PatriotCTF 2025 - 比赛 | Pretend

# Space Pirates

根据附件逆向写脚本即可

  `target = [ 0x5A, 0x3D, 0x5B, 0x9C, 0x98, 0x73, 0xAE, 0x32, 0x25, 0x47,`
    `0x48, 0x51, 0x6C, 0x71, 0x3A, 0x62, 0xB8, 0x7B, 0x63, 0x57,`
    `0x25, 0x89, 0x58, 0xBF, 0x78, 0x34, 0x98, 0x71, 0x68, 0x59]`

`xor_key = [0x42, 0x73, 0x21, 0x69, 0x37]`
`magic_add = 0x2A`
`flag_len = 30`


`buffer = list(target)`

`for i in range(flag_len):`
    `buffer[i] ^= i`


`for i in range(flag_len):`
    `buffer[i] = (buffer[i] - magic_add) & 0xFF`



`for i in range(0, flag_len, 2):`
    `buffer[i], buffer[i + 1] = buffer[i + 1], buffer[i]`



`for i in range(flag_len):`
    `buffer[i] ^= xor_key[i % 5]`


`flag = ''.join(chr(b) for b in buffer)`
`print(flag)`

# Are You Pylingual?

首先对题目所给的 pyc 文件进行反编译得到 python 原文件：

Decompiled with PyLingual (https://pylingual.io)
Internal filename: pylinguese.py
Bytecode version: 3.12.0rc2 (3531)
Source timestamp: 2025-09-06 18:41:22 UTC (1757184082)
import pyfiglet
file = open('flag.txt', 'r')
flag = file.read()
font = 'slant'
words = 'MASONCC IS THE BEST CLUB EVER'
flag_track = 0
art = list(pyfiglet.figlet_format(words, font=font))
i = len(art) % 10
for ind in range(len(art)):
if ind == i and flag_track < len(flag):
art[ind] = flag[flag_track]
i += 28
flag_track += 1
art_str = ''.join(art)
first_val = 5
second_val = 6
first_half = art_str[:len(art_str) // 2]
second_half = art_str[len(art_str) // 2:]
first = [~ord(char) ^ first_val for char in first_half]
second = [~ord(char) ^ second_val for char in second_half]
output = second + first
print(output)

通过分析可知 flag 被分成了两部分，再结合题目给的 output.txt 文件编写脚本即可：

output = [-90, -42, -39, -42, -39, -39, -39, -42, -39, -42, -39, -42, -39, -42, -39, -90, -90, -39, -48, -13, -52, -39, -42, -39, -42, -39, -42, -39, -42, -90, -42, -39, -42, -39, -90, -90, -42, -39, -39, -39, -39, -42, -39, -90, -90, -39, -39, -42, -105, -90, -90, -42, -39, -39, -91, -90, -90, -39, -91, -39, -42, -39, -42, -39, -39, -39, -39, -42, -39, -42, -39, -39, -39, -42, -39, -42, -34, -39, -39, -42, -39, -42, -39, -42, -39, -42, -39, -90, -90, -39, -39, -123, -13, -39, -42, -39, -42, -39, -42, -39, -90, -90, -39, -39, -115, -39, -42, -90, -90, -90, -39, -39, -39, -42, -39, -42, -90, -42, -39, -42, -39, -42, -90, -90, -90, -39, -90, -90, -90, -42, -39, -42, -90, -39, -42, -39, -39, -39, -39, -42, -39, -42, -90, -90, -90, -42, -39, -42, -90, -90, -90, -42, -39, -42, -90, -42, -39, -42, -39, -42, -68, -42, -39, -42, -39, -13, -42, -90, -42, -39, -42, -90, -42, -39, -42, -90, -42, -90, -90, -90, -90, -90, -42, -39, -39, -42, -90, -90, -105, -90, -90, -42, -90, -90, -90, -90, -90, -42, -42, -90, -90, -90, -90, -42, -42, -90, -42, -39, -39, -39, -39, -39, -91, -90, -90, -90, -102, -42, -90, -90, -90, -90, -90, -42, -91, -90, -90, -90, -90, -42, -90, -90, -90, -90, -90, -42, -39, -39, -13, -39, -39, -39, -39, -39, -85, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -128, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -119, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -13, -39, -39, -39, -39, -90, -90, -90, -90, -90, -90, -90, -39, -39, -39, -39, -90, -115, -90, -90, -90, -90, -90, -90, -90, -90, -90, -90, -39, -13, -39, -39, -39, -42, -39, -90, -90, -90, -90, -42, -39, -123, -39, -39, -42, -56, -42, -39, -90, -90, -90, -90, -42, -39, -90, -90, -39, -91, -13, -39, -39, -42, -39, -90, -90, -42, -39, -39, -123, -39, -123, -39, -42, -106, -42, -39, -90, -90, -42, -39, -42, -39, -42, -90, -42, -39, -42, -13, -39, -42, -39, -42, -90, -90, -90, -39, -39, -123, -39, -123, -42, -73, -42, -39, -42, -90, -90, -90, -42, -39, -90, -43, -39, -90, -42, -39, -13, -42, -90, -90, -90, -90, -90, -42, -39, -39, -123, -90, -90, -124, -42, -90, -90, -90, -90, -90, -42, -90, -42, -39, -123, -90, -123, -39, -39, -13, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -39, -13, -38, -38, -118, -38, -91, -91, -38, -38, -91, -91, -91, -91, -91, -91, -38, -38, -38, -91, -91, -91, -91, -91, -38, -91, -91, -91, -91, -38, -38, -91, -103, -38, -38, -91, -91, -91, -91, -91, -91, -91, -91, -91, -91, -91, -91, -91, -91, -38, -38, -38, -91, -91, -91, -91, -91, -91, -91, -91, -114, -16, -38, -38, -38, -43, -38, -38, -122, -43, -38, -38, -43, -38, -38, -38, -122, -38, -43, -38, -91, -91, -91, -43, -43, -38, -91, -91, -100, -90, -43, -38, -122, -38, -43, -38, -43, -38, -91, -91, -91, -91, -43, -38, -91, -91, -91, -91, -43, -38, -38, -43, -38, -38, -91, -43, -127, -91, -91, -91, -43, -16, -38, -38, -43, -38, -43, -122, -91, -43, -38, -43, -38, -43, -122, -38, -122, -38, -90, -91, -91, -38, -90, -43, -107, -43, -38, -43, -38, -43, -38, -38, -122, -43, -38, -43, -38, -43, -38, -38, -38, -43, -38, -43, -38, -38, -38, -38, -38, -38, -38, -43, -104, -43, -38, -90, -91, -91, -38, -90, -38, -16, -38, -43, -38, -43, -38, -38, -43, -38, -43, -38, -91, -91, -91, -38, -122, -91, -91, -91, -68, -38, -43, -38, -43, -91, -43, -38, -43, -38, -43, -122, -38, -38, -43, -38, -43, -91, -91, -91, -43, -38, -43, -91, -91, -91, -38, -38, -113, -91, -43, -38, -43, -38, -91, -91, -91, -43, -38, -43, -38, -16, -43, -91, -43, -38, -38, -43, -91, -43, -91, -43, -38, -38, -122, -91, -119, -91, -91, -91, -91, -43, -90, -91, -91, -91, -91, -43, -91, -43, -38, -122, -91, -43, -90, -91, -91, -91, -91, -43, -90, -91, -91, -91, -103, -43, -38, -38, -43, -91, -91, -91, -43, -43, -91, -91, -91, -91, -43, -38, -38, -16, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -50, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -114, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -38, -16, -38, -38, -91, -91, -91, -91, -109, -91, -91, -91, -38, -38, -91, -91, -91, -91, -91, -91, -91, -91, -38, -38, -38, -91, -91, -91, -91, -38, -38, -91, -91, -91, -91, -91, -54, -91, -91, -91, -91, -91, -91, -91, -91, -91, -91, -91, -38, -38, -38, -91, -91, -91, -91, -91, -91, -91, -91, -38, -38, -38, -38, -91, -108, -38, -38, -91, -91, -91, -91, -91, -91, -38, -16, -38, -43, -91, -38, -38, -91, -91, -43, -38, -43, -38, -43, -38, -43, -38, -91, -91, -91, -91, -43, -38, -38, -43, -38, -91, -91, -38, -45, -43, -38, -91, -91, -91, -91, -43, -38, -91, -91, -91, -43, -91, -38, -38, -91, -91, -109, -38, -38, -43, -38, -91, -91, -91]

length = len(output)
cut_index = length - (length // 2)  

encrypted_second_part = output[:cut_index]
encrypted_first_part = output[cut_index:]

decrypted_second_str = "".join([chr(~(x ^ 6)) for x in encrypted_second_part])
decrypted_first_str = "".join([chr(~(x ^ 5)) for x in encrypted_first_part])

final_art = decrypted_first_str + decrypted_second_str

start_idx = len(final_art) % 10
flag = ""
idx = start_idx
while idx < len(final_art):
    flag += final_art[idx]
    idx += 28

print("Recovered Flag:")
print(flag)

# Space Pirates 2

通过附件可知是一个 rust 源文件，但也不难，直接逆向写脚本即可：

target = [
    0x15, 0x5A, 0xAC, 0xF6, 0x36, 0x22, 0x3B, 0x52, 0x6C, 0x4F, 0x90, 0xD9, 0x35, 0x63, 0xF8, 0x0E,
    0x02, 0x33, 0xB0, 0xF1, 0xB7, 0x69, 0x42, 0x67, 0x25, 0xEA, 0x96, 0x63, 0x1B, 0xA7, 0x03, 0x0B
]
xor_key = [0x7E, 0x33, 0x91, 0x4C, 0xA5]
rot_pattern = [1, 3, 5, 7, 2, 4, 6]
magic_sub = 0x5D

buf = list(target)

for i in range(len(buf)):
    buf[i] ^= ((i * i) % 256)

for i in range(0, len(buf), 5):
    end = min(i + 5, len(buf))
    buf[i:end] = buf[i:end][::-1]

for i in range(len(buf)):
    buf[i] = (buf[i] + magic_sub) % 256

for i in range(0, len(buf), 2):
    if i + 1 < len(buf):
        buf[i], buf[i+1] = buf[i+1], buf[i]

def ror(val, n):
    n = n % 8
    return ((val >> n) | (val << (8 - n))) & 0xFF

for i in range(len(buf)):
    rot = rot_pattern[i % 7]
    buf[i] = ror(buf[i], rot)

for i in range(len(buf)):
    buf[i] ^= xor_key[i % 5]

print("Flag:", "".join([chr(x) for x in buf]))

# Space Pirates 3

target = [
    0x60, 0x6D, 0x5D, 0x97, 0x2C, 0x04, 0xAF, 0x7C, 0xE2, 0x9E, 0x77, 0x85,
    0xD1, 0x0F, 0x1D, 0x17, 0xD4, 0x30, 0xB7, 0x48, 0xDC, 0x48, 0x36, 0xC1,
    0xCA, 0x28, 0xE1, 0x37, 0x58, 0x0F
]

xor_key = [0xC7, 0x2E, 0x89, 0x51, 0xB4, 0x6D, 0x1F]
rotation_pattern = [7, 5, 3, 1, 6, 4, 2, 0]
magic_sub = 0x93
chunk_size = 6


buf = list(target)

print("Starting decryption...")


