[1] ^= 0x3Du;a1[2] ^= 0x5Bu;a1[3] ^= 0x4Cu;a1[4] ^= a1[2];a1[5] ^= 0x13u;a1[6] ^= 0x1Cu;a1[7] ^= 0x47u;a1[8] ^= a1[1];a1[9] ^= *a1;a1[10] ^= 0x6Fu;a1[11] ^= 0x5Bu;*a1 ^= 0x31u;a1[1] ^= 0x16u;a1[2] ^= 0x20u;a1[3] ^= a1[2];a1[4] ^= 0x51u;a1[5] ^= 0x23u;a1[6] ^= 0x28u;a1[7] ^= a1[4];a1[8] ^= 0x79u;a1[9] ^= a1[7];a1[10] ^= 0x67u;a1[11] ^= 0x18u;*a1 ^= 0x67u;a1[1] ^= 3u;a1[2] ^= 0x10u;a1[3] ^= 0x12u;a1[4] ^= 0x58u;a1[5] ^= 4u;++a1[6];a1[7] ^= 0x1Du;a1[8] ^= 0x2Du;++a1[9];a1[10] ^= 0x1Bu;a1[11] ^= 0xAu;*a1 ^= 0x28u;a1[1] ^= 0x1Cu;a1[2] ^= *a1;a1[3] ^= 0x7Au;a1[4] ^= 0x22u;a1[5] ^= 0x3Fu;a1[6] ^= a1[3];a1[7] ^= 0x6Eu;a1[8] ^= 0x7Du;a1[9] ^= 0x69u;++a1[10];a1[11] ^= 0x57u;++*a1;a1[1] ^= 0x17u;a1[2] ^= 0x6Au;++a1[3];a1[4] ^= 0x54u;a1[5] ^= 0x50u;a1[6] ^= 0x1Fu;++a1[7];a1[8] ^= 0x20u;++a1[9];a1[10] ^= 1u;a1[11] ^= 0x23u;++*a1;a1[1] ^= 0x53u;a1[2] ^= a1[1];a1[3] ^= 0x52u;a1[4] ^= 0x36u;++a1[5];a1[6] ^= 0x38u;a1[7] ^= 0x40u;a1[8] ^= 0x62u;a1[9] ^= 0x11u;a1[10] ^= 0x77u;a1[11] ^= 0x21u;++*a1;a1[1] ^= 3u;++a1[2];a1[3] ^= 4u;a1[4] ^= 0xAu;a1[5] ^= 0x47u;a1[6] ^= 0x7Du;a1[7] ^= *a1;a1[8] ^= 0x26u;a1[9] ^= 0x63u;a1[10] ^= 0x61u;a1[11] ^= 0x1Au;*a1 ^= 0x75u;a1[1] ^= 0x47u;a1[2] ^= 0x23u;a1[3] ^= 0x3Bu;a1[4] ^= 0x31u;a1[5] ^= 0x30u;a1[6] ^= 0x44u;a1[7] ^= 0x7Cu;a1[8] ^= 0x52u;a1[9] ^= 1u;a1[10] ^= 0x38u;a1[11] ^= 1u;*a1 ^= 0x4Eu;++a1[1];a1[2] ^= 0x1Au;a1[3] ^= 0x22u;a1[4] ^= 0x30u;a1[5] ^= 0x11u;a1[6] ^= a1[1];a1[7] ^= 0x47u;a1[8] ^= 0x44u;++a1[9];a1[10] ^= 0x18u;a1[11] ^= 0x39u;*a1 ^= 0x3Bu;a1[1] ^= 0x1Eu;a1[2] ^= 0x5Au;a1[3] ^= 0x21u;a1[4] ^= 0x53u;a1[5] ^= 0x3Fu;a1[6] ^= 0x58u;++a1[7];a1[8] ^= 0x6Eu;++a1[9];++a1[10];a1[11] ^= 0x49u;*a1 ^= 0x19u;++a1[1];a1[2] ^= 0x53u;a1[3] ^= a1[1];a1[4] ^= 0x62u;a1[5] ^= 0x58u;a1[6] ^= *a1;a1[7] ^= 0x71u;a1[8] ^= 0x7Eu;a1[9] ^= 0x2Bu;++a1[10];a1[11] ^= 0x77u;*a1 ^= 0x33u;a1[1] ^= 0x63u;a1[2] ^= 0x2Cu;a1[3] ^= 0x3Fu;a1[4] ^= 0x7Eu;a1[5] ^= 0x11u;a1[6] ^= 0x59u;a1[7] ^= 0x38u;a1[8] ^= 0x67u;a1[9] ^= 0x41u;a1[10] ^= a1[3];a1[11] ^= 0x11u;*a1 ^= 0x6Cu;a1[1] ^= 0xBu;a1[2] ^= 0x19u;a1[3] ^= 0x2Du;++a1[4];a1[5] ^= 0x2Du;a1[6] ^= 0x71u;a1[7] ^= a1[5];a1[8] ^= 