re
是谁不复习计网和数据库写re
Syclang
给出两个文件 一个是ir 一个是编译器
直接看ir即可
拿vscode正则匹配替换
relpace:
(var\d+)\(@exp.([XLRXkey]+)(\[\d\])\)
$1.$2$3
#(\d+)
$1
<\+\d+>
""
(var\d+)\(@exp(.key\[\d+\])\)
$1$2
LABEL
""
GOTO
goto
#!tempa := \{\d+\}\*\{(var\d+)\}\n (.*?)<.*>
$2[$1]
\[0\](\[var\d+\])
$1
:=
=
:
:
IF
if
得到
#include <stdint.h>
#include <stdint.h>
struct exp
{
uint64_t key[24];
uint64_t L[8];
uint64_t R[8];
uint64_t X[8];
};
uint64_t read(char arr[24]) {}
uint64_t writes() {}
uint64_t writef() {}
uint64_t exit(){};
void main()
{
char var11[24];
struct exp var22, var23, var24, var25;
register uint64_t temp0;
register uint64_t temp1;
register uint64_t temp2;
register uint64_t temp3;
register uint64_t temp4;
register uint64_t temp5;
register uint64_t temp6;
register uint64_t temp7;
register uint64_t temp8;
register uint64_t temp9;
register uint64_t temp10;
register uint64_t temp11;
register uint64_t temp12;
register uint64_t temp13;
register uint64_t temp14;
register uint64_t temp15;
register uint64_t temp16;
register uint64_t temp17;
register uint64_t temp18;
register uint64_t temp19;
register uint64_t temp20;
register uint64_t temp21;
register uint64_t temp22;
register uint64_t temp23;
register uint64_t temp24;
register uint64_t temp25;
register uint64_t temp26;
register uint64_t temp27;
register uint64_t temp28;
register uint64_t temp29;
register uint64_t temp30;
register uint64_t temp31;
register uint64_t temp32;
register uint64_t temp33;
register uint64_t temp34;
register uint64_t temp35;
register uint64_t temp36;
register uint64_t temp37;
register uint64_t temp38;
register uint64_t temp39;
register uint64_t temp40;
register uint64_t temp41;
register uint64_t temp42;
register uint64_t temp43;
register uint64_t temp44;
register uint64_t temp45;
register uint64_t temp46;
register uint64_t temp47;
register uint64_t temp48;
register uint64_t temp49;
register uint64_t temp50;
register uint64_t temp51;
register uint64_t temp52;
register uint64_t temp53;
register uint64_t temp54;
register uint64_t temp55;
register uint64_t temp56;
register uint64_t temp57;
register uint64_t temp58;
register uint64_t temp59;
register uint64_t temp60;
register uint64_t temp61;
register uint64_t temp62;
register uint64_t temp63;
register uint64_t temp64;
register uint64_t temp65;
register uint64_t temp66;
register uint64_t temp67;
register uint64_t temp68;
register uint64_t temp69;
register uint64_t temp70;
register uint64_t temp71;
register uint64_t temp72;
register uint64_t temp73;
register uint64_t temp74;
register uint64_t temp75;
register uint64_t temp76;
register uint64_t temp77;
register uint64_t temp78;
register uint64_t temp79;
register uint64_t temp80;
register uint64_t temp81;
register uint64_t temp82;
register uint64_t temp83;
register uint64_t temp84;
register uint64_t temp85;
register uint64_t temp86;
register uint64_t temp87;
register uint64_t temp88;
register uint64_t temp89;
register uint64_t temp90;
register uint64_t temp91;
register uint64_t temp92;
register uint64_t temp93;
register uint64_t temp94;
register uint64_t temp95;
register uint64_t temp96;
register uint64_t temp97;
register uint64_t temp98;
register uint64_t temp99;
register uint64_t temp100;
register uint64_t temp101;
register uint64_t temp102;
register uint64_t temp103;
register uint64_t temp104;
register uint64_t temp105;