for i in range(len(buf)):
    position_value = ((i * i) + i) % 256
    buf[i] ^= position_value


for chunk_start in range(0, len(buf), chunk_size):
    chunk_end = min(chunk_start + chunk_size, len(buf))
    buf[chunk_start:chunk_end] = buf[chunk_start:chunk_end][::-1]


for i in range(len(buf)):
    buf[i] = (buf[i] + magic_sub) % 256  

for i in range(0, len(buf) - 1, 2):
    buf[i], buf[i+1] = buf[i+1], buf[i]


def ror(val, n):
    n = n % 8
    return ((val >> n) | (val << (8 - n))) & 0xFF

for i in range(len(buf)):
    rotation = rotation_pattern[i % len(rotation_pattern)]
    buf[i] = ror(buf[i], rotation)


for i in range(len(buf)):
    buf[i] ^= xor_key[i % len(xor_key)]


flag = "".join([chr(b) for b in buf])
print(f"\nFlag found: {flag}")

# Vorpal Masters

def find_valid_license_key():
    v6_fixed = "CACI"
    s1_fixed = "PatriotCTF"
    v4_solutions = []

    for v4 in range(-5000, 10001):
        left = (v4 + 22) % 1738
        right = 6 * ((2 * v4) % 2000) + 9
        if left == right:
            v4_solutions.append(v4)

    if v4_solutions:
        for v4 in v4_solutions:
            print(f"{v6_fixed}-{v4}-{s1_fixed}")

if __name__ == "__main__":
    find_valid_license_key()

# ReadMyNote

通过在 main 函数中查找 "2025" 从而定位到

*(__m128 *)Str = _mm_xor_ps(
                   _mm_xor_ps(
                     (__m128)_mm_load_si128((const __m128i *)&xmmword_140010750),
                     (__m128)_mm_loadu_si128((const __m128i *)&xmmword_140010640)),
                   (__m128)xmmword_140010760);

然后就知道 Flag 的前 16 个字符 = [数据 A] XOR [数据 B] XOR [数据 C]。

所以需要去 IDA 里找到这三个 xmmword_... 对应的数据，这就是 flag 的第一部分。

然后再通过

qmemcpy(v2115, "5R!Z=6g3a=`2", 12); // 硬编码的字符串
WORD6(v2115[0]) = 1400;             // 补充最后两个字节 (1400 = 0x0578)
for ( nn = 16; nn != 30; ++nn )     // 循环解密
    Str[nn] ^= 5u;                  // 每个字符异或 5

可知第二部分是将字符串 "5R!Z=6g3a=2" 和 0x0578 的每个字节都异或 5`。

因此脚本为：

import struct

def solve():
    print("[-] 开始计算 Flag...")

    hex_A = "30303030303030303030303030303030"
    hex_B = "414B34525A365335495A4C7E63716675"
    hex_C = "35353535353535353535353535353535"

    bytes_A = bytes.fromhex(hex_A)[::-1]
    bytes_B = bytes.fromhex(hex_B)[::-1]
    bytes_C = bytes.fromhex(hex_C)[::-1]

    part1_chars = []
    for i in range(16):

        val = bytes_A[i] ^ bytes_B[i] ^ bytes_C[i]
        part1_chars.append(chr(val))
    
    part1 = "".join(part1_chars)

    

    raw_str = "5R!Z=6g3a=`2"

    part2_bytes = [ord(c) for c in raw_str]

    part2_bytes.append(0x78)
    part2_bytes.append(0x05)

    part2_chars = []
    for b in part2_bytes:
        part2_chars.append(chr(b ^ 5))
        
    part2 = "".join(part2_chars)


    

    full_flag = part1 + part2import struct

def solve():

    hex_A = "30303030303030303030303030303030"
    hex_B = "414B34525A365335495A4C7E63716675"
    hex_C = "35353535353535353535353535353535"

    bytes_A = bytes.fromhex(hex_A)[::-1]
    bytes_B = bytes.fromhex(hex_B)[::-1]
    bytes_C = bytes.fromhex(hex_C)[::-1]

    part1_chars = []
    for i in range(16):

        val = bytes_A[i] ^ bytes_B[i] ^ bytes_C[i]
        part1_chars.append(chr(val))
    
    part1 = "".join(part1_chars)


    

    raw_str = "5R!Z=6g3a=`2"

    part2_bytes = [ord(c) for c in raw_str]

    part2_bytes.append(0x78)
    part2_bytes.append(0x05)

    part2_chars = []
    for b in part2_bytes:
        part2_chars.append(chr(b ^ 5))
        
    part2 = "".join(part2_chars)

    

    full_flag = part1 + part2
    print(f"最终 FLAG: {full_flag}")

if __name__ == "__main__":
    solve()
    print(f"最终 FLAG: {full_flag}")


if __name__ == "__main__":
    solve()

# Entropy Discord

在字符串搜索栏中找到字符串 "\n [+] Transformation check passed!\n", 从而通过交叉引用定位到函数 sub_6ED0，然后通过观察伪代码定位到：

LABEL_8:
      *(_QWORD *)fd = &unk_47BE0;
      v29 = sub_AEC0;
      s1[0] = &off_528B8;
      s1[1] = &dword_0 + 2;
      v22 = fd;
      v23 = 1u;
      sub_45440(s1);
      byte_55961 = 0;
      signal(5, handler);
      __debugbreak();
    }

发现这里有反调试，因此需要将其对应的汇编代码 nop 掉：

.text:0000000000006FEF                 lea     rsi, handler    ; handler
.text:0000000000006FF6                 mov     edi, 5          ; sig
.text:0000000000006FFB                 call    cs:signal_ptr
.text:0000000000007001                 int     3               ; Trap to Debugger

在 nop 的时候要注意后面的：

.text:000000000000703F                 ud2
.text:0000000000007041 ; ---------------------------------------------------------------------------
.text:0000000000007041                 ud2
.text:0000000000007043 ; ---------------------------------------------------------------------------
.text:0000000000007043                 ud2
.text:0000000000007045 ; ---------------------------------------------------------------------------
.text:0000000000007045                 ud2
.text:0000000000007047 ; ---------------------------------------------------------------------------
.text:0000000000007047                 ud2
.text:0000000000007049 ; ---------------------------------------------------------------------------
.text:0000000000007049                 ud2
.text:000000000000704B ; ---------------------------------------------------------------------------
.text:000000000000704B                 ud2
.text:000000000000704D ; ---------------------------------------------------------------------------
.text:000000000000704D                 ud2
.text:000000000000704F ; ---------------------------------------------------------------------------
.text:000000000000704F                 ud2
.text:0000000000007051 ; ---------------------------------------------------------------------------
.text:0000000000007051                 ud2
.text:0000000000007053 ; ---------------------------------------------------------------------------
.text:0000000000007053                 ud2
.text:0000000000007055 ; ---------------------------------------------------------------------------
.text:0000000000007055                 ud2
.text:0000000000007057 ; ---------------------------------------------------------------------------
.text:0000000000007057                 ud2
.text:0000000000007059 ; ---------------------------------------------------------------------------
.text:0000000000007059                 ud2
.text:000000000000705B ; ---------------------------------------------------------------------------
.text:000000000000705B                 ud2
.text:000000000000705D ; ---------------------------------------------------------------------------
.text:000000000000705D                 ud2
.text:000000000000705F ; ---------------------------------------------------------------------------
.text:000000000000705F                 ud2
.text:0000000000007061 ; ---------------------------------------------------------------------------
.text:0000000000007061                 ud2
.text:0000000000007063 ; ---------------------------------------------------------------------------
.text:0000000000007063                 ud2
.text:0000000000007065 ; ---------------------------------------------------------------------------
.text:0000000000007065                 ud2
.text:0000000000007067 ; ---------------------------------------------------------------------------
.text:0000000000007067                 ud2
.text:0000000000007069 ; ---------------------------------------------------------------------------
.text:0000000000007069                 ud2
.text:000000000000706B ; ---------------------------------------------------------------------------
.text:000000000000706B                 ud2
.text:000000000000706D ; ---------------------------------------------------------------------------
.text:000000000000706D                 ud2
.text:000000000000706F ; ---------------------------------------------------------------------------
.text:000000000000706F                 ud2