0x3Cu;a1[9] ^= 0x17u;a1[10] ^= 0x77u;a1[11] ^= 0x5Du;*a1 ^= 0x1Fu;a1[1] ^= *a1;a1[2] ^= 0x4Bu;a1[3] ^= 0x56u;a1[4] ^= 0x1Cu;a1[5] ^= 0x5Eu;a1[6] ^= 0x68u;++a1[7];a1[8] ^= 0x6Du;a1[9] ^= a1[6];a1[10] ^= 0x3Cu;a1[11] ^= a1[5];*a1 ^= 0x1Bu;a1[1] ^= *a1;a1[2] ^= 0x7Eu;a1[3] ^= 0x69u;a1[4] ^= a1[3];a1[5] ^= 0x52u;a1[6] ^= 4u;++a1[7];a1[8] ^= 0x1Du;a1[9] ^= 0x3Au;a1[10] ^= 0xEu;a1[11] ^= 0x25u;++*a1;a1[1] ^= 0x64u;a1[2] ^= *a1;a1[3] ^= 0x69u;a1[4] ^= 0x7Fu;a1[5] ^= a1[4];a1[6] ^= 0x2Fu;a1[7] ^= 0x4Fu;++a1[8];a1[9] ^= 0x62u;++a1[10];++a1[11];++*a1;a1[1] ^= 0x7Bu;a1[2] ^= *a1;a1[3] ^= a1[1];a1[4] ^= 0x3Cu;a1[5] ^= 0x1Fu;a1[6] ^= 0x6Du;a1[7] ^= *a1;a1[8] ^= a1[5];a1[9] ^= 4u;++a1[10];a1[11] ^= 0x49u;*a1 ^= 0xDu;a1[1] ^= *a1;a1[2] ^= 0x67u;a1[3] ^= 0x2Du;a1[4] ^= 0x72u;a1[5] ^= 0x58u;a1[6] ^= a1[4];a1[7] ^= 0x4Fu;a1[8] ^= 0x3Bu;++a1[9];a1[10] ^= 0x16u;a1[11] ^= a1[8];*a1 ^= 0x24u;++a1[1];a1[2] ^= 0x28u;a1[3] ^= 0x50u;++a1[4];a1[5] ^= 0x57u;a1[6] ^= a1[3];a1[7] ^= 0x40u;a1[8] ^= 0x53u;a1[9] ^= a1[2];a1[10] ^= a1[2];a1[11] ^= 0x3Du;*a1 ^= 0x36u;a1[1] ^= *a1;a1[2] ^= 0x67u;a1[3] ^= 0x4Bu;a1[4] ^= 0x1Du;a1[5] ^= 4u;a1[6] ^= 0x2Fu;a1[7] ^= 0x67u;++a1[8];a1[9] ^= 0x44u;a1[10] ^= a1[6];a1[11] ^= 0x4Bu;*a1 ^= 0x74u;a1[1] ^= 0x24u;a1[2] ^= 0x54u;a1[3] ^= a1[2];a1[4] ^= 0xEu;++a1[5];a1[6] ^= 0x72u;a1[7] ^= a1[2];a1[8] ^= 0x47u;a1[9] ^= 0x57u;a1[10] ^= 0x40u;a1[11] ^= 0x1Cu;*a1 ^= 0x6Cu;++a1[1];a1[2] ^= 0x54u;++a1[3];++a1[4];a1[5] ^= 0x3Fu;a1[6] ^= a1[1];a1[7] ^= 0x6Bu;a1[8] ^= 0x3Eu;++a1[9];++a1[10];a1[11] ^= 0x12u;++*a1;++a1[1];a1[2] ^= 0x12u;a1[3] ^= *a1;a1[4] ^= 0x57u;a1[5] ^= a1[2];a1[6] ^= 4u;++a1[7];++a1[8];a1[9] ^= 0x12u;a1[10] ^= 0x74u;++a1[11];*a1 ^= 0x56u;a1[1] ^= 0x52u;a1[2] ^= 9u;a1[3] ^= 0x32u;a1[4] ^= 0x31u;a1[5] ^= 0x4Bu;a1[6] ^= 0x32u;a1[7] ^= a1[2];a1[8] ^= 0x72u;a1[9] ^= 0x48u;a1[10] ^= a1[3];a1[11] ^= 0x2Bu;*a1 ^= 0x51u;++a1[1];a1[2] ^= 0x69u;a1[3] ^= 0x35u;a1[4] ^= 0xDu;a1[5] ^= 0x4Au;a1[6] ^= 0x5Fu;++a1[7];++a1[8];a1[9] ^= 0x31u;a1[10] ^= 0x61u;a1[11] ^= 0x1Fu;++*a1;a1[1] ^= 0x79u;a1[2] ^= 0x78u;a1[3] ^= 0x5Fu;a1[4] ^= 0x7Eu;a1[5] ^= 0x18u;a1[6] ^= 0x74u;a1[7] ^= 