register uint64_t temp106;
register uint64_t temp107;
register uint64_t temp108;
register uint64_t temp109;
register uint64_t temp110;
register uint64_t temp111;
register uint64_t temp112;
register uint64_t temp113;
register uint64_t temp114;
register uint64_t temp115;
register uint64_t temp116;
register uint64_t temp117;
register uint64_t temp118;
register uint64_t temp119;
register uint64_t temp120;
register uint64_t temp121;
register uint64_t temp122;
register uint64_t temp123;
register uint64_t temp124;
register uint64_t temp125;
register uint64_t temp126;
register uint64_t temp127;
register uint64_t temp128;
register uint64_t temp129;
register uint64_t temp130;
register uint64_t temp131;
register uint64_t temp132;
register uint64_t temp133;
register uint64_t temp134;
register uint64_t temp135;
register uint64_t temp136;
register uint64_t temp137;
register uint64_t temp138;
register uint64_t temp139;
register uint64_t temp140;
register uint64_t temp141;
register uint64_t temp142;
register uint64_t temp143;
register uint64_t temp144;
register uint64_t temp145;
register uint64_t temp146;
register uint64_t temp147;
register uint64_t temp148;
register uint64_t temp149;
register uint64_t temp150;
register uint64_t temp151;
register uint64_t temp152;
register uint64_t temp153;
register uint64_t temp154;
register uint64_t temp155;
register uint64_t temp156;
register uint64_t temp157;
register uint64_t temp158;
register uint64_t temp159;
register uint64_t temp160;
register uint64_t temp161;
register uint64_t temp162;
register uint64_t temp163;
register uint64_t temp164;
register uint64_t temp165;
register uint64_t temp166;
register uint64_t temp167;
register uint64_t temp168;
register uint64_t temp169;
register uint64_t temp170;
register uint64_t temp171;
register uint64_t temp172;
register uint64_t temp173;
register uint64_t temp174;
register uint64_t temp175;
register uint64_t temp176;
register uint64_t temp177;
register uint64_t temp178;
register uint64_t temp179;
register uint64_t temp180;
register uint64_t temp181;
register uint64_t temp182;
register uint64_t temp183;
register uint64_t temp184;
register uint64_t temp185;
register uint64_t temp186;
register uint64_t temp187;
register uint64_t temp188;
register uint64_t temp189;
register uint64_t temp190;
register uint64_t temp191;
register uint64_t temp192;
register uint64_t temp193;
register uint64_t temp194;
register uint64_t temp195;
register uint64_t temp196;
register uint64_t temp197;
register uint64_t temp198;
register uint64_t temp199;
register uint64_t temp200;
register uint64_t temp201;
register uint64_t temp202;
register uint64_t temp203;
register uint64_t temp204;
register uint64_t temp205;
register uint64_t temp206;
register uint64_t temp207;
register uint64_t temp208;
register uint64_t temp209;
register uint64_t temp210;
register uint64_t temp211;
register uint64_t temp212;
register uint64_t temp213;
register uint64_t temp214;
register uint64_t temp215;
register uint64_t temp216;
register uint64_t temp217;
register uint64_t temp218;
register uint64_t temp219;
register uint64_t temp220;
register uint64_t temp221;
register uint64_t temp222;
register uint64_t temp223;
register uint64_t temp224;
register uint64_t temp225;
register uint64_t temp226;
register uint64_t temp227;