这些占位符都要 nop 掉，然后 ucp 得到完整伪代码：

void sub_6ED0()
{
int v0; // eax
int v1; // ebp
unsigned __int64 v2; // rbx
unsigned __int64 v3; // r15
ssize_t v4; // rax
unsigned __int64 v5; // rax
unsigned __int64 v6; // rax
unsigned __int64 v7; // rax
unsigned __int64 v8; // rax
unsigned __int64 v9; // rax
unsigned __int64 v10; // rax
unsigned __int64 v11; // rax
unsigned __int64 v12; // rax
unsigned __int64 v13; // rax
unsigned __int64 v14; // rax
unsigned __int64 v15; // rax
unsigned __int64 v16; // rax
unsigned __int64 v17; // rax
unsigned __int64 v18; // rax
char *v19; // r14
void *v20; // r15
__int64 v21; // rbx
char *v22; // r14
unsigned __int64 v23; // rbx
signed __int64 v24; // rax
signed __int64 v25; // rtt
char v26; // al
void *v27; // rbp
unsigned __int64 v28; // rsi
unsigned __int64 v29; // rbx
void *v30; // r14
__int64 v31; // r15
void *v32; // rbx
__int64 v33; // rdx
__int64 v34; // r10
bool v35; // bl
char *v36; // rdi
unsigned __int64 v37; // r15
unsigned __int8 *v38; // r14
unsigned __int64 v39; // rax
char *v40; // rcx
__int64 v41; // r12
unsigned __int64 v42; // r11
unsigned __int64 v43; // r15
_QWORD *v44; // rbx
__int64 v45; // r12
char *v46; // rax
unsigned __int64 v47; // rcx
char *v48; // r14
char *v49; // r11
char *v50; // r14
char *v51; // r12
unsigned __int64 v52; // rbx
char *v53; // r13
int v54; // ecx
char v55; // r10
char *v56; // rbp
char *v57; // rcx
int v58; // ebx
int v59; // r12d
int v60; // r11d
char *v61; // r13
unsigned int v62; // ebx
unsigned __int64 v63; // rax
char *v64; // r12
int v65; // ecx
__int64 v66; // rax
__int64 v67; // rax
int v68; // ecx
__int64 v69; // rt2
bool v70; // r11
bool v71; // of
char *v72; // r12
int v73; // ecx
__int64 v74; // rt2
bool v75; // r11
char *v76; // rbx
unsigned int v77; // ebp
char v78; // r10
char v79; // r11
int v80; // r11d
int v81; // r10d
char *v82; // r14
void *v83; // r15
__int64 v84; // rbp
void *v85; // r14
__int64 v86; // rbx
__int64 v87; // r15
void *v88; // rdx
void *v89; // rbx
unsigned __int64 v90; // rbx
unsigned int v91; // eax
__m128i v92; // xmm0
__m128i v93; // xmm1
char *v94; // r14
void *v95; // r15
__int64 v96; // rbx
char *v97; // r14
int v98; // r13d
__int64 v99; // rdx
bool v100; // r14
__m128i v101; // xmm0
__m128i v102; // xmm1
int v103; // eax
char *v104; // rbx
__int64 v105; // r13
unsigned __int8 *v106; // r12
char *v107; // rbp
unsigned __int8 *v108; // rsi
char *v109; // rcx
unsigned __int8 *v110; // rdi
int v111; // edx
char *v112; // r14
unsigned __int8 *v113; // r15
unsigned __int8 v114; // di
char *v115; // r8
unsigned __int8 *v116; // r14
unsigned int v117; // esi
unsigned int v118; // edi
int v119; // edi
int v120; // r10d
int v121; // r9d
unsigned int v122; // r8d
_QWORD *v123; // rax
size_t v124; // r11
unsigned __int8 *v125; // rsi
unsigned int v126; // ecx
unsigned __int64 v127; // rdx
char *v128; // r14
unsigned __int8 *v129; // r15
char *v130; // rdi
unsigned __int8 *v131; // r14
unsigned int v132; // r8d
unsigned int v133; // esi
int v134; // esi
int v135; // r10d
int v136; // r9d
unsigned int v137; // edi
void *v138; // rdx
__int64 v139; // rcx
void *v140; // r12
void *v141; // rdi
void *v142; // r14
__int64 v143; // rbx
__int64 v144; // r15
void *v145; // rdx
void *v146; // rbx
unsigned __int64 v147; // rsi
_BYTE *v148; // rcx
int v149; // eax
bool v150; // cf
__int64 v151; // r8
unsigned int v152; // eax
int v153; // eax
__int64 v154; // rt2
bool v155; // r10
unsigned int v156; // edx
__int64 v157; // rdx
unsigned int v158; // r8d
void *v159; // rbx
char *v160; // r14
void *v161; // r15
__int64 v162; // rbx
char *v163; // r14
__int64 v164; // rax
__int64 v165; // rdx
char *v166; // r8
char *v167; // r9
unsigned __int8 *v168; // r10
__int64 v169; // rax
bool v170; // zf
unsigned __int8 v171; // cl
unsigned __int64 v172; // r15
_BYTE *v173; // r11
unsigned __int8 v174; // al
__int64 v175; // rcx
int v176; // eax
unsigned __int8 v177; // al
char *v178; // rbx
char *v179; // r12
__m128i v180; // xmm0
__m128i v181; // xmm2
unsigned __int64 v182; // rcx
__int64 v183; // rbx
unsigned __int64 v184; // rdx
unsigned __int64 v185; // rsi
__int64 v186; // rdi
size_t v187; // rdx
_BYTE *v188; // r15
int v189; // eax
unsigned __int64 v190; // r11
unsigned __int64 v191; // r9
__int64 v192; // r8
unsigned __int64 v193; // rcx
void **v194; // rbx
char *v195; // rdx
char i; // r15
unsigned int v197; // eax
int v198; // esi
int v199; // r9d
int v200; // r8d
__int64 v201; // rsi
char *v202; // r15
char *v203; // rcx
char *v204; // rdi
char *v205; // rbp
_BYTE *v206; // rdi
__int64 v207; // rdi
unsigned __int64 v208; // r8
void **v209; // rbx
__int64 v210; // r8
char *v211; // r11
char *v212; // r12
__int64 v213; // r12
_BYTE *v214; // r11
char *v215; // rbp
__m128i v216; // xmm0
__m128i v217; // xmm0
__m128i v218; // xmm3
char *v219; // rbp
__int64 v220; // r12
__m128i si128; // xmm8
__m128i v222; // xmm6
__m128i v223; // xmm4
__m128i v224; // xmm9
__m128i v225; // xmm7
__m128i v226; // xmm5
__int64 v227; // rdx
__int64 v228; // rdx
__int64 v229; // rdx
__int64 v230; // rdx
unsigned __int64 v231; // rax
unsigned __int8 v232; // al
unsigned __int8 v233; // bl
char v234; // al
unsigned __int8 v235; // cl
unsigned __int8 v236; // bl
char v237; // al
unsigned __int8 v238; // cl
unsigned __int8 v239; // bl
char v240; // al
unsigned __int8 v241; // cl
unsigned __int64 v242; // r15
char *v243; // r13
__int64 v244; // rdx
unsigned __int64 v245; // rax
unsigned __int8 v246; // al
__int64 v247; // rdx
unsigned __int8 v248; // bl
char v249; // al
__int64 v250; // rbx
void *v251; // rax
__int64 j; // r12
char v253; // r14
void *v254; // rbx
void *v255; // r14
char *v256; // r15
char *v257; // rdi
unsigned __int64 v258; // [rsp+8h] [rbp-2C0h] BYREF
__int128 v259; // [rsp+10h] [rbp-2B8h] BYREF
unsigned __int8 *v260; // [rsp+20h] [rbp-2A8h]
void *v261; // [rsp+28h] [rbp-2A0h]
void *v262; // [rsp+30h] [rbp-298h]
size_t v263; // [rsp+38h] [rbp-290h]
unsigned __int8 *v264; // [rsp+40h] [rbp-288h]
void *v265; // [rsp+48h] [rbp-280h]
void *s1[2]; // [rsp+50h] [rbp-278h] BYREF
__m256i v267; // [rsp+60h] [rbp-268h]
const char *v268; // [rsp+80h] [rbp-248h]
__int64 v269; // [rsp+88h] [rbp-240h]
const char *v270; // [rsp+90h] [rbp-238h]
__int64 v271; // [rsp+98h] [rbp-230h]
const char *v272; // [rsp+A0h] [rbp-228h]
__int64 v273; // [rsp+A8h] [rbp-220h]
const char *v274; // [rsp+B0h] [rbp-218h]
__int64 v275; // [rsp+B8h] [rbp-210h]
const char *v276; // [rsp+C0h] [rbp-208h]
__int64 v277; // [rsp+C8h] [rbp-200h]
int *v278; // [rsp+D0h] [rbp-1F8h] BYREF
void *s2; // [rsp+D8h] [rbp-1F0h]
size_t n; // [rsp+E0h] [rbp-1E8h]
__int64 (__fastcall *v281)(); // [rsp+E8h] [rbp-1E0h]
int fd[2]; // [rsp+F0h] [rbp-1D8h] BYREF
void *v283; // [rsp+F8h] [rbp-1D0h]
int **v284; // [rsp+100h] [rbp-1C8h]
__int64 v285; // [rsp+108h] [rbp-1C0h]
void **v286; // [rsp+110h] [rbp-1B8h]
__int64 v287; // [rsp+118h] [rbp-1B0h]
unsigned __int64 v288; // [rsp+128h] [rbp-1A0h]
__int64 v289; // [rsp+138h] [rbp-190h]
char *v290; // [rsp+140h] [rbp-188h]
__int64 v291; // [rsp+148h] [rbp-180h]
unsigned __int64 v292; // [rsp+150h] [rbp-178h]
unsigned __int64 v293; // [rsp+158h] [rbp-170h]
unsigned __int64 v294; // [rsp+160h] [rbp-168h] BYREF
int v295; // [rsp+16Ch] [rbp-15Ch]
__m128i v296; // [rsp+170h] [rbp-158h] BYREF
void *v297; // [rsp+180h] [rbp-148h]
unsigned __int64 *v298; // [rsp+188h] [rbp-140h] BYREF
void *v299; // [rsp+190h] [rbp-138h]
char *v300; // [rsp+198h] [rbp-130h]
__int64 v301; // [rsp+1A0h] [rbp-128h]
const char *v302; // [rsp+1A8h] [rbp-120h] BYREF
void *ptr; // [rsp+1B0h] [rbp-118h]
__int64 v304; // [rsp+1B8h] [rbp-110h]
int v305; // [rsp+1C4h] [rbp-104h] BYREF
unsigned int v306; // [rsp+1C8h] [rbp-100h] BYREF
int v307; // [rsp+1CCh] [rbp-FCh] BYREF
__m128i v308; // [rsp+1D0h] [rbp-F8h] BYREF
__m128i v309; // [rsp+1E0h] [rbp-E8h] BYREF
__m128i v310; // [rsp+1F0h] [rbp-D8h] BYREF
void *v311; // [rsp+208h] [rbp-C0h]
__m128i v312; // [rsp+210h] [rbp-B8h] BYREF
__m128i v313; // [rsp+220h] [rbp-A8h] BYREF
__m128i v314; // [rsp+230h] [rbp-98h] BYREF
__m128i v315; // [rsp+240h] [rbp-88h] BYREF
__m128i v316; // [rsp+250h] [rbp-78h] BYREF
unsigned __int64 v317; // [rsp+260h] [rbp-68h]
char *v318; // [rsp+268h] [rbp-60h]
__m128i v319; // [rsp+270h] [rbp-58h] BYREF
__m128i v320[4]; // [rsp+280h] [rbp-48h] BYREF
s1[0] = &off_528A8;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD )&v267.m256i_u64[1] = 0;
sub_45440(s1);
v259 = 0;
v0 = open("/dev/urandom", 0);
if ( v0 < 0 )
{
v2 = ((unsigned __int64)(unsigned int)_errno_location() << 32) | 2;
goto LABEL_17;
}
v1 = v0;
v2 = 0;
v3 = 0;
while ( 1 )
{
v4 = read(v1, (char *)&v259 + v3, 16 - v3);
if ( v4 < 0 )
break;
if ( !v4 )
{
v2 = sub_44830();
close(v1);
if ( !v2 )
goto LABEL_8;