0x53u;++a1[8];a1[9] ^= 0x73u;a1[10] ^= 0x71u;a1[11] ^= 0x60u;*a1 ^= 0x58u;a1[1] ^= 0x51u;a1[2] ^= 0x63u;a1[3] ^= 0x6Du;a1[4] ^= 5u;a1[5] ^= a1[2];a1[6] ^= 0x1Au;++a1[7];a1[8] ^= 0x25u;a1[9] ^= a1[8];a1[10] ^= 0x5Cu;a1[11] ^= 0x19u;*a1 ^= 0x61u;a1[1] ^= 0x2Fu;a1[2] ^= 0x6Eu;a1[3] ^= 0x1Cu;a1[4] ^= 0x6Eu;a1[5] ^= 0x54u;a1[6] ^= 3u;++a1[7];a1[8] ^= 0x1Du;a1[9] ^= 0xDu;a1[10] ^= 0x6Du;++a1[11];*a1 ^= 0x3Eu;a1[1] ^= 0x57u;a1[2] ^= *a1;a1[3] ^= 0x2Au;a1[4] ^= a1[2];a1[5] ^= a1[1];a1[6] ^= 0x57u;a1[7] ^= 0xEu;a1[8] ^= 5u;a1[9] ^= 0x2Cu;a1[10] ^= 7u;a1[11] ^= a1[3];*a1 ^= 0x64u;++a1[1];a1[2] ^= 0x63u;a1[3] ^= 0x75u;++a1[4];a1[5] ^= 0xAu;++a1[6];a1[7] ^= 0x53u;++a1[8];a1[9] ^= 0x37u;a1[10] ^= *a1;a1[11] ^= 0x53u;*a1 ^= 0x27u;a1[1] ^= 0x61u;a1[2] ^= 0x71u;a1[3] ^= 0x51u;a1[4] ^= 0x7Au;++a1[5];++a1[6];a1[7] ^= 0x5Au;a1[8] ^= 0x78u;a1[9] ^= 0x18u;a1[10] ^= 0x44u;a1[11] ^= 0x77u;*a1 ^= 6u;a1[1] ^= 0x19u;a1[2] ^= 0x61u;++a1[3];a1[4] ^= 0x54u;a1[5] ^= 0xEu;a1[6] ^= *a1;a1[7] ^= 0x37u;a1[8] ^= 4u;a1[9] ^= 0x67u;a1[10] ^= a1[4];a1[11] ^= 0x33u;*a1 ^= 0x5Du;a1[1] ^= 0x4Du;a1[2] ^= 0x79u;a1[3] ^= 0x3Bu;a1[4] ^= 0x7Eu;a1[5] ^= 0x44u;++a1[6];a1[7] ^= 0x27u;a1[8] ^= a1[2];a1[9] ^= 0x3Cu;++a1[10];a1[11] ^= 0x45u;*a1 ^= 0x12u;a1[1] ^= 0x5Fu;a1[2] ^= a1[1];a1[3] ^= 0x7Au;a1[4] ^= 0x2Cu;a1[5] ^= 0x22u;a1[6] ^= 0x21u;a1[7] ^= 8u;a1[8] ^= 0x7Cu;a1[9] ^= 0x63u;a1[10] ^= 0x40u;a1[11] ^= a1[8];*a1 ^= 0x47u;a1[1] ^= *a1;a1[2] ^= 0x73u;a1[3] ^= 0x13u;a1[4] ^= 0x2Bu;a1[5] ^= 0x52u;a1[6] ^= 0x3Du;a1[7] ^= 0x5Cu;a1[8] ^= 0x71u;a1[9] ^= a1[7];a1[10] ^= 0x64u;a1[11] ^= 0x70u;*a1 ^= 0x35u;++a1[1];a1[2] ^= 0x4Au;++a1[3];a1[4] ^= 0x49u;a1[5] ^= 0x52u;a1[6] ^= a1[4];a1[7] ^= 9u;a1[8] ^= 0x34u;++a1[9];a1[10] ^= 0x53u;a1[11] ^= 0x28u;*a1 ^= 0x65u;++a1[1];a1[2] ^= 0x6Eu;a1[3] ^= 0x54u;a1[4] ^= 0x6Eu;a1[5] ^= 0x21u;++a1[6];a1[7] ^= 0x36u;a1[8] ^= 0x51u;a1[9] ^= a1[8];a1[10] ^= 0x73u;a1[11] ^= 0x54u;*a1 ^= 0x58u;a1[1] ^= *a1;a1[2] ^= *a1;a1[3] ^= 0x41u;a1[4] ^= 0x12u;a1[5] ^= 0x65u;a1[6] ^= 0x18u;a1[7] ^= 0x52u;a1[8] ^= 1u;a1[9] ^= 0x6Cu;a1[10] ^= 0x4Bu;a1[11] ^= 0x7Au;*a1 ^= 0x18u;a1[1] ^= 9u;++a1[2];a1[3] ^= 