register uint64_t temp228;
register uint64_t temp229;
register uint64_t temp230;
register uint64_t temp231;
register uint64_t temp232;
register uint64_t temp233;
register uint64_t temp234;
register uint64_t temp235;
register uint64_t temp236;
register uint64_t temp237;
register uint64_t temp238;
register uint64_t temp239;
register uint64_t temp240;
register uint64_t temp241;
register uint64_t temp242;
register uint64_t temp243;
register uint64_t temp244;
register uint64_t temp245;
register uint64_t temp246;
register uint64_t temp247;
register uint64_t temp248;
register uint64_t temp249;
register uint64_t temp250;
register uint64_t temp251;
register uint64_t temp252;
register uint64_t temp253;
register uint64_t temp254;
register uint64_t temp255;
register uint64_t temp256;
register uint64_t temp257;
register uint64_t temp258;
register uint64_t temp259;
register uint64_t temp260;
register uint64_t temp261;
register uint64_t temp262;
register uint64_t temp263;
register uint64_t temp264;
register uint64_t temp265;
register uint64_t temp266;
register uint64_t temp267;
register uint64_t temp268;
register uint64_t temp269;
register uint64_t temp270;
register uint64_t temp271;
register uint64_t temp272;
register uint64_t temp273;
register uint64_t temp274;
register uint64_t temp275;
register uint64_t temp276;
register uint64_t temp277;
register uint64_t temp278;
register uint64_t temp279;
register uint64_t temp280;
register uint64_t temp281;
register uint64_t temp282;
register uint64_t temp283;
register uint64_t temp284;
register uint64_t temp285;
register uint64_t temp286;
register uint64_t temp287;
register uint64_t temp288;
register uint64_t temp289;
register uint64_t temp290;
register uint64_t temp291;
register uint64_t temp292;
register uint64_t temp293;
register uint64_t temp294;
register uint64_t temp295;
register uint64_t temp296;
register uint64_t temp297;
register uint64_t temp298;
register uint64_t temp299;
register uint64_t temp300;
register uint64_t temp301;
register uint64_t temp302;
register uint64_t temp303;
register uint64_t temp304;
register uint64_t temp305;
register uint64_t temp306;
register uint64_t temp307;
register uint64_t temp308;
register uint64_t temp309;
register uint64_t temp310;
register uint64_t temp311;
register uint64_t temp312;
register uint64_t temp313;
register uint64_t temp314;
register uint64_t temp315;
register uint64_t temp316;
register uint64_t temp317;
register uint64_t temp318;
register uint64_t temp319;
register uint64_t temp320;
register uint64_t temp321;
register uint64_t temp322;
register uint64_t temp323;
register uint64_t temp324;
register uint64_t temp325;
register uint64_t temp326;
register uint64_t temp327;
register uint64_t temp328;
register uint64_t temp329;
register uint64_t temp330;
register uint64_t temp331;
register uint64_t temp332;
register uint64_t temp333;
register uint64_t temp334;
register uint64_t temp335;
register uint64_t temp336;
register uint64_t temp337;
register uint64_t temp338;
register uint64_t temp339;
register uint64_t temp340;
register uint64_t temp341;
register uint64_t temp342;
register uint64_t temp343;
register uint64_t temp344;
register uint64_t temp345;
register uint64_t temp346;
register uint64_t temp347;
register uint64_t temp348;
register uint64_t temp349;
register uint64_t temp350;