LABEL_17:
v294 = v2;
v298 = &v294;
v299 = sub_44430;
*(_QWORD *)fd = &off_52A28;
v283 = &dword_0 + 2;
v286 = 0;
v284 = (int **)&v298;
v285 = 1;
v302 = aStderr;
ptr = &byte_6;
v23 = __readfsqword(0xFFFFFFD8);
if ( v23 )
{
if ( v23 == qword_559A8 )
goto LABEL_19;
LABEL_25:
if ( _InterlockedCompareExchange(&dword_559B0, 1, 0) )
sub_5F10(&dword_559B0);
qword_559A8 = v23;
dword_559B4 = 1;
v258 = (unsigned __int64)&qword_559A8;
}
else
{
v24 = qword_559F8;
do
{
if ( v24 == -1 )
sub_6830();
v23 = v24 + 1;
v25 = v24;
v24 = _InterlockedCompareExchange64(&qword_559F8, v24 + 1, v24);
}
while ( v25 != v24 );
__writefsqword(0xFFFFFFD8, v23);
if ( v23 != qword_559A8 )
goto LABEL_25;
LABEL_19:
if ( dword_559B4 == -1 )
sub_5970();
++dword_559B4;
v258 = (unsigned __int64)&qword_559A8;
}
v278 = (int *)&v258;
s2 = 0;
v26 = sub_BC60(&v278, &off_53DA8, fd);
v27 = s2;
if ( v26 )
{
if ( !s2 )
{
s1[0] = &off_541C8;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD )&v267.m256i_u64[1] = 0;
sub_5520(s1, &off_541D8);
}
v28 = v258;
v170 = ((_DWORD )(v258 + 12))-- == 1;
if ( v170 )
goto LABEL_34;
LABEL_35:
if ( !v27 )
goto LABEL_36;
}
else
{
if ( ((unsigned __int8)s2 & 3) != 1 )
{
v27 = 0;
v28 = v258;
v170 = ((_DWORD *)(v258 + 12))-- == 1;
if ( v170 )
goto LABEL_34;
goto LABEL_35;
}
v82 = (char *)s2 - 1;
v83 = *(void **)((char *)s2 - 1);
v84 = *(_QWORD *)((char *)s2 + 7);
if ( *(_QWORD )v84 )
((void (__fastcall **)(void *))v84)(v83);
if ( *(_QWORD )(v84 + 8) )
free(v83);
free(v82);
v27 = 0;
v28 = v258;
v170 = ((_DWORD *)(v258 + 12))-- == 1;
if ( !v170 )
goto LABEL_35;
LABEL_34:
*(_QWORD *)v28 = 0;
if ( _InterlockedExchange((volatile __int32 *)(v28 + 8), 0) != 2 )
goto LABEL_35;
syscall(202, v28 + 8, 129, 1);
if ( !v27 )
{
LABEL_36:
v29 = v294;
if ( (v294 & 3) == 1 )
{
v30 = *(void **)(v294 - 1);
v31 = *(_QWORD *)(v294 + 7);
if ( (_QWORD )v31 )
((void (__fastcall **)(_QWORD))v31)((_QWORD *)(v294 - 1));
v32 = (void *)(v29 - 1);
if ( *(_QWORD *)(v31 + 8) )
free(v30);
free(v32);
}
return;
}
}
v258 = (unsigned __int64)v27;
v278 = (int *)&v302;
s2 = sub_1A4A0;
n = (size_t)&v258;
v281 = sub_44430;
s1[0] = &off_54178;
s1[1] = &dword_0 + 2;
v267.m256i_i64[0] = (__int64)&v278;
*(_OWORD )&v267.m256i_u64[1] = 2u;
sub_5520(s1, &off_54198);
}
v3 += v4;
if ( v3 > 0xF )
goto LABEL_16;
}
v2 = ((unsigned __int64)(unsigned int)_errno_location() << 32) | 2;
LABEL_16:
close(v1);
if ( v2 )
goto LABEL_17;
LABEL_8:
*(_QWORD *)fd = &unk_47BE0;
v283 = sub_AEC0;
s1[0] = &off_528B8;
s1[1] = &dword_0 + 2;
v267.m256i_i64[0] = (__int64)fd;
*(_OWORD *)&v267.m256i_u64[1] = 1u;
sub_45440(s1);
byte_55961 = 0;
s1[0] = &off_52870;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
s1[0] = &off_528D8;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
v302 = (const char *)&v259;
v278 = (int *)&v302;
s2 = sub_6DB0;
LOWORD(s1[0]) = 2;
v267.m256i_i32[0] = 0x20000;
v267.m256i_i64[2] = 0;
v267.m256i_i32[6] = -385875936;
*(_QWORD *)fd = &unk_52A08;
v283 = &dword_0 + 2;
v286 = s1;
v287 = 1;
v284 = &v278;
v285 = 1;
sub_45440(fd);
v302 = (char *)&v259 + 1;
v278 = (int *)&v302;
s2 = sub_6DB0;
LOWORD(s1[0]) = 2;
v267.m256i_i32[0] = 0x20000;
v267.m256i_i64[2] = 0;
v267.m256i_i32[6] = -385875936;
*(_QWORD *)fd = &unk_52A08;
v283 = &dword_0 + 2;
v286 = s1;
v287 = 1;
v284 = &v278;
v285 = 1;
sub_45440(fd);
v302 = (char *)&v259 + 2;
v278 = (int *)&v302;
s2 = sub_6DB0;
LOWORD(s1[0]) = 2;
v267.m256i_i32[0] = 0x20000;
v267.m256i_i64[2] = 0;
v267.m256i_i32[6] = -385875936;
*(_QWORD *)fd = &unk_52A08;
v283 = &dword_0 + 2;
v286 = s1;
v287 = 1;
v284 = &v278;
v285 = 1;
sub_45440(fd);
v302 = (char *)&v259 + 3;
v278 = (int *)&v302;
s2 = sub_6DB0;
LOWORD(s1[0]) = 2;
v267.m256i_i32[0] = 0x20000;
v267.m256i_i64[2] = 0;
v267.m256i_i32[6] = -385875936;
*(_QWORD *)fd = &unk_52A08;
v283 = &dword_0 + 2;
v286 = s1;
v287 = 1;
v284 = &v278;
v285 = 1;
sub_45440(fd);
s1[0] = &off_528E8;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
v5 = (BYTE2(v259)
+ 16777619
* ((1540483477
* ((BYTE1(v259)
+ 16777619
* ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9LL))
^ ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9uLL)) >> 15)))
^ ((BYTE1(v259)
+ 16777619
* ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9LL))
^ ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9uLL)) >> 15))) >> 13)))
^ ((1540483477
* ((BYTE1(v259)
+ 16777619
* ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9LL))
^ ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9uLL)) >> 15)))
^ ((BYTE1(v259)
+ 16777619
* ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9LL))
^ ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9uLL)) >> 15))) >> 13))) >> 15)))
^ ((BYTE2(v259)
+ 16777619
* ((1540483477
* ((BYTE1(v259)
+ 16777619
* ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9LL))
^ ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9uLL)) >> 15)))
^ ((BYTE1(v259)
+ 16777619
* ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9LL))
^ ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9uLL)) >> 15))) >> 13)))
^ ((1540483477
* ((BYTE1(v259)
+ 16777619
* ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9LL))
^ ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9uLL)) >> 15)))
^ ((BYTE1(v259)
+ 16777619
* ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9LL))
^ ((1540483477 * (((unsigned __int8)v259 + 0x20F4CB99AD752F3DLL) ^ 0x107A65CCD6BA9uLL)) >> 15))) >> 13))) >> 15))) >> 13);
v6 = 1540483477
* ((BYTE3(v259) + 16777619 * ((1540483477 * v5) ^ ((1540483477 * v5) >> 15)))
^ ((BYTE3(v259) + 16777619 * ((1540483477 * v5) ^ ((1540483477 * v5) >> 15))) >> 13));
v7 = 1540483477
* ((BYTE4(v259) + 16777619 * (v6 ^ (v6 >> 15))) ^ ((BYTE4(v259) + 16777619 * (v6 ^ (v6 >> 15))) >> 13));
v8 = 1540483477
* ((BYTE5(v259) + 16777619 * (v7 ^ (v7 >> 15))) ^ ((BYTE5(v259) + 16777619 * (v7 ^ (v7 >> 15))) >> 13));
v9 = 1540483477
* ((BYTE6(v259) + 16777619 * (v8 ^ (v8 >> 15))) ^ ((BYTE6(v259) + 16777619 * (v8 ^ (v8 >> 15))) >> 13));
v10 = 1540483477
* ((BYTE7(v259) + 16777619 * (v9 ^ (v9 >> 15))) ^ ((BYTE7(v259) + 16777619 * (v9 ^ (v9 >> 15))) >> 13));
v11 = 1540483477
* ((BYTE8(v259) + 16777619 * (v10 ^ (v10 >> 15))) ^ ((BYTE8(v259) + 16777619 * (v10 ^ (v10 >> 15))) >> 13));
v12 = 1540483477
* ((BYTE9(v259) + 16777619 * (v11 ^ (v11 >> 15))) ^ ((BYTE9(v259) + 16777619 * (v11 ^ (v11 >> 15))) >> 13));
v13 = 1540483477
* ((BYTE10(v259) + 16777619 * (v12 ^ (v12 >> 15))) ^ ((BYTE10(v259) + 16777619 * (v12 ^ (v12 >> 15))) >> 13));
v14 = 1540483477
* ((BYTE11(v259) + 16777619 * (v13 ^ (v13 >> 15))) ^ ((BYTE11(v259) + 16777619 * (v13 ^ (v13 >> 15))) >> 13));
v15 = 1540483477
* ((BYTE12(v259) + 16777619 * (v14 ^ (v14 >> 15))) ^ ((BYTE12(v259) + 16777619 * (v14 ^ (v14 >> 15))) >> 13));
v16 = 1540483477
* ((BYTE13(v259) + 16777619 * (v15 ^ (v15 >> 15))) ^ ((BYTE13(v259) + 16777619 * (v15 ^ (v15 >> 15))) >> 13));
v17 = 1540483477
* ((BYTE14(v259) + 16777619 * (v16 ^ (v16 >> 15))) ^ ((BYTE14(v259) + 16777619 * (v16 ^ (v16 >> 15))) >> 13));
v18 = 1540483477
* ((HIBYTE(v259) + 16777619 * (v17 ^ (v17 >> 15))) ^ ((HIBYTE(v259) + 16777619 * (v17 ^ (v17 >> 15))) >> 13));
v294 = v18 ^ (v18 >> 15);
*(_QWORD *)fd = &v294;
v283 = sub_E050;
v312.m128i_i16[0] = 2;
v313.m128i_i32[0] = 0x100000;
v314.m128i_i64[0] = 0;
v314.m128i_i32[2] = -385875936;
s1[0] = &off_528F8;
s1[1] = &dword_0 + 2;
v267.m256i_i64[2] = (__int64)&v312;
v267.m256i_i64[3] = 1;
v267.m256i_i64[0] = (__int64)fd;
v267.m256i_i64[1] = 1;
sub_45440(s1);
s1[0] = (void *)0x1B600000000LL;
LODWORD(s1[1]) = 1;
WORD2(s1[1]) = 0;
sub_1FF90(fd, s1, aProcSelfStatus, 17);
if ( fd[0] )
{
v19 = (char *)v283;
if ( ((unsigned __int8)v283 & 3) == 1 )
{
v20 = *(void **)((char *)v283 - 1);
v21 = *(_QWORD *)((char *)v283 + 7);
if ( (_QWORD )v21 )
((void (__fastcall **)(_QWORD))v21)((_QWORD *)((char *)v283 - 1));
v22 = v19 - 1;
if ( *(_QWORD *)(v21 + 8) )
free(v20);
free(v22);
}
goto LABEL_202;
}
LODWORD(v265) = fd[1];
LODWORD(v278) = fd[1];
s1[0] = 0;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 0;
if ( !sub_20260(&v278, s1) )
{
v36 = (char *)s1[1];
v37 = 0;
v38 = 0;
v262 = s1[1];
while ( 1 )
{
if ( v267.m256i_i64[0] < v37 )
{
LABEL_80:
v47 = v267.m256i_i64[0] - (_QWORD)v38;
if ( (unsigned __int8 *)v267.m256i_i64[0] == v38 )
goto LABEL_181;
v46 = (char *)&v38[(_QWORD)v36];
LOBYTE(v34) = 1;
LODWORD(v260) = v34;
v264 = v38;
LABEL_82:
v48 = (char *)&v38[(_QWORD)v36];
if ( v48[v47 - 1] == 10 )
{
v34 = v47 - 1;
if ( v47 == 1 )
{
v47 = -1;
v49 = 0;
}
else
{
v170 = v48[v47 - 2] == 13;
v47 -= 2LL;
v49 = v46;
if ( !v170 )
v49 = 0;
}
if ( v49 )
v46 = v49;
else
v47 = v34;
}
}
else
{
v39 = v37;
while ( 1 )
{
v34 = v267.m256i_i64[0] - v39;
v40 = &v36[v39];
if ( v267.m256i_i64[0] - v39 > 0xF )
{
v42 = ((unsigned __int64)(v40 + 7) & 0xFFFFFFFFFFFFFFF8LL) - (_QWORD)v40;