0x65u;a1[4] ^= 0xBu;++a1[5];a1[6] ^= 0x7Fu;a1[7] ^= a1[4];a1[8] ^= 0x38u;a1[9] ^= 0x55u;a1[10] ^= 0x56u;a1[11] ^= 0x67u;*a1 ^= 0x61u;a1[1] ^= 0x46u;a1[2] ^= a1[1];a1[3] ^= 0x52u;a1[4] ^= 0x6Au;a1[5] ^= 0x1Du;a1[6] ^= 0x7Fu;a1[7] ^= 0xCu;a1[8] ^= a1[7];a1[9] ^= 0x7Au;a1[10] ^= a1[1];a1[11] ^= 0x69u;*a1 ^= 0x75u;a1[1] ^= *a1;a1[2] ^= a1[1];a1[3] ^= 0x18u;a1[4] ^= 0x49u;a1[5] ^= 0x3Fu;a1[6] ^= a1[5];a1[7] ^= a1[4];a1[8] ^= a1[3];a1[9] ^= 0x2Du;a1[10] ^= 0x2Cu;a1[11] ^= 0x6Eu;*a1 ^= 0x33u;a1[1] ^= 0x24u;a1[2] ^= 0x50u;a1[3] ^= 0xEu;a1[4] ^= 0x64u;++a1[5];++a1[6];++a1[7];a1[8] ^= 0x7Du;++a1[9];a1[10] ^= 0xBu;a1[11] ^= 0x1Bu;*a1 ^= 0xDu;a1[1] ^= 0x6Bu;a1[2] ^= 0x57u;a1[3] ^= 0x58u;a1[4] ^= 0x62u;a1[5] ^= 0xCu;a1[6] ^= 8u;a1[7] ^= a1[1];a1[8] ^= 0x60u;a1[9] ^= 0x28u;a1[10] ^= a1[7];a1[11] ^= *a1;*a1 ^= 8u;a1[1] ^= 0x77u;a1[2] ^= a1[1];a1[3] ^= 2u;++a1[4];a1[5] ^= 0x3Eu;a1[6] ^= 0x51u;a1[7] ^= a1[2];a1[8] ^= 0x54u;a1[9] ^= 0x6Cu;a1[10] ^= 0x6Du;a1[11] ^= 0x51u;*a1 ^= 0x50u;++a1[1];a1[2] ^= 0x1Cu;a1[3] ^= *a1;a1[4] ^= 0x77u;a1[5] ^= 0x41u;++a1[6];a1[7] ^= 0x11u;++a1[8];a1[9] ^= 0x6Bu;a1[10] ^= 0x54u;a1[11] ^= 0x78u;*a1 ^= 0x76u;a1[1] ^= 0x55u;a1[2] ^= 0x34u;a1[3] ^= 0x17u;a1[4] ^= a1[3];a1[5] ^= *a1;a1[6] ^= 0x6Cu;a1[7] ^= 0x49u;a1[8] ^= 0x3Eu;a1[9] ^= 0x38u;a1[10] ^= 7u;a1[11] ^= 0x5Cu;*a1 ^= 0x2Eu;++a1[1];++a1[2];a1[3] ^= 0x5Eu;a1[4] ^= 0x3Eu;++a1[5];++a1[6];a1[7] ^= 0x71u;a1[8] ^= 0x65u;a1[9] ^= 0xBu;a1[10] ^= 0x2Au;a1[11] ^= 0x5Au;++*a1;a1[1] ^= 0x1Cu;a1[2] ^= 1u;++a1[3];a1[4] ^= 0x20u;++a1[5];a1[6] ^= 0x1Fu;a1[7] ^= 0x4Fu;++a1[8];a1[9] ^= 3u;a1[10] ^= 0x3Du;a1[11] ^= 0x4Bu;*a1 ^= 0x24u;a1[1] ^= 0x78u;a1[2] ^= 0x12u;a1[3] ^= a1[1];a1[4] ^= 0x19u;a1[5] ^= 8u;a1[6] ^= a1[3];a1[7] ^= 0x15u;++a1[8];a1[9] ^= 0x47u;a1[10] ^= a1[8];a1[11] ^= a1[9];*a1 ^= 0x72u;a1[1] ^= *a1;a1[2] ^= 0x1Bu;a1[3] ^= 0x3Bu;a1[4] ^= 0x25u;a1[5] ^= 0x31u;a1[6] ^= a1[1];a1[7] ^= 0x57u;a1[8] ^= 6u;a1[9] ^= a1[4];a1[10] ^= 0x57u;++a1[11];++*a1;a1[1] ^= 0x6Eu;a1[2] ^= 0x5Du;a1[3] ^= 0x1Du;a1[4] ^= a1[3];a1[5] ^= 0x45u;a1[6] ^= 0x3Bu;++a1[7];a1[8] ^= 0x16u;++a1[9];a1[10] ^= 0x57u;a1[11] ^= 0x58u;*a1 ^= 0x7Bu;a1[1] ^= 