register uint64_t temp351;
register uint64_t temp352;
register uint64_t temp353;
register uint64_t temp354;
register uint64_t temp355;
register uint64_t temp356;
register uint64_t temp357;
register uint64_t temp358;
register uint64_t temp359;
register uint64_t temp360;
register uint64_t temp361;
register uint64_t temp362;
register uint64_t temp363;
register uint64_t temp364;
register uint64_t temp365;
register uint64_t temp366;
register uint64_t temp367;
register uint64_t temp368;
register uint64_t temp369;
register uint64_t temp370;
register uint64_t temp371;
register uint64_t temp372;
register uint64_t temp373;
register uint64_t temp374;
register uint64_t temp375;
register uint64_t temp376;
register uint64_t temp377;
register uint64_t temp378;
register uint64_t temp379;
register uint64_t temp380;
register uint64_t temp381;
register uint64_t temp382;
register uint64_t temp383;
register uint64_t temp384;
register uint64_t temp385;
register uint64_t temp386;
register uint64_t temp387;
register uint64_t temp388;
register uint64_t temp389;
register uint64_t temp390;
register uint64_t temp391;
register uint64_t temp392;
register uint64_t temp393;
register uint64_t temp394;
register uint64_t temp395;
register uint64_t temp396;
register uint64_t temp397;
register uint64_t temp398;
register uint64_t temp399;
register uint64_t var0;
register uint64_t var1;
register uint64_t var2;
register uint64_t var3;
register uint64_t var4;
register uint64_t var5;
register uint64_t var6;
register uint64_t var7;
register uint64_t var8;
register uint64_t var9;
register uint64_t var10;
register uint64_t var12;
register uint64_t var13;
register uint64_t var14;
register uint64_t var15;
register uint64_t var16;
register uint64_t var17;
register uint64_t var18;
register uint64_t var19;
register uint64_t var20;
register uint64_t var21;
register uint64_t var26;
register uint64_t var27;
register uint64_t var28;
register uint64_t var29;
temp1 = read(var11);
temp2 = 0;
var15 = temp2;
label4:
temp4 = 24;
if (var15 < temp4)
goto label3;
goto label2;
label3:
temp5 = 0;
var12 = temp5;
var16 = var15;
var12 = var11[var16];
temp6 = 23;
temp7 = temp6 - var15;
var18 = temp7;
var22.key[var18] = var12;
temp3 = 1;
var15 = var15 + temp3;
goto label4;
label2:
temp8 = 23;
var15 = temp8;
label11:
temp10 = 0;
if (var15 > temp10)
goto label10;
goto label9;
label10:
var18 = var15;
var19 = var22.key[var18];
temp11 = 1;
temp12 = var15 - temp11;
var16 = temp12;
var17 = var22.key[var16];
temp13 = var19 - var17;
var21 = temp13;
var22.key[var15] = var21;
temp9 = 1;
var15 = var15 - temp9;
goto label11;
label9:
temp15 = 0;
var22.L[0] = temp15;
temp17 = 8;
var22.R[0] = temp17;
temp19 = 11;
var22.X[0] = temp19;
temp21 = 15;
var22.L[1] = temp21;
temp23 = 23;
var22.R[1] = temp23;
temp25 = 0;
temp26 = 13;
temp27 = temp25 - temp26;
var22.X[1] = temp27;
temp29 = 2;
var22.L[2] = temp29;
temp31 = 11;
var22.R[2] = temp31;
temp33 = 17;
var22.X[2] = temp33;
temp35 = 10;
var22.L[3] = temp35;
temp37 = 20;
var22.R[3] = temp37;
temp39 = 0;
temp40 = 19;
temp41 = temp39 - temp40;
var22.X[3] = temp41;
temp43 = 6;
var22.L[4] = temp43;
temp45 = 13;
var22.R[4] = temp45;
temp47 = 23;
var22.X[4] = temp47;
temp49 = 9;
var22.L[5] = temp49;
temp51 = 21;
var22.R[5] = temp51;
temp53 = 0;
temp54 = 29;
temp55 = temp53 - temp54;
var22.X[5] = temp55;