if ( v42 )
{
v41 = 0;
while ( v40[v41] != 10 )
{
if ( v42 == ++v41 )
{
v43 = v34 - 16;
if ( v42 <= v34 - 16 )
goto LABEL_66;
goto LABEL_69;
}
}
}
else
{
v43 = v34 - 16;
v42 = 0;
LABEL_66:
v44 = (_QWORD *)(((unsigned __int64)(v40 + 7) & 0xFFFFFFFFFFFFFFF8LL) + 8);
do
{
if ( ((v44 ^ 0xA0A0A0A0A0A0A0ALL | (0x101010101010100LL - (v44 ^ 0xA0A0A0A0A0A0A0ALL)))
& ((v44 - 1) | (0x101010101010100LL - ((v44 - 1) ^ 0xA0A0A0A0A0A0A0ALL)))
& 0x8080808080808080LL) != 0x8080808080808080LL )
break;
v42 += 16LL;
v44 += 2;
}
while ( v42 <= v43 );
LABEL_69:
if ( v34 == v42 )
{
LABEL_79:
v37 = v267.m256i_i64[0];
goto LABEL_80;
}
v34 = (__int64)&v40[v42];
v45 = 0;
while ( *(_BYTE *)(v34 + v45) != 10 )
{
if ( v267.m256i_i64[0] - v42 - v39 == ++v45 )
goto LABEL_79;
}
v41 = v42 + v45;
}
}
else
{
if ( v267.m256i_i64[0] == v39 )
goto LABEL_79;
v41 = 0;
while ( v40[v41] != 10 )
{
if ( v34 == ++v41 )
goto LABEL_79;
}
}
v37 = v41 + v39 + 1;
if ( v41 + v39 < v267.m256i_i64[0] && v40[v41] == 10 )
break;
v39 += v41 + 1;
if ( v37 > v267.m256i_i64[0] )
goto LABEL_80;
}
v46 = (char *)&v38[(_QWORD)v36];
LODWORD(v260) = 0;
v264 = (unsigned __int8 *)v37;
v47 = v37 - (_QWORD)v38;
if ( (unsigned __int8 *)v37 != v38 )
goto LABEL_82;
}
if ( v47 < 0xA )
goto LABEL_49;
v34 = *(_QWORD *)v46 ^ 0x6950726563617254LL;
if ( v34 | *((unsigned __int16 *)v46 + 4) ^ 0x3A64LL )
goto LABEL_49;
if ( v47 == 10 )
{
LABEL_94:
v50 = 0;
v51 = 0;
goto LABEL_95;
}
v55 = v46[10];
if ( v55 < -64 )
sub_5AF0(v46, v47, 10, v47, &off_52838);
v56 = v46 + 10;
v57 = &v46[v47];
v50 = 0;
if ( v55 < 0 )
{
LABEL_102:
v58 = v55 & 0x1F;
v59 = v56[1] & 0x3F;
if ( (unsigned __int8)v55 <= 0xDFu )
{
v61 = v56 + 2;
v62 = v59 | (v58 << 6);
}
else
{
v60 = (v59 << 6) | v56[2] & 0x3F;
if ( (unsigned __int8)v55 < 0xF0u )
{
v61 = v56 + 3;
v62 = (v58 << 12) | v60;
}
else
{
v61 = v56 + 4;
v62 = ((v55 & 7) << 18) | (v60 << 6) | v56[3] & 0x3F;
}
}
goto LABEL_108;
}
while ( 1 )
{
v61 = v56 + 1;
v62 = (unsigned __int8)v55;
LABEL_108:
v51 = &v50[v61 - v56];
LODWORD(v34) = v62 - 9;
if ( v62 - 9 < 5 || v62 == 32 )
goto LABEL_109;
if ( v62 < 0x80 )
break;
LODWORD(v34) = v62 >> 8;
if ( v62 >> 8 <= 0x1F )
{
if ( (_DWORD)v34 )
{
if ( (_DWORD)v34 != 22 || v62 != 5760 )
break;
}
else
{
LODWORD(v34) = byte_496F7[(unsigned __int8)v62];
if ( (v34 & 1) == 0 )
break;
}
goto LABEL_109;
}
if ( (_DWORD)v34 == 32 )
{
LODWORD(v34) = byte_496F7[(unsigned __int8)v62];
if ( (v34 & 2) == 0 )
break;
goto LABEL_109;
}
if ( (_DWORD)v34 != 48 || v62 != 12288 )
break;
LABEL_109:
if ( v61 == v57 )
goto LABEL_94;
v55 = *v61;
v50 += v61 - v56;
v56 = v61;
if ( *v61 < 0 )
goto LABEL_102;
}
while ( v61 != v57 )
{
v76 = v57;
v77 = *(v57 - 1);
if ( (v77 & 0x80000000) != 0 )
{
v78 = *(v57 - 2);
if ( v78 >= -64 )
{
v57 -= 2;
v81 = v78 & 0x1F;
}
else
{
v79 = (v57 - 3);
if ( v79 >= -64 )
{
v57 -= 3;
v80 = v79 & 0xF;
}
else
{
v57 -= 4;
v80 = (((v76 - 4) & 7) << 6) | v79 & 0x3F;
}
v81 = (v80 << 6) | v78 & 0x3F;
}
LODWORD(v34) = v81 << 6;
v77 = v34 | v77 & 0x3F;
}
else
{
--v57;
}
v36 = (char *)v262;
if ( v77 - 9 >= 5 && v77 != 32 )
{
if ( v77 < 0x80 )
goto LABEL_180;
LODWORD(v34) = v77 >> 8;
if ( v77 >> 8 > 0x1F )
{
if ( (_DWORD)v34 == 32 )
{
LODWORD(v34) = byte_496F7[(unsigned __int8)v77];
v36 = (char *)v262;
LOBYTE(v34) = (unsigned __int8)v34 >> 1;
}
else
{
if ( (_DWORD)v34 != 48 )
{
LABEL_180:
v51 = &v76[v51 - v61];
break;
}
LOBYTE(v34) = v77 == 12288;
}
}
else if ( (_DWORD)v34 )
{
if ( (_DWORD)v34 != 22 )
goto LABEL_180;
LOBYTE(v34) = v77 == 5760;
}
else
{
LODWORD(v34) = byte_496F7[(unsigned __int8)v77];
v36 = (char *)v262;
}
if ( (v34 & 1) == 0 )
goto LABEL_180;
}
}
LABEL_95:
v52 = v51 - v50;
if ( v51 == v50 )
goto LABEL_49;
v53 = &v50[(_QWORD)v46 + 10];
if ( v52 != 1 )
{
LOBYTE(v54) = *v53;
goto LABEL_128;
}
v54 = (unsigned __int8)*v53;
if ( v54 == 43 || v54 == 45 )
goto LABEL_49;
LABEL_128:
if ( (_BYTE)v54 == 45 )
{
if ( v52 < 9 )
{
if ( v52 == 1 )
goto LABEL_196;
v64 = v51 - 1;
v65 = 0;
while ( 1 )
{
LODWORD(v34) = (unsigned __int8)v50[(_QWORD)v46 + 11] - 48;
if ( (unsigned int)v34 > 9 )
goto LABEL_49;
v65 = 10 * v65 - v34;
if ( v64 == ++v50 )
goto LABEL_197;
}
}
v72 = v51 - 1;
v65 = 0;
while ( v72 != v50 )
{
v74 = 10LL * v65;
v73 = 10 * v65;
v75 = HIDWORD(v74) != 0;
LODWORD(v34) = (unsigned __int8)v50[(_QWORD)v46 + 11] - 48;
if ( (unsigned int)v34 <= 9 && !v75 )
{
++v50;
v71 = OFSUB(v73, (_DWORD)v34);
v65 = v73 - v34;
if ( !v71 )
continue;
}
goto LABEL_49;
}
goto LABEL_197;
}
if ( (unsigned __int8)v54 != 43 )
{
if ( v52 <= 7 )
goto LABEL_140;
goto LABEL_145;
}
v53 = &v50[(_QWORD)v46 + 11];
v63 = v52 - 1;
if ( v52 >= 9 )
{
--v52;
LABEL_145:
v67 = 0;
v65 = 0;
while ( v52 != v67 )
{
v69 = 10LL * v65;
v68 = 10 * v65;
v70 = HIDWORD(v69) != 0;
LODWORD(v34) = (unsigned __int8)v53[v67] - 48;
if ( (unsigned int)v34 <= 9 && !v70 )
{
++v67;
v71 = OFADD((_DWORD)v34, v68);
v65 = v34 + v68;
if ( !v71 )
continue;
}
goto LABEL_49;
}
LABEL_197:
v35 = v65 != 0;
goto LABEL_198;
}
--v52;
if ( !v63 )
{
LABEL_196:
v65 = 0;
goto LABEL_197;
}
LABEL_140:
v66 = 0;
v65 = 0;
while ( 1 )
{
LODWORD(v34) = (unsigned __int8)v53[v66] - 48;
if ( (unsigned int)v34 > 9 )
break;
v65 = v34 + 10 * v65;
if ( v52 == ++v66 )
goto LABEL_197;
}
LABEL_49:
v38 = v264;
if ( (_BYTE)v260 )
{
LABEL_181:
if ( s1[0] )
free(v36);
close((int)v265);
goto LABEL_202;
}
}
}
if ( (v33 & 3) == 1 )
{
v85 = *(void **)(v33 - 1);
v86 = *(_QWORD *)(v33 + 7);
if ( (_QWORD )v86 )
{
v87 = v33;
((void (__fastcall **)(_QWORD))v86)((_QWORD *)(v33 - 1));
v33 = v87;
}
v88 = (void *)(v33 - 1);
if ( *(_QWORD *)(v86 + 8) )
{
v89 = v88;
free(v85);
v88 = v89;
}
free(v88);
v35 = 0;
}
else
{
v35 = 0;
}
LABEL_198:
if ( s1[0] )
free(s1[1]);
close((int)v265);
if ( v35 )
{
s1[0] = &off_52918;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
LOBYTE(v259) = v259 ^ 0xDE;
BYTE3(v259) ^= 0xADu;
BYTE7(v259) ^= 0xBEu;
BYTE11(v259) ^= 0xEFu;
}
LABEL_202:
v90 = (BYTE9(v259) << 8)
| (BYTE5(v259) << 16)
| (BYTE2(v259) << 24)
| ((unsigned __int64)BYTE11(v259) << 32)
| ((unsigned __int64)BYTE7(v259) << 40)
| ((unsigned __int64)BYTE3(v259) << 48)
| ((unsigned __int64)(unsigned int)v259 << 56)
| (unsigned __int8)(HIBYTE(v259)
^ BYTE14(v259)
^ BYTE13(v259)
^ BYTE12(v259)
^ BYTE10(v259)
^ BYTE8(v259)
^ BYTE6(v259)
^ BYTE4(v259)
^ BYTE1(v259)
^ BYTE11(v259)
^ BYTE9(v259)
^ BYTE7(v259)
^ BYTE5(v259)
^ BYTE3(v259)
^ v259
^ BYTE2(v259));
if ( ptrace(PTRACE_TRACEME, 0, 0, 0) == -1 )
{
s1[0] = &off_52880;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
v90 ^= 0xF3F3DDE3DEADB33FLL;
}
else
{
v91 = getpid();
ptrace(PTRACE_DETACH, v91, 0, 0);
}
v258 = 0x9E3779B97F4A7C15LL * (ROL8(v90, 13) ^ 0xDEADBEEFLL);
v278 = (int *)&v258;
s2 = sub_E050;
v92 = _mm_loadu_si128(&v312);
v93 = _mm_loadu_si128(&v313);
*(__m128i *)&v267.m256i_u64[2] = _mm_loadu_si128(&v314);
*(__m128i *)v267.m256i_i8 = v93;
*(__m128i *)s1 = v92;
*(_QWORD *)fd = &off_52928;
v283 = &dword_0 + 2;
v286 = s1;
v287 = 1;
v284 = &v278;
v285 = 1;
sub_45440(fd);
s1[0] = (void *)0x1B600000000LL;
LODWORD(s1[1]) = 1;
WORD2(s1[1]) = 0;
sub_1FF90(fd, s1, aProcSelfStat, 15);
if ( fd[0] )
{
v94 = (char *)v283;
if ( ((unsigned __int8)v283 & 3) == 1 )
{
v95 = *(void **)((char *)v283 - 1);
v96 = *(_QWORD *)((char *)v283 + 7);
if ( (_QWORD )v96 )
((void (__fastcall **)(_QWORD))v96)((_QWORD *)((char *)v283 - 1));
v97 = v94 - 1;
if ( *(_QWORD *)(v96 + 8) )
free(v95);
free(v97);
if ( v258 != 0xCAFEBABE13371337LL )
goto LABEL_216;
goto LABEL_444;
}
goto LABEL_443;
}
v98 = fd[1];
v305 = fd[1];
v298 = 0;
v299 = &dword_0 + 1;
v300 = 0;
if ( sub_20260(&v305, &v298) )
{
if ( (v99 & 3) == 1 )
{
v142 = *(void **)(v99 - 1);
v143 = *(_QWORD *)(v99 + 7);
if ( (_QWORD )v143 )
{
v144 = v99;
((void (__fastcall **)(_QWORD))v143)((_QWORD *)(v99 - 1));
v99 = v144;
}
v145 = (void *)(v99 - 1);
if ( *(_QWORD *)(v143 + 8) )
{
v146 = v145;
free(v142);
v145 = v146;
}
free(v145);
v100 = 0;
}
else
{
v100 = 0;
}
goto LABEL_439;
}
LODWORD(v262) = v98;
v103 = (int)v300;
v265 = v300;
v104 = &v300[(_QWORD)v299];
v264 = 0;
v105 = 0x100003E00LL;
v106 = 0;
v107 = (char *)v299;
v260 = 0;
v108 = 0;
v109 = (char *)v299;
v110 = 0;
v111 = 0;
do
{
LABEL_219:
if ( (v111 & 1) != 0 )
{
v100 = 0;
v98 = (int)v262;
goto LABEL_439;
}
v113 = v110;
LOBYTE(v103) = 1;
if ( v109 == v104 )
{
LOBYTE(v109) = 1;
v264 = (unsigned __int8 *)v109;
goto LABEL_222;
}
do
{
v115 = v109;
v116 = v108;
v117 = (unsigned __int8)*v109;
if ( (v117 & 0x80u) != 0 )
{
v119 = v117 & 0x1F;
v120 = v109[1] & 0x3F;
if ( (unsigned __int8)v117 <= 0xDFu )
{
v109 += 2;
v118 = v120 | (v119 << 6);
}
else
{
v121 = (v120 << 6) | v109[2] & 0x3F;
if ( (unsigned __int8)v117 < 0xF0u )
{
v109 += 3;
v118 = v121 | (v119 << 12);
}
else
{
v109 += 4;
v118 = (v121 << 6) | v115[3] & 0x3F | ((v117 & 7) << 18);
}
}
}
else
{
++v109;
v118 = v117;
}