0x28u;a1[2] ^= 2u;a1[3] ^= 0x49u;a1[4] ^= 0x40u;a1[5] ^= 0x1Fu;++a1[6];++a1[7];a1[8] ^= 0x27u;++a1[9];++a1[10];a1[11] ^= 0x5Du;*a1 ^= 0x1Du;a1[1] ^= 0x6Bu;a1[2] ^= *a1;a1[3] ^= 0x5Au;a1[4] ^= 0xDu;a1[5] ^= 0x52u;a1[6] ^= 0x59u;a1[7] ^= a1[5];a1[8] ^= 0x73u;++a1[9];a1[10] ^= 4u;a1[11] ^= a1[5];*a1 ^= 3u;a1[1] ^= 0x3Du;a1[2] ^= *a1;a1[3] ^= 0x73u;a1[4] ^= 0x7Cu;a1[5] ^= 0xFu;a1[6] ^= 0x4Fu;a1[7] ^= 0xDu;a1[8] ^= 0x62u;a1[9] ^= 0x2Fu;a1[10] ^= 0x60u;a1[11] ^= 0x38u;*a1 ^= 0x5Bu;a1[1] ^= 0x22u;a1[2] ^= 0x12u;a1[3] ^= 0x19u;a1[4] ^= 0x56u;a1[5] ^= 0x29u;a1[6] ^= 0x48u;a1[7] ^= 0x45u;a1[8] ^= 0xEu;a1[9] ^= a1[1];a1[10] ^= 0x4Cu;a1[11] ^= 0x7Cu;*a1 ^= 0x23u;a1[1] ^= *a1;a1[2] ^= 0xEu;a1[3] ^= 0x6Au;++a1[4];a1[5] ^= 0x3Bu;a1[6] ^= 0x54u;a1[7] ^= 0x57u;a1[8] ^= 0x1Bu;a1[9] ^= 0x1Du;a1[10] ^= 0x53u;a1[11] ^= 0x25u;*a1 ^= 0x41u;a1[1] ^= 0x59u;a1[2] ^= 0x2Eu;++a1[3];++a1[4];a1[5] ^= 0x26u;a1[6] ^= 0x72u;a1[7] ^= 0xAu;a1[8] ^= 0x6Fu;++a1[9];a1[10] ^= 0x33u;a1[11] ^= a1[9];*a1 ^= 0x3Au;a1[1] ^= *a1;a1[2] ^= 0x2Eu;a1[3] ^= 0x42u;a1[4] ^= 0x74u;a1[5] ^= 0x70u;a1[6] ^= 0x3Du;a1[7] ^= 0x74u;a1[8] ^= 0x7Bu;a1[9] ^= 0x7Du;a1[10] ^= 0x15u;a1[11] ^= 0x11u;*a1 ^= 0x73u;a1[1] ^= 0x24u;a1[2] ^= 0x7Eu;a1[3] ^= 0x4Cu;a1[4] ^= *a1;a1[5] ^= 0x34u;a1[6] ^= 0x41u;a1[7] ^= 0x2Du;a1[8] ^= 0x68u;++a1[9];a1[10] ^= 0x6Fu;a1[11] ^= 0x75u;*a1 ^= 0x77u;a1[1] ^= 0x1Eu;a1[2] ^= 0x4Du;a1[3] ^= 0x4Cu;a1[4] ^= 0x56u;a1[5] ^= 0x30u;a1[6] ^= 0x6Fu;a1[7] ^= 0x5Cu;a1[8] ^= 5u;a1[9] ^= a1[4];a1[10] ^= 0x25u;a1[11] ^= 0x29u;*a1 ^= 0x48u;a1[1] ^= 0x3Bu;a1[2] ^= *a1;a1[3] ^= 0xAu;a1[4] ^= 0x6Fu;a1[5] ^= *a1;a1[6] ^= 0x65u;a1[7] ^= 0x59u;a1[8] ^= a1[1];a1[9] ^= 0x11u;a1[10] ^= 0x73u;a1[11] ^= a1[2];*a1 ^= 0x59u;a1[1] ^= 0x7Eu;a1[2] ^= 0x4Fu;a1[3] ^= 0x2Bu;a1[4] ^= *a1;a1[5] ^= 0x25u;a1[6] ^= 0x2Eu;a1[7] ^= 0x3Cu;a1[8] ^= 0x6Bu;a1[9] ^= 0x70u;a1[10] ^= 0x29u;a1[11] ^= 0x3Bu;v3[0] = 126;v3[1] = 50;v3[2] = 37;v3[3] = 88;v3[4] = 89;v3[5] = 107;v3[6] = 53;v3[7] = 110;v3[8] = 0;v3[9] = 19;v3[10] = 30;v3[11] = 56;if ( v3[i] == a1[i] ){printf("%c",flaga);return 1LL;}return 0LL;
//b0Nf|Re_LiT!
//the flag are:
//b0Nf|Re_LiT!
}