temp57 = 1;
var22.L[6] = temp57;
temp59 = 19;
var22.R[6] = temp59;
temp61 = 31;
var22.X[6] = temp61;
temp63 = 4;
var22.L[7] = temp63;
temp65 = 17;
var22.R[7] = temp65;
temp67 = 0;
temp68 = 37;
temp69 = temp67 - temp68;
var22.X[7] = temp69;
temp70 = 0;
var15 = temp70;
label43:
temp72 = 8;
if (var15 < temp72)
goto label42;
goto label41;
label42:
var16 = var22.L[var15];
var18 = var22.R[var15];
var20 = var22.X[var15];
var17 = var22.key[var16];
var19 = var22.key[var18];
var17 = var17 + var20;
var19 = var19 - var20;
var22.key[var16] = var17;
var22.key[var18] = var19;
temp71 = 1;
var15 = var15 + temp71;
goto label43;
label41:
temp75 = 1;
var15 = temp75;
label54:
temp77 = 24;
if (var15 < temp77)
goto label53;
goto label52;
label53:
var17 = var22.key[var15];
temp78 = 1;
temp79 = var15 - temp78;
var16 = temp79;
var20 = var22.key[var16];
var17 = var17 + var20;
var22.key[var15] = var17;
temp76 = 1;
var15 = var15 + temp76;
goto label54;
label52:
temp81 = 0;
var15 = temp81;
label61:
temp83 = 23;
if (var15 < temp83)
goto label60;
goto label59;
label60:
var16 = var15;
var12 = var22.key[var16];
temp84 = 1;
temp85 = var15 + temp84;
var18 = temp85;
var13 = var22.key[var18];
temp86 = 0;
var13 = temp86;
temp87 = var12 ^ var13;
var14 = temp87;
var22.key[var16] = var14;
temp82 = 1;
var15 = var15 + temp82;
goto label61;
label59:
temp89 = 0;
var24.L[0] = temp89;
temp91 = 12;
var24.R[0] = temp91;
temp93 = 0;
temp94 = 19;
temp95 = temp93 - temp94;
var24.X[0] = temp95;
temp97 = 9;
var24.L[1] = temp97;
temp99 = 10;
var24.R[1] = temp99;
temp101 = 0;
temp102 = 10;
temp103 = temp101 - temp102;
var24.X[1] = temp103;
temp105 = 9;
var24.L[2] = temp105;
temp107 = 12;
var24.R[2] = temp107;
temp109 = 3;
var24.X[2] = temp109;
temp111 = 8;
var24.L[3] = temp111;
temp113 = 19;
var24.R[3] = temp113;
temp115 = 0;
temp116 = 11;
temp117 = temp115 - temp116;
var24.X[3] = temp117;
temp119 = 10;
var24.L[4] = temp119;
temp121 = 12;
var24.R[4] = temp121;
temp123 = 0;
temp124 = 9;
temp125 = temp123 - temp124;
var24.X[4] = temp125;
temp127 = 9;
var24.L[5] = temp127;
temp129 = 13;
var24.R[5] = temp129;
temp131 = 3;
var24.X[5] = temp131;
temp133 = 1;
var24.L[6] = temp133;
temp135 = 22;
var24.R[6] = temp135;
temp137 = 0;
temp138 = 19;
temp139 = temp137 - temp138;
var24.X[6] = temp139;
temp141 = 0;
var24.L[7] = temp141;
temp143 = 23;
var24.R[7] = temp143;
temp145 = 7;
var24.X[7] = temp145;
temp147 = 12;
var24.key[0] = temp147;
temp149 = 31;
var24.key[1] = temp149;
temp151 = 31;
var24.key[2] = temp151;
temp153 = 31;
var24.key[3] = temp153;
temp155 = 31;
var24.key[4] = temp155;
temp157 = 31;
var24.key[5] = temp157;
temp159 = 31;
var24.key[6] = temp159;
temp161 = 31;
var24.key[7] = temp161;
temp163 = 42;
var24.key[8] = temp163;
temp165 = 46;
var24.key[9] = temp165;
temp167 = 45;
var24.key[10] = temp167;
temp169 = 45;
var24.key[11] = temp169;
temp171 = 20;
var24.key[12] = temp171;
temp173 = 23;
var24.key[13] = temp173;
temp175 = 23;
var24.key[14] = temp175;
temp177 = 23;
var24.key[15] = temp177;
temp179 = 23;
var24.key[16] = temp179;
temp181 = 23;
var24.key[17] = temp181;
temp183 = 23;
var24.key[18] = temp183;
temp185 = 12;
var24.key[19] = temp185;
temp187 = 12;
var24.key[20] = temp187;
temp189 = 12;
var24.key[21] = temp189;
temp191 = 0;
temp192 = 7;
temp193 = temp191 - temp192;
var24.key[22] = temp193;