v108 = &v116[v109 - v115];
if ( v118 <= 0x20 && _bittest64(&v105, v118) )
{
LABEL_218:
v106 = v108;
v107 = v109;
v260 = v108;
v110 = v108;
v103 = v111;
v112 = (char *)(v116 - v113);
if ( v112 )
goto LABEL_247;
goto LABEL_219;
}
if ( v118 >= 0x80 )
{
v122 = v118 >> 8;
if ( v118 >> 8 > 0x1F )
{
if ( v122 == 32 )
{
v114 = byte_496F7[(unsigned __int8)v118] >> 1;
}
else
{
if ( v122 != 48 )
continue;
v114 = v118 == 12288;
}
}
else if ( v122 )
{
if ( v122 != 22 )
continue;
v114 = v118 == 5760;
}
else
{
v114 = byte_496F7[(unsigned __int8)v118];
}
if ( (v114 & 1) != 0 )
goto LABEL_218;
}
}
while ( v109 != v104 );
LOBYTE(v109) = 1;
v264 = (unsigned __int8 *)v109;
v106 = v108;
v107 = &v300[(_QWORD)v299];
LABEL_222:
v109 = &v300[(_QWORD)v299];
v110 = v113;
v111 = v103;
v112 = (char *)((_BYTE *)v265 - v113);
}
while ( v265 == v113 );
LABEL_247:
v263 = (size_t)v299;
v123 = malloc(0x40u);
if ( !v123 )
sub_53C0(8, 64);
v124 = v263;
*v123 = &v113[v263];
v123[1] = v112;
s1[0] = &byte_4;
s1[1] = v123;
v267.m256i_i64[0] = 1;
v261 = &dword_0 + 1;
while ( 1 )
{
v125 = v260;
v126 = (unsigned int)v264;
v127 = (unsigned int)v264;
LABEL_251:
if ( (v127 & 1) != 0 )
break;
v129 = v125;
LOBYTE(v126) = 1;
while ( v107 != v104 )
{
v130 = v107;
v131 = v106;
v132 = (unsigned __int8)*v107;
if ( (v132 & 0x80u) != 0 )
{
v134 = v132 & 0x1F;
v135 = v107[1] & 0x3F;
if ( (unsigned __int8)v132 <= 0xDFu )
{
v107 += 2;
v133 = v135 | (v134 << 6);
}
else
{
v136 = (v135 << 6) | v107[2] & 0x3F;
if ( (unsigned __int8)v132 < 0xF0u )
{
v107 += 3;
v133 = v136 | (v134 << 12);
}
else
{
v107 += 4;
v133 = (v136 << 6) | v130[3] & 0x3F | ((v132 & 7) << 18);
}
}
}
else
{
++v107;
v133 = v132;
}
v106 += v107 - v130;
if ( v133 <= 0x20 && _bittest64(&v105, v133) )
{
LABEL_250:
v260 = v106;
v125 = v106;
v126 = v127;
v127 = (unsigned int)v127;
v128 = (char *)(v131 - v129);
if ( !v128 )
goto LABEL_251;
goto LABEL_278;
}
if ( v133 >= 0x80 )
{
v137 = v133 >> 8;
if ( v133 >> 8 > 0x1F )
{
if ( v137 == 32 )
{
if ( (byte_496F7[(unsigned __int8)v133] & 2) != 0 )
goto LABEL_250;
}
else if ( v137 == 48 && v133 == 12288 )
{
goto LABEL_250;
}
}
else if ( v137 )
{
if ( v137 == 22 && v133 == 5760 )
goto LABEL_250;
}
else if ( (byte_496F7[(unsigned __int8)v133] & 1) != 0 )
{
goto LABEL_250;
}
}
}
LOBYTE(v127) = 1;
v264 = (unsigned __int8 *)v127;
v125 = v129;
v127 = v126;
v128 = (char *)((_BYTE *)v265 - v129);
if ( v265 == v129 )
goto LABEL_251;
LABEL_278:
v138 = v261;
if ( v261 == s1[0] )
{
sub_5250(s1, v261);
v138 = v261;
v124 = v263;
v123 = s1[1];
}
v139 = 2LL * (_QWORD)v138;
v123[v139] = &v129[v124];
v123[v139 + 1] = v128;
v261 = (char *)v138 + 1;
v267.m256i_i64[0] = (__int64)v138 + 1;
}
v140 = s1[0];
v141 = s1[1];
if ( (unsigned __int64)v261 < 4 )
{
v100 = 0;
v98 = (int)v262;
goto LABEL_437;
}
v147 = *((_QWORD *)s1[1] + 7);
v98 = (int)v262;
if ( !v147 )
goto LABEL_300;
v148 = (_BYTE )((_QWORD *)s1[1] + 6);
if ( v147 == 1 )
{
v149 = (unsigned __int8)*v148;
v100 = 0;
if ( v149 == 43 )
goto LABEL_437;
v147 = 1;
if ( v149 == 45 )
goto LABEL_437;
LABEL_302:
v157 = 0;
v152 = 0;
while ( 1 )
{
v158 = (unsigned __int8)v148[v157] - 48;
if ( v158 > 9 )
break;
v152 = v158 + 10 * v152;
if ( v147 == ++v157 )
goto LABEL_305;
}
LABEL_300:
v100 = 0;
goto LABEL_437;
}
if ( *v148 == 43 )
{
++v148;
v150 = v147-- < 0xA;
if ( v150 )
goto LABEL_302;
}
else if ( v147 < 9 )
{
goto LABEL_302;
}
v151 = 0;
v152 = 0;
v100 = 0;
while ( v147 != v151 )
{
v154 = 10LL * v152;
v153 = 10 * v152;
v155 = HIDWORD(v154) != 0;
v156 = (unsigned __int8)v148[v151] - 48;
if ( v156 > 9 || v155 )
goto LABEL_437;
++v151;
v150 = CFADD(v156, v153);
v152 = v156 + v153;
if ( v150 )
goto LABEL_300;
}
LABEL_305:
v265 = s1[1];
v306 = v152;
*(_QWORD *)fd = &v306;
v283 = sub_BE70;
s1[0] = &off_52850;
s1[1] = &dword_0 + 2;
v267.m256i_i64[0] = (__int64)fd;
*(_OWORD *)&v267.m256i_u64[1] = 1u;
sub_AB20(&v302, s1);
v264 = (unsigned __int8 *)v302;
s1[0] = (void *)0x1B600000000LL;
v159 = ptr;
LODWORD(s1[1]) = 1;
WORD2(s1[1]) = 0;
sub_1FF90(fd, s1, ptr, v304);
if ( fd[0] )
{
v160 = (char *)v283;
if ( ((unsigned __int8)v283 & 3) == 1 )
{
v297 = v159;
v161 = *(void **)((char *)v283 - 1);
v162 = *(_QWORD *)((char *)v283 + 7);
if ( (_QWORD )v162 )
((void (__fastcall **)(_QWORD))v162)((_QWORD *)((char *)v283 - 1));
v163 = v160 - 1;
if ( *(_QWORD *)(v162 + 8) )
free(v161);
free(v163);
v159 = v297;
}
v100 = 0;
LABEL_434:
if ( v264 )
free(v159);
v141 = v265;
LABEL_437:
if ( v140 )
free(v141);
LABEL_439:
if ( v298 )
free(v299);
close(v98);
if ( v100 )
{
s1[0] = &off_52948;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
v294 ^= 0xDEABDEABDEADB33FLL;
}
LABEL_443:
if ( v258 != 0xCAFEBABE13371337LL )
goto LABEL_216;
goto LABEL_444;
}
v295 = fd[1];
v307 = fd[1];
v278 = 0;
s2 = &dword_0 + 1;
n = 0;
v164 = sub_20260(&v307, &v278);
v100 = v164 == 0;
if ( v164 )
{
sub_6E40(v165);
LABEL_431:
if ( v278 )
free(s2);
close(v295);
goto LABEL_434;
}
v297 = v159;
v311 = v140;
s1[0] = aGdb;
s1[1] = &dword_0 + 3;
v267.m256i_i64[0] = (__int64)aLldb;
v267.m256i_i64[1] = 4;
v267.m256i_i64[2] = (__int64)"radare2r2idax64dbgstraceltrace\n"
"\n"
"\n"
"[!] Debugger detected! The entropy spirits are ANGRY!\n"
"\n"
"\n"
"\n"
"src/crypto.rs\n"
"\n"
"[!] Debugger detected! The entropy spirits are displeased!\n"
"\n"
"/dev/urandom";
v267.m256i_i64[3] = 7;
v268 = "r2idax64dbgstraceltrace\n"
"\n"
"\n"
"[!] Debugger detected! The entropy spirits are ANGRY!\n"
"\n"
"\n"
"\n"
"src/crypto.rs\n"
"\n"
"[!] Debugger detected! The entropy spirits are displeased!\n"
"\n"
"/dev/urandom";
v269 = 2;
v270 = "idax64dbgstraceltrace\n"
"\n"
"\n"
"[!] Debugger detected! The entropy spirits are ANGRY!\n"
"\n"
"\n"
"\n"
"src/crypto.rs\n"
"\n"
"[!] Debugger detected! The entropy spirits are displeased!\n"
"\n"
"/dev/urandom";
v271 = 3;
v272 = "x64dbgstraceltrace\n"
"\n"
"\n"
"[!] Debugger detected! The entropy spirits are ANGRY!\n"
"\n"
"\n"
"\n"
"src/crypto.rs\n"
"\n"
"[!] Debugger detected! The entropy spirits are displeased!\n"
"\n"
"/dev/urandom";
v273 = 6;
v274 = "straceltrace\n"
"\n"
"\n"
"[!] Debugger detected! The entropy spirits are ANGRY!\n"
"\n"
"\n"
"\n"
"src/crypto.rs\n"
"\n"
"[!] Debugger detected! The entropy spirits are displeased!\n"
"\n"
"/dev/urandom";
v275 = 6;
v276 = "ltrace\n"
"\n"
"\n"
"[!] Debugger detected! The entropy spirits are ANGRY!\n"
"\n"
"\n"
"\n"
"src/crypto.rs\n"
"\n"
"[!] Debugger detected! The entropy spirits are displeased!\n"
"\n"
"/dev/urandom";
v277 = 6;
v166 = (char *)s2;
v167 = (char *)n;
v318 = (char *)s2 + 48;
v168 = 0;
v261 = s2;
v263 = n;
while ( 2 )
{
v172 = *(unsigned __int64 *)((char *)&s1[1] + (_QWORD)v168);
if ( !v172 )
goto LABEL_430;
v173 = *(void **)((char *)s1 + (_QWORD)v168);
v260 = v168;
if ( v172 >= (unsigned __int64)v167 )
{
if ( (char *)v172 == v167 )
{
v176 = bcmp(v173, v166, (size_t)v167);
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
v170 = v176 == 0;
goto LABEL_317;
}
goto LABEL_319;
}
if ( v172 != 1 )
{
if ( v172 < 0x21 )
{
v177 = *v173;
v293 = v172;
if ( v172 == 2 )
{
v178 = v167;
v179 = v166;
if ( (unsigned __int64)v167 < 0x11 )
goto LABEL_341;
v180 = _mm_cvtsi32_si128(v177);
v181 = _mm_shuffle_epi32(_mm_shufflelo_epi16(_mm_unpacklo_epi8(v180, v180), 0), 0);
LOBYTE(v182) = v173[1];
v183 = 1;
LABEL_403:
v217 = _mm_cvtsi32_si128((unsigned __int8)v182);
v218 = _mm_shuffle_epi32(_mm_shufflelo_epi16(_mm_unpacklo_epi8(v217, v217), 0), 0);
*(_QWORD *)fd = v166;
v283 = v167;
v284 = (int **)(v173 + 1);
v317 = v172 - 1;
v285 = v172 - 1;
v296 = v181;
v310 = v218;
if ( v172 + 63 >= (unsigned __int64)v167 )
{
v171 = 0;
v220 = 0;
}
else
{
v219 = &v318[v183];
v220 = 0;
v171 = 0;
v301 = v183;
do
{
if ( (v171 & 1) != 0 )
break;
si128 = _mm_loadu_si128((const __m128i *)&v166[v220 + 16]);
v222 = _mm_loadu_si128((const __m128i *)&v166[v220 + 32]);
v223 = _mm_loadu_si128((const __m128i *)&v166[v220 + 48]);
v224 = _mm_loadu_si128((const __m128i *)&v219[v220 - 32]);
v225 = _mm_loadu_si128((const __m128i *)&v219[v220 - 16]);
v226 = _mm_loadu_si128((const __m128i *)&v219[v220]);
v227 = (unsigned int)_mm_movemask_epi8(
_mm_and_si128(
_mm_cmpeq_epi8(_mm_loadu_si128((const __m128i *)&v219[v220 - 48]), v218),
_mm_cmpeq_epi8(_mm_loadu_si128((const __m128i *)&v166[v220]), v181)));
if ( (_DWORD)v227 )
{
v309 = v223;
v308 = v226;
v316 = v222;
v315 = v225;
v320[0] = si128;
v319 = v224;
v232 = sub_5050(fd, v220, v227, 0);
v224 = _mm_load_si128(&v319);
si128 = _mm_load_si128(v320);
v225 = _mm_load_si128(&v315);
v222 = _mm_load_si128(&v316);
v226 = _mm_load_si128(&v308);
v223 = _mm_load_si128(&v309);
v218 = _mm_load_si128(&v310);
v181 = _mm_load_si128(&v296);
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
v171 = v232;
}
v228 = (unsigned int)_mm_movemask_epi8(_mm_and_si128(_mm_cmpeq_epi8(v224, v218), _mm_cmpeq_epi8(si128, v181)));