3.[網鼎杯 2020 青龍組]singal

查看主邏輯

int __cdecl vm_operad(int *a1, int a2)
{int result; // eaxchar Str[200]; // [esp+13h] [ebp-E5h] BYREFchar v4; // [esp+DBh] [ebp-1Dh]int v5; // [esp+DCh] [ebp-1Ch]int v6; // [esp+E0h] [ebp-18h]int v7; // [esp+E4h] [ebp-14h]int v8; // [esp+E8h] [ebp-10h]int v9; // [esp+ECh] [ebp-Ch]v9 = 0;v8 = 0;v7 = 0;v6 = 0;v5 = 0;while ( 1 ){result = v9;if ( v9 >= a2 )return result;switch ( a1[v9] ){case 1:Str[v6 + 100] = v4;++v9;++v6;++v8;break;case 2:v4 = a1[v9 + 1] + Str[v8];v9 += 2;break;case 3:v4 = Str[v8] - LOBYTE(a1[v9 + 1]);v9 += 2;break;case 4:v4 = a1[v9 + 1] ^ Str[v8];v9 += 2;break;case 5:v4 = a1[v9 + 1] * Str[v8];v9 += 2;break;case 6:++v9;break;case 7:if ( Str[v7 + 100] != a1[v9 + 1] ){printf("what a shame...");exit(0);}++v7;v9 += 2;break;case 8:Str[v5] = v4;++v9;++v5;break;case 10:read(Str);++v9;break;case 11:v4 = Str[v8] - 1;++v9;break;case 12:v4 = Str[v8] + 1;++v9;break;default:continue;}}
}

其中的case 10 代碼

size_t __cdecl read(char *Str)
{size_t result; // eaxprintf("string:");scanf("%s", Str);result = strlen(Str);if ( result != 15 ){puts("WRONG!\n");exit(0);}return result;
}

我們知道需要一直循環找到flag,使用符號執行:

符號執行（Symbolic Execution）是一種程序分析技術。其可以通過分析程序來得到讓特定代碼區域執行的輸入。使用符號執行分析一個程序時，該程序會使用符號值作為輸入，而非一般執行程序時使用的具體值。在達到目標代碼時，分析器可以得到相應的路徑約束，然后通過約束求解器來得到可以觸發目標代碼的具體值。[1] 符號模擬技術（symbolic simulation）則把類似的思想用于硬件分析。符號計算（Symbolic computation）則用于數學表達式分析。我理解為更厲害的爆破。

基礎語法:

import angrproj = angr.Project('文件名') #新建一個工程
init_state=proj.factory.entry_sate() #設置程序的入口
sm=proj.factory.simulation_manager(init_state) #執行程序
sm.explore(find=0x.....，avoid=0x.....) #執行到某個條件,避免某個條件sm.found[0] #找到符合條件的值
found_state=sm.found[0]
found_state.posix.doumps(0)  #獲得我們最開始的輸入
found_state.posix.doumps(1)  #獲得我們最后的輸出

腳本例子:

import angr
import sysdef main(argv):p = angr.Project('')initial_state = p.factory.entry_state()sm = p.factory.simgr(initial_state)sm.explore(find=good_addr, avoid=bad_addr) if sm.found:flag = sm.found[0]print(flag.posix.dumps(sys.stdin.fileno()))else:raise Exception('Cannot find')
if __name__ == '__main__':main(sys.argv)

腳本解密:

import angrp = angr.Project(r'C:\Users\21901\Desktop\signal.exe')
state = p.factory.entry_state()
simgr = p.factory.simgr(state)
simgr.explore(find=0x0040179E, avoid=0x004016E6)
flag = simgr.found[0].posix.dumps(0)[:15]
print(flag)#b'757515121f3d478'