temp195 = 0;
var24.key[23] = temp195;
temp196 = 23;
var15 = temp196;
label118:
temp198 = 0;
if (var15 > temp198)
goto label117;
goto label116;
label117:
var18 = var15;
var19 = var24.key[var18];
temp199 = 1;
temp200 = var15 - temp199;
var16 = temp200;
var17 = var24.key[var16];
temp201 = var19 - var17;
var21 = temp201;
var24.key[var15] = var21;
temp197 = 1;
var15 = var15 - temp197;
goto label118;
label116:
temp202 = 0;
var15 = temp202;
label126:
temp204 = 8;
if (var15 < temp204)
goto label125;
goto label124;
label125:
var16 = var24.L[var15];
var18 = var24.R[var15];
var20 = var24.X[var15];
var17 = var24.key[var16];
var19 = var24.key[var18];
var17 = var17 + var20;
var19 = var19 - var20;
var24.key[var16] = var17;
var24.key[var18] = var19;
temp203 = 1;
var15 = var15 + temp203;
goto label126;
label124:
temp207 = 1;
var15 = temp207;
label137:
temp209 = 24;
if (var15 < temp209)
goto label136;
goto label135;
label136:
var17 = var24.key[var15];
temp210 = 1;
temp211 = var15 - temp210;
var16 = temp211;
var20 = var24.key[var16];
var17 = var17 + var20;
var24.key[var15] = var17;
temp208 = 1;
var15 = var15 + temp208;
goto label137;
label135:
temp214 = 252;
var23.key[0] = temp214;
temp216 = 352;
var23.key[1] = temp216;
temp218 = 484;
var23.key[2] = temp218;
temp220 = 470;
var23.key[3] = temp220;
temp222 = 496;
var23.key[4] = temp222;
temp224 = 487;
var23.key[5] = temp224;
temp226 = 539;
var23.key[6] = temp226;
temp228 = 585;
var23.key[7] = temp228;
temp230 = 447;
var23.key[8] = temp230;
temp232 = 474;
var23.key[9] = temp232;
temp234 = 577;
var23.key[10] = temp234;
temp236 = 454;
var23.key[11] = temp236;
temp238 = 466;
var23.key[12] = temp238;
temp240 = 345;
var23.key[13] = temp240;
temp242 = 344;
var23.key[14] = temp242;
temp244 = 486;
var23.key[15] = temp244;
temp246 = 501;
var23.key[16] = temp246;
temp248 = 423;
var23.key[17] = temp248;
temp250 = 490;
var23.key[18] = temp250;
temp252 = 375;
var23.key[19] = temp252;
temp254 = 257;
var23.key[20] = temp254;
temp256 = 203;
var23.key[21] = temp256;
temp258 = 265;
var23.key[22] = temp258;
temp260 = 125;
var23.key[23] = temp260;
temp261 = 0;
var15 = temp261;
label168:
temp263 = 24;
if (var15 < temp263)
goto label167;
goto label166;
label167:
var16 = var15;
var17 = var23.key[var16];
var18 = var15;
var19 = var24.key[var18];
temp264 = var17 ^ var19;
var21 = temp264;
var23.key[var15] = var21;
temp262 = 1;
var15 = var15 + temp262;
goto label168;
label166:
temp265 = 0;
var15 = temp265;
label176:
temp267 = 8;
if (var15 < temp267)
goto label175;
goto label174;
label175:
temp268 = var15 + var15;
temp269 = temp268 + var15;
var16 = temp269;
var17 = var22.key[var16];
var23.X[var15] = var17;
temp266 = 1;
var15 = var15 + temp266;
goto label176;
label174:
temp270 = 23;
var15 = temp270;
label181:
temp272 = 0;
if (var15 > temp272)
goto label180;
goto label179;
label180:
var18 = var15;
var19 = var23.key[var18];
var16 = var15;
temp273 = 1;
var16 = var16 - temp273;
var17 = var23.key[var16];
temp275 = var19 - var17;
var21 = temp275;
var23.key[var15] = var21;
temp271 = 1;
var15 = var15 - temp271;
goto label181;
label179:
temp276 = 0;
var15 = temp276;
label190:
temp278 = 8;
if (var15 < temp278)
goto label189;
goto label188;
label189:
var16 = var22.L[var15];
var18 = var22.R[var15];
var20 = var23.X[var15];
var17 = var23.key[var16];
var19 = var23.key[var18];