if ( (_WORD)v228 )
{
v233 = v171;
v309 = v223;
v308 = v226;
v316 = v222;
v315 = v225;
v234 = sub_5050(fd, v220 + 16, v228, v171);
v225 = _mm_load_si128(&v315);
v222 = _mm_load_si128(&v316);
v226 = _mm_load_si128(&v308);
v223 = _mm_load_si128(&v309);
v218 = _mm_load_si128(&v310);
v181 = _mm_load_si128(&v296);
v235 = v233;
v183 = v301;
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
v171 = (v234 | v235) & 1;
}
v229 = (unsigned int)_mm_movemask_epi8(_mm_and_si128(_mm_cmpeq_epi8(v225, v218), _mm_cmpeq_epi8(v222, v181)));
if ( (_WORD)v229 )
{
v236 = v171;
v309 = v223;
v308 = v226;
v237 = sub_5050(fd, v220 + 32, v229, v171);
v226 = _mm_load_si128(&v308);
v223 = _mm_load_si128(&v309);
v218 = _mm_load_si128(&v310);
v181 = _mm_load_si128(&v296);
v238 = v236;
v183 = v301;
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
v171 = (v237 | v238) & 1;
}
v230 = (unsigned int)_mm_movemask_epi8(_mm_and_si128(_mm_cmpeq_epi8(v226, v218), _mm_cmpeq_epi8(v223, v181)));
if ( (_WORD)v230 )
{
v239 = v171;
v240 = sub_5050(fd, v220 + 48, v230, v171);
v218 = _mm_load_si128(&v310);
v181 = _mm_load_si128(&v296);
v241 = v239;
v183 = v301;
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
v171 = (v240 | v241) & 1;
}
v231 = v220 + v172 + 63 + 64;
v220 += 64;
}
while ( v231 < (unsigned __int64)v167 );
}
if ( v172 + v220 + 15 < (unsigned __int64)v167 )
{
v242 = v172 + 15;
v243 = &v166[v183];
do
{
if ( (v171 & 1) != 0 )
break;
v244 = (unsigned int)_mm_movemask_epi8(
_mm_and_si128(
_mm_cmpeq_epi8(_mm_loadu_si128((const __m128i *)&v243[v220]), v218),
_mm_cmpeq_epi8(_mm_loadu_si128((const __m128i *)&v166[v220]), v181)));
if ( (_DWORD)v244 )
{
v246 = sub_5050(fd, v220, v244, 0);
v218 = _mm_load_si128(&v310);
v181 = _mm_load_si128(&v296);
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
v171 = v246;
}
v245 = v242 + v220 + 16;
v220 += 16;
}
while ( v245 < (unsigned __int64)v167 );
}
v247 = (unsigned int)_mm_movemask_epi8(
_mm_and_si128(
_mm_cmpeq_epi8(
_mm_loadu_si128((const __m128i *)&v167[(_QWORD)v166 - v317 - 16 + v183]),
v218),
_mm_cmpeq_epi8(
_mm_loadu_si128((const __m128i *)&v167[(_QWORD)v166 - v317 - 16]),
v181)));
if ( (_DWORD)v247 )
{
v248 = v171;
v249 = sub_5050(fd, &v167[-v317 - 16], v247, v171);
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
v171 = (v249 | v248) & 1;
}
v98 = (int)v262;
goto LABEL_318;
}
v182 = v172 - 4;
v184 = 0;
if ( v172 >= 4 )
v184 = v172 - 4;
v185 = v172;
while ( v184 < v185 )
{
v186 = v185 - 1;
if ( v185 - 1 >= v172 )
sub_54BE(v186, v172, &off_52820, v182, v166);
v182 = (unsigned __int8)v173[--v185];
if ( (_BYTE)v182 != v177 )
{
v178 = v167;
v179 = v166;
if ( (unsigned __int64)v167 >= v172 + 15 )
{
v216 = _mm_cvtsi32_si128(v177);
v181 = _mm_shuffle_epi32(_mm_shufflelo_epi16(_mm_unpacklo_epi8(v216, v216), 0), 0);
v183 = v186;
goto LABEL_403;
}
LABEL_341:
while ( 1 )
{
v187 = v172;
v188 = v173;
v189 = bcmp(v179, v173, v187);
v173 = v188;
v172 = v293;
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
if ( !v189 )
goto LABEL_430;
++v179;
if ( v293 > (unsigned __int64)--v178 )
goto LABEL_319;
}
}
}
}
sub_D920(fd, v166, v167, v173, v172);
if ( fd[0] == 1 )
{
v190 = v288;
v191 = v292 - 1;
if ( v288 == -1 )
{
v207 = v287;
v208 = v287 + v191;
if ( v287 + v191 < (unsigned __int64)v290 )
{
v209 = v286;
v296.m128i_i64[0] = v285;
v293 = (unsigned __int64)v283 - 1;
while ( !_bittest64((const __int64 *)&v209, *(unsigned __int8 *)(v289 + v208)) )
{
v207 += v292;
LABEL_387:
v208 = v207 + v191;
i = 0;
if ( v207 + v191 >= (unsigned __int64)v290 )
goto LABEL_427;
}
v210 = v289 + v207;
v211 = (char *)v283;
while ( (unsigned __int64)v211 < v292 )
{
v212 = v211;
if ( &v211[v207] >= v290 )
{
v257 = (char *)v283 + v207;
if ( v290 > v257 )
v257 = v290;
sub_54BE(v257, v290, &off_53A70, v283, v210);
}
++v211;
if ( v212[v291] != v212[v210] )
{
v207 = (__int64)&v212[v207 - (_QWORD)v283 + 1];
goto LABEL_387;
}
}
if ( v293 >= v292 )
{
i = 1;
v98 = (int)v262;
if ( v283 )
sub_54BE(v293, v292, &off_53A40, v283, v210);
}
else
{
v213 = v207 - 1;
v214 = v283;
v215 = (char *)v283;
while ( 1 )
{
v150 = v215-- == 0;
if ( v150 )
break;
if ( &v214[v213] >= v290 )
sub_54BE(&v214[v213], v290, &off_53A58, v283, &v214[v213]);
v170 = v214[v291 - 1] == v214[v289 - 1 + v207];
v214 = v215;
if ( !v170 )
{
v207 += v296.m128i_i64[0];
v98 = (int)v262;
goto LABEL_387;
}
}
i = 1;
v98 = (int)v262;
}
goto LABEL_427;
}
}
else
{
v192 = v287;
v193 = v287 + v191;
if ( v287 + v191 < (unsigned __int64)v290 )
{
v194 = v286;
v293 = v285;
v296.m128i_i64[0] = v292 - v285;
while ( !_bittest64((const __int64 *)&v194, *(unsigned __int8 *)(v289 + v193)) )
{
v192 += v292;
v190 = 0;
LABEL_368:
v193 = v192 + v191;
i = 0;
if ( v192 + v191 >= (unsigned __int64)v290 )
goto LABEL_427;
}
v202 = (char *)v283;
if ( v190 > (unsigned __int64)v283 )
v202 = (char *)v190;
v203 = (char *)(v289 + v192);
v204 = v202;
while ( (unsigned __int64)v204 < v292 )
{
v205 = v204;
if ( &v204[v192] >= v290 )
{
v256 = &v202[v192];
if ( v290 > v256 )
v256 = v290;
sub_54BE(v256, v290, &off_53A70, v203, v192);
}
++v204;
v98 = (int)v262;
if ( v205[v291] != v205[(_QWORD)v203] )
{
v192 = (__int64)&v205[v192 - (_QWORD)v283 + 1];
v190 = 0;
goto LABEL_368;
}
}
v206 = v283;
while ( v190 < (unsigned __int64)v206 )
{
if ( (unsigned __int64)--v206 >= v292 )
sub_54BE(v206, v292, &off_53A40, v203, v192);
v203 = &v206[v192];
if ( &v206[v192] >= v290 )
sub_54BE(&v206[v192], v290, &off_53A58, v203, v192);
if ( v206[v291] != v203[v289] )
{
v192 += v293;
v190 = v296.m128i_i64[0];
goto LABEL_368;
}
}
i = 1;
goto LABEL_427;
}
}
}
else if ( !BYTE2(v285) )
{
v195 = (char *)v283;
for ( i = v285; ; i ^= 1u )
{
if ( v195 )
{
if ( v195 >= v290 )
{
if ( v195 != v290 )
LABEL_480:
sub_5AF0(v289, v290, v195, v290, &off_53E08);
}
else if ( v195[v289] < -64 )
{
goto LABEL_480;
}
}
if ( v195 == v290 )
goto LABEL_427;
v197 = (unsigned __int8)v195[v289];
if ( (v197 & 0x80u) != 0 )
{
v198 = v197 & 0x1F;
v199 = v195[v289 + 1] & 0x3F;
if ( (unsigned __int8)v197 <= 0xDFu )
{
v197 = v199 | (v198 << 6);
}
else
{
v200 = (v199 << 6) | v195[v289 + 2] & 0x3F;
if ( (unsigned __int8)v197 < 0xF0u )
v197 = (v198 << 12) | v200;
else
v197 = ((v197 & 7) << 18) | (v200 << 6) | v195[v289 + 3] & 0x3F;
}
}
if ( (i & 1) != 0 )
{
i = 1;
goto LABEL_427;
}
v201 = 1;
if ( v197 >= 0x80 )
{
v201 = 2;
if ( v197 >= 0x800 )
v201 = 4LL - (v197 < (unsigned int)&loc_10000);
}
v195 += v201;
}
}
i = 0;
LABEL_427:
v166 = (char *)v261;
v167 = (char *)v263;
v168 = v260;
v171 = i;
goto LABEL_318;
}
v174 = *v173;
if ( (unsigned __int64)v167 <= 0xF )
{
v175 = 0;
while ( v166[v175] != v174 )
{
if ( v167 == (char *)++v175 )
goto LABEL_319;
}
LABEL_430:
v140 = v311;
v159 = v297;
goto LABEL_431;
}
v169 = sub_D840(v174, v166, v167);
v168 = v260;
v167 = (char *)v263;
v166 = (char *)v261;
v170 = v169 == 1;
LABEL_317:
v171 = v170;
LABEL_318:
if ( (v171 & 1) != 0 )
goto LABEL_430;
LABEL_319:
v168 += 16;
if ( v168 != (unsigned __int8 *)&qword_80 )
continue;
break;
}
if ( v278 )
free(v166);
close(v295);
if ( v264 )
free(v297);
if ( v311 )
free(v265);
if ( v298 )
free(v299);
close((int)v262);
if ( v258 != 0xCAFEBABE13371337LL )
{
LABEL_216:
s1[0] = &off_529A8;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
v278 = (int *)&unk_47BE8;
s2 = sub_E050;
*(__m128i *)&v267.m256i_u64[2] = v314;
*(__m128i *)v267.m256i_i8 = v313;
*(__m128i *)s1 = v312;
*(_QWORD *)fd = &off_529B8;
v283 = &dword_0 + 2;
v286 = s1;
v287 = 1;
v284 = &v278;
v285 = 1;
sub_45440(fd);
v278 = (int *)&v258;
s2 = sub_E050;
v101 = _mm_loadu_si128(&v312);
v102 = _mm_loadu_si128(&v313);
*(__m128i *)&v267.m256i_u64[2] = _mm_loadu_si128(&v314);
*(__m128i *)v267.m256i_i8 = v102;
*(__m128i *)s1 = v101;
*(_QWORD *)fd = &off_529D8;
v283 = &dword_0 + 2;
v286 = s1;
v287 = 1;
v284 = &v278;
v285 = 1;
sub_45440(fd);
s1[0] = &off_529F8;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
return;
}
LABEL_444:
s1[0] = &off_52958;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
s1[0] = &off_52968;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
v250 = v294;
v251 = malloc(0x1Eu);
if ( !v251 )
sub_53C0(1, 30);
s1[0] = &off_18 + 6;
s1[1] = v251;
v267.m256i_i64[0] = 0;
for ( j = 0; j != 30; v267.m256i_i64[0] = j )
{
v250 = 0x5DEECE66DLL * v250 + 11;
v253 = byte_47ED2[j] ^ BYTE1(v250);
if ( (void *)j == s1[0] )
{
sub_A680(s1, &off_52890);
v251 = s1[1];
}
*((_BYTE *)v251 + j++) = v253;
}
v254 = s1[0];
v255 = s1[1];
sub_A8E0(fd, s1[1], 30);
v278 = fd;
s2 = sub_6EA0;
s1[0] = &off_52978;
s1[1] = &dword_0 + 2;
v267.m256i_i64[0] = (__int64)&v278;
*(_OWORD *)&v267.m256i_u64[1] = 1u;
sub_45440(s1);
if ( 2LL * *(_QWORD *)fd )
free(v283);
s1[0] = &off_52998;
s1[1] = &dword_0 + 1;
v267.m256i_i64[0] = 8;
*(_OWORD *)&v267.m256i_u64[1] = 0;
sub_45440(s1);
if ( v254 )
free(v255);
}