得到flag{757515121f3d478}

4. crackme

進入ida查看主邏輯

int wmain()
{FILE *v0; // eaxFILE *v1; // eaxchar v3; // [esp+3h] [ebp-405h]char v4[256]; // [esp+4h] [ebp-404h] BYREFchar Format[256]; // [esp+104h] [ebp-304h] BYREFchar v6[256]; // [esp+204h] [ebp-204h] BYREFchar v7[256]; // [esp+304h] [ebp-104h] BYREFprintf("Come one! Crack Me~~~\n");memset(v7, 0, sizeof(v7));memset(v6, 0, sizeof(v6));while ( 1 ){do{do{printf("user(6-16 letters or numbers):");scanf("%s", v7);v0 = (FILE *)sub_4024BE();fflush(v0);}while ( !(unsigned __int8)sub_401000(v7) );printf("password(6-16 letters or numbers):");scanf("%s", v6);v1 = (FILE *)sub_4024BE();fflush(v1);}while ( !(unsigned __int8)sub_401000(v6) );sub_401090(v7);memset(Format, 0, sizeof(Format));memset(v4, 0, sizeof(v4));v3 = ((int (__cdecl *)(char *, char *))loc_4011A0)(Format, v4);if ( sub_401830((int)v7, v6) ){if ( v3 )break;}printf(v4);}printf(Format);return 0;
}

前面是正常的輸入賬號密碼代碼,并判斷是不是數字和字母,之后我們需要break出while死循環,需要滿足sub_401830函數返回1,跟進查看

bool __cdecl sub_401830(int a1, const char *a2)
{int v3; // [esp+18h] [ebp-22Ch]int v4; // [esp+1Ch] [ebp-228h]int v5; // [esp+28h] [ebp-21Ch]unsigned int v6; // [esp+30h] [ebp-214h]char v7; // [esp+36h] [ebp-20Eh]char v8; // [esp+37h] [ebp-20Dh]char v9; // [esp+38h] [ebp-20Ch]unsigned __int8 v10; // [esp+39h] [ebp-20Bh]unsigned __int8 v11; // [esp+3Ah] [ebp-20Ah]char v12; // [esp+3Bh] [ebp-209h]int v13; // [esp+3Ch] [ebp-208h] BYREFchar v14; // [esp+40h] [ebp-204h] BYREFchar v15[255]; // [esp+41h] [ebp-203h] BYREFchar v16[256]; // [esp+140h] [ebp-104h] BYREFv4 = 0;v5 = 0;v11 = 0;v10 = 0;memset(v16, 0, sizeof(v16));v14 = 0;memset(v15, 0, sizeof(v15));v9 = 0;v6 = 0;v3 = 0;while ( v6 < strlen(a2) ){if ( isdigit(a2[v6]) ){v8 = a2[v6] - 48;}else if ( isxdigit(a2[v6]) ){if ( *((_DWORD *)NtCurrentPeb()->ProcessHeap + 3) != 2 )a2[v6] = 34;v8 = (a2[v6] | 0x20) - 87;}else{v8 = ((a2[v6] | 0x20) - 97) % 6 + 10;}__rdtsc();__rdtsc();v9 = v8 + 16 * v9;if ( !((int)(v6 + 1) % 2) ){v15[v3++ - 1] = v9;v9 = 0;}++v6;}while ( v5 < 8 ){v10 += byte_416050[++v11];v12 = byte_416050[v11];v7 = byte_416050[v10];byte_416050[v10] = v12;byte_416050[v11] = v7;if ( (NtCurrentPeb()->NtGlobalFlag & 0x70) != 0 )v12 = v10 + v11;v16[v5] = byte_416050[(unsigned __int8)(v7 + v12)] ^ v15[v4 - 1];if ( (unsigned __int8)*(_DWORD *)&NtCurrentPeb()->BeingDebugged ){v10 = -83;v11 = 43;}sub_401710(v16, a1, v5++);v4 = v5;if ( v5 >= (unsigned int)(&v15[strlen(&v14)] - v15) )v4 = 0;}v13 = 0;sub_401470(v16, &v13);return v13 == 0xAB94;
}

需要滿足v13 == 0xAB94也就是v13 == 43924,查看v13可知與sub_401470函數有關

其中的v16與sub_401710(v16, a1, v5++);函數和 v16[v5] = byte_416050[(v7 + v12)] ^ v15[v4 - 1];異或操作有關,

首先看sub_401470函數

unsigned int *__usercall sub_401470@<eax>(int a1@<ebx>, _BYTE *a2, unsigned int *a3)
{char v5; // alunsigned int *result; // eaxif ( *a2 != 0x64 )*a3 ^= 3u;else*a3 |= 4u;if ( a2[1] != 0x62 ){*a3 &= 0x61u;_EAX = *a3;}else{_EAX = a3;*a3 |= 0x14u;}__asm { aam }if ( a2[2] != 0x61 )*a3 &= 0xAu;else*a3 |= 0x84u;if ( a2[3] != 0x70 )*a3 >>= 7;else*a3 |= 0x114u;if ( a2[4] != 0x70 )*a3 *= 2;else*a3 |= 0x380u;if ( *(NtCurrentPeb()->ProcessHeap + 3) != 2 ){if ( a2[5] != 0x66 )*a3 |= 0x21u;else*a3 |= 0x2DCu;}if ( a2[5] != 0x73 ){v5 = a3;*a3 ^= 0x1ADu;}else{*a3 |= 0xA04u;v5 = a3;}_AL = v5 - (~(a1 >> 5) - 1);__asm { daa }if ( a2[6] != 0x65 )*a3 |= 0x4Au;else*a3 |= 0x2310u;if ( a2[7] != 0x63 ){*a3 &= 0x3A3u;return *a3;}else{result = a3;*a3 |= 0x8A10u;}return result;
}