var17 = var17 - var20;
var19 = var19 + var20;
var23.key[var16] = var17;
var23.key[var18] = var19;
temp277 = 1;
var15 = var15 + temp277;
goto label190;
label188:
temp281 = 1;
var15 = temp281;
label201:
temp283 = 24;
if (var15 < temp283)
goto label200;
goto label199;
label200:
var17 = var23.key[var15];
temp284 = 1;
temp285 = var15 - temp284;
var16 = temp285;
var20 = var23.key[var16];
var17 = var17 + var20;
var23.key[var15] = var17;
temp282 = 1;
var15 = var15 + temp282;
goto label201;
label199:
temp287 = 0;
var15 = temp287;
label208:
temp289 = 7;
if (var15 < temp289)
goto label207;
goto label206;
label207:
var16 = var15;
var17 = var22.L[var16];
temp290 = 1;
temp291 = var15 + temp290;
var18 = temp291;
var19 = var22.L[var18];
temp292 = var17 ^ var19;
var21 = temp292;
temp293 = 23;
if (var21 > temp293)
goto label215;
goto label214;
label215:
temp294 = 23;
var21 = temp294;
label214:
var25.L[var15] = var21;
temp288 = 1;
var15 = var15 + temp288;
goto label208;
label206:
temp296 = 0;
var25.L[7] = temp296;
temp297 = 0;
var15 = temp297;
label219:
temp299 = 7;
if (var15 < temp299)
goto label218;
goto label217;
label218:
var16 = var15;
var17 = var22.R[var16];
temp300 = 1;
temp301 = var15 + temp300;
var18 = temp301;
var19 = var22.R[var18];
temp302 = var17 ^ var19;
var21 = temp302;
temp303 = 23;
if (var21 > temp303)
goto label226;
goto label225;
label226:
temp304 = 23;
var21 = temp304;
label225:
var25.R[var15] = var21;
temp298 = 1;
var15 = var15 + temp298;
goto label219;
label217:
temp306 = 23;
var25.R[7] = temp306;
temp307 = 0;
var15 = temp307;
label230:
temp309 = 7;
if (var15 < temp309)
goto label229;
goto label228;
label229:
var16 = var15;
var17 = var22.X[var16];
temp310 = 1;
temp311 = var15 + temp310;
var18 = temp311;
var19 = var22.X[var18];
temp312 = var17 ^ var19;
var21 = temp312;
var25.X[var15] = var21;
temp308 = 1;
var15 = var15 + temp308;
goto label230;
label228:
temp314 = 12;
var25.X[7] = temp314;
temp316 = 127;
var25.key[0] = temp316;
temp318 = 111;
var25.key[1] = temp318;
temp320 = 188;
var25.key[2] = temp320;
temp322 = 174;
var25.key[3] = temp322;
temp324 = 195;
var25.key[4] = temp324;
temp326 = 128;
var25.key[5] = temp326;
temp328 = 88;
var25.key[6] = temp328;
temp330 = 121;
var25.key[7] = temp330;
temp332 = 123;
var25.key[8] = temp332;
temp334 = 103;
var25.key[9] = temp334;
temp336 = 57;
var25.key[10] = temp336;
temp338 = 123;
var25.key[11] = temp338;
temp340 = 97;
var25.key[12] = temp340;
temp342 = 74;
var25.key[13] = temp342;
temp344 = 37;
var25.key[14] = temp344;
temp346 = 59;
var25.key[15] = temp346;
temp348 = 21;
var25.key[16] = temp348;
temp350 = 47;
var25.key[17] = temp350;
temp352 = 54;
var25.key[18] = temp352;
temp354 = 28;
var25.key[19] = temp354;
temp356 = 49;
var25.key[20] = temp356;
temp358 = 55;
var25.key[21] = temp358;
var25.key[22] = var1;
temp361 = 125;
var25.key[23] = temp361;
temp362 = 23;
var15 = temp362;
label263:
temp364 = 0;
if (var15 > temp364)
goto label262;
goto label261;
label262:
var18 = var15;
var19 = var25.key[var18];
var16 = var15;
temp365 = 1;
var16 = var16 - temp365;
var17 = var25.key[var16];
temp367 = var19 - var17;
var21 = temp367;
var25.key[var15] = var21;
temp363 = 1;
var15 = var15 - temp363;
goto label263;
label261:
temp368 = 0;
var15 = temp368;
label272:
temp370 = 8;
if (var15 < temp370)
goto label271;