看代码末尾的 LABEL_444（成功分支）：

// 1. 初始化 v250 为 v294 (v294 是输入文件的哈希值)
v250 = v294; 
// ...
for ( j = 0; j != 30; ... )
{
  // 2. 使用 v250 作为种子进行随机数生成 (线性同余生成器 LCG)
  v250 = 0x5DEECE66DLL * v250 + 11;
  // 3. 用生成的随机数去异或解密 Flag
  v253 = byte_47ED2[j] ^ BYTE1(v250);
  // ...
}

可以知道
v294 是解密的钥匙。
v294 是根据我们的输入文件 (flag) 计算出来的（通过 FNV-1a 哈希算法）。
因此需要构造一个输入文件，使得它自然通过 v258 的检查。只有这样，生成的 v294 才是作者预期的那个正确的密钥

目标方程：
程序要求 v258 == 0xCAFEBABE13371337
v258 的计算公式在代码里是：

1	v258 = 0x9E3779B97F4A7C15LL * (__ROL8__(v90, 13) ^ 0xDEADBEEFLL);

我们需要逆推 v90，然后把 v90 的各个字节填回输入文件。

现在我们需要通过脚本做两件事：
（1）数学逆向：算出能通过检查的完美字节，写入 flag 文件。
（2）自动 Patch：读取原始程序，把 /dev/urandom 修改为 flag，并保存为一个新程序。

import os
import subprocess



def ror64(val, rot):
    return ((val >> rot) | (val << (64 - rot))) & 0xFFFFFFFFFFFFFFFF

def mod_inverse(a, m):
    return pow(a, -1, m)

target_v258 = 0xCAFEBABE13371337
multiplier = 0x9E3779B97F4A7C15
xor_const = 0xDEADBEEF

inv_multiplier = mod_inverse(multiplier, 2**64)
temp = (target_v258 * inv_multiplier) & 0xFFFFFFFFFFFFFFFF
temp = temp ^ xor_const
v90 = ror64(temp, 13)


input_bytes_base = [0] * 16
v90_bytes = [(v90 >> (i * 8)) & 0xFF for i in range(8)]


locked_indices = {0, 3, 7, 11, 2, 5, 9}

input_bytes_base[0]  = v90_bytes[7]
input_bytes_base[3]  = v90_bytes[6]
input_bytes_base[7]  = v90_bytes[5]
input_bytes_base[11] = v90_bytes[4]
input_bytes_base[2]  = v90_bytes[3]
input_bytes_base[5]  = v90_bytes[2]
input_bytes_base[9]  = v90_bytes[1]


free_indices = [i for i in range(16) if i not in locked_indices]

print(f"[*] 目标 v90: {hex(v90)}")
print(f"[*] 修正值 (Fix Byte) 将被放置在以下位置之一: {free_indices}\n")

binary_path = "./entropy_solved" 


for pos in free_indices:
    current_attempt = list(input_bytes_base)
    

    current_xor = 0
    for b in current_attempt:
        current_xor ^= b
    fix_byte = current_xor ^ v90_bytes[0]
    

    current_attempt[pos] = fix_byte
    

    with open("flag", "wb") as f:
        f.write(bytes(current_attempt))
    

    try:

        result = subprocess.check_output(binary_path, shell=True).decode(errors='ignore')
        

        flag_line = ""
        for line in result.splitlines():
            if "FLAG:" in line or "PCTF" in line:
                flag_line = line.strip()
        

        print(f"[尝试位置 {pos:2d}] -> {flag_line}")
            
    except Exception as e:
        pass

print("\n[*] 请从上面列表中找到那个可读的 flag (PCTF{...})")

write up