每一次的if語句都和字母的判斷有關也就是猜測需要滿足所有的else語句,可以驗證一下

因為結果是,我們計算一下看看是否相等,其中的

if ( *(NtCurrentPeb()->ProcessHeap + 3) != 2 )

這行代碼的作用是檢查當前進程的默認堆的某個偏移位置的值是否不等于 2

這種對 PEB 或堆的直接訪問和判斷可能是某種反調試機制,我們可以都試試來找到a3==43924的情況

#include<stdio.h>int main(){int a=0,s;s=a|4|0x14|0x84|0x114|0x380|0xA04|0x2310|0x8A10;if(s==43924){puts("right");}else{puts("wrong");}return 0;//right
}

#include<stdio.h>int main(){int a=0,s;s=a|4|0x14|0x84|0x114|0x380|0x2DC|0x2310|0x8A10;if(s==43924){puts("right");}else{puts("wrong");}return 0;//wrong
}

所以a2也就是v16是dbappsec

int __cdecl sub_401710(int a1, const char *a2, signed int a3)
{int result; // eaxsigned int v4; // [esp+4h] [ebp-58h]struct _STARTUPINFOW StartupInfo; // [esp+14h] [ebp-48h] BYREFmemset(&StartupInfo, 0, sizeof(StartupInfo));StartupInfo.cb = 68;GetStartupInfoW(&StartupInfo);v4 = strlen(a2);if ( StartupInfo.dwX|| StartupInfo.dwY|| StartupInfo.dwXCountChars|| StartupInfo.dwYCountChars|| StartupInfo.dwFillAttribute|| StartupInfo.dwXSize|| StartupInfo.dwYSize ){if ( a3 <= v4 )return &a2[a3];elsereturn &a2[v4];}else if ( a3 <= v4 ){result = a2[a3] ^ *(a3 + a1);*(a3 + a1) = result;}else{result = a3 + a1;*(a3 + a1) += byte_416050[v4 + a3] & a2[v4];}return result;
}

之后查看sub_401710函數的實參,v16是密文,a1是賬號,v5是計數器且該函數是在 while ( v5 < 8 )循環中進行的所以v5最大為7,而我們賬號welcomebeijing長度是14一直比v5大,所以

v4 = strlen(a2);就是賬號的長度,所以a3 <= v4一直成立,其中的第一個if語句

if ( StartupInfo.dwX|| StartupInfo.dwY|| StartupInfo.dwXCountChars|| StartupInfo.dwYCountChars|| StartupInfo.dwFillAttribute|| StartupInfo.dwXSize|| StartupInfo.dwYSize )

是檢查窗口是否已配置,我也不知道他配置沒配置,所以可能異或也可能不異或,存疑,猜測和打開方式有關

所以關鍵之處就是

直接return不進行操作,或者是

 result = a2[a3] ^ *(a3 + a1);*(a3 + a1) = result;

可知這是賬號的前八位和v16的前八位異或得到v16

我們要得到的是v15

分析邏輯

請添加圖片描述

這里是把密碼轉成16進制數,之后儲存在v15中進行加密計算

v16[v5] = byte_416050[(v7 + v12)] ^ v15[v4 - 1];

這里我們知道了v16,其中的byte_416050可以動態調試查看其中我們需要的8位

其中要把動態調試監測的代碼nop掉,就是上面分析的和動態調試有關的代碼NtCurrentPeb這種的都nop掉

請添加圖片描述

得到的ecx的值是0x2A,0xD7,0x92,0xE9,0x53,0xE2,0xC4,0xCD

寫代碼解決

#include<stdio.h>int main(){char a[]="dbappsec";char zh[]="welcomebeijing";int i,j;//for (i=0;i<=7;i++){//	a[i]^=zh[i];//}int key[]={0x2A,0xD7,0x92,0xE9,0x53,0xE2,0xC4,0xCD};for (i=0;i<=7;i++){a[i]^=key[i];printf("%02x",(unsigned char)a[i]);//直接異或的 //4eb5f3992391a1ae  d2be2981b84f2a905669995873d6a36c//異或賬號前八位的://39d09ffa4cfcc4cc  84ab2835640e510eb81f86e0ced4d91c}return 0;
}

最后都試試是可知是flag{d2be2981b84f2a905669995873d6a36c}