goto label270;
label271:
var16 = var25.L[var15];
var18 = var25.R[var15];
var20 = var25.X[var15];
var17 = var25.key[var16];
var19 = var25.key[var18];
var17 = var17 - var20;
var19 = var19 + var20;
var25.key[var16] = var17;
var25.key[var18] = var19;
temp369 = 1;
var15 = var15 + temp369;
goto label272;
label270:
temp373 = 1;
var15 = temp373;
label283:
temp375 = 24;
if (var15 < temp375)
goto label282;
goto label281;
label282:
var17 = var25.key[var15];
temp376 = 1;
temp377 = var15 - temp376;
var16 = temp377;
var20 = var25.key[var16];
var17 = var17 + var20;
var25.key[var15] = var17;
temp374 = 1;
var15 = var15 + temp374;
goto label283;
label281:
temp379 = 0;
var12 = temp379;
temp380 = 0;
var13 = temp380;
temp381 = 0;
var15 = temp381;
label292:
temp382 = 24;
if (var15 < temp382)
goto label291;
goto label290;
label291:
var16 = var15;
var12 = var22.key[var15];
var18 = var15;
var13 = var23.key[var18];
if (var13 != var12)
goto label298;
goto label297;
label298:
temp383 = writef();
temp384 = exit();
label297:
temp385 = 1;
temp386 = var15 + temp385;
var15 = temp386;
goto label292;
label290:
temp387 = writes();
temp388 = exit();
}
直接编译即可 别开O3优化 会优化没（）
然后ida识别 建结构体
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
unsigned __int64 v3; // [rsp+28h] [rbp-1348h]
unsigned __int64 v4; // [rsp+28h] [rbp-1348h]
__int64 v5; // [rsp+30h] [rbp-1340h]
__int64 v6; // [rsp+30h] [rbp-1340h]
__int64 v7; // [rsp+30h] [rbp-1340h]
__int64 v8; // [rsp+30h] [rbp-1340h]
__int64 v9; // [rsp+38h] [rbp-1338h]
__int64 v10; // [rsp+38h] [rbp-1338h]
__int64 v11; // [rsp+38h] [rbp-1338h]
__int64 v12; // [rsp+38h] [rbp-1338h]
__int64 v13; // [rsp+40h] [rbp-1330h]
__int64 v14; // [rsp+40h] [rbp-1330h]
__int64 v15; // [rsp+40h] [rbp-1330h]
__int64 v16; // [rsp+40h] [rbp-1330h]
unsigned __int64 i; // [rsp+58h] [rbp-1318h]
__int64 j; // [rsp+58h] [rbp-1318h]
unsigned __int64 k; // [rsp+58h] [rbp-1318h]
unsigned __int64 m; // [rsp+58h] [rbp-1318h]
unsigned __int64 n; // [rsp+58h] [rbp-1318h]
__int64 ii; // [rsp+58h] [rbp-1318h]
unsigned __int64 jj; // [rsp+58h] [rbp-1318h]
unsigned __int64 kk; // [rsp+58h] [rbp-1318h]
unsigned __int64 mm; // [rsp+58h] [rbp-1318h]
unsigned __int64 nn; // [rsp+58h] [rbp-1318h]
__int64 i1; // [rsp+58h] [rbp-1318h]
unsigned __int64 i2; // [rsp+58h] [rbp-1318h]
unsigned __int64 i3; // [rsp+58h] [rbp-1318h]
unsigned __int64 i4; // [rsp+58h] [rbp-1318h]
unsigned __int64 i5; // [rsp+58h] [rbp-1318h]
unsigned __int64 i6; // [rsp+58h] [rbp-1318h]
__int64 i7; // [rsp+58h] [rbp-1318h]
unsigned __int64 i8; // [rsp+58h] [rbp-1318h]
unsigned __int64 i9; // [rsp+58h] [rbp-1318h]
unsigned __int64 i10; // [rsp+58h] [rbp-1318h]
char v37; // [rsp+C0h] [rbp-12B0h]
exp var25; // [rsp+D50h] [rbp-620h]
exp var24; // [rsp+ED0h] [rbp-4A0h]
exp var23; // [rsp+1050h] [rbp-320h]
exp var22; // [rsp+11D0h] [rbp-1A0h]
char flag[32]; // [rsp+1350h] [rbp-20h] BYREF
read(flag, argv, envp);
for ( i = 0LL; i < 0x18; ++i )
var22.key[23 - i] = flag[i];
for ( j = 23LL; j; --j )
var22.key[j] -= var22.key[j - 1];
var22.L[0] = 0LL;
var22.R[0] = 8LL;
var22.X[0] = 11LL;
var22.L[1] = 15LL;
var22.R[1] = 23LL;
var22.X[1] = -13LL;
var22.L[2] = 2LL;
var22.R[2] = 11LL;
var22.X[2] = 17LL;
var22.L[3] = 10LL;
var22.R[3] = 20LL;
var22.X[3] = -19LL;
var22.L[4] = 6LL;
var22.R[4] = 13LL;
var22.X[4] = 23LL;
var22.L[5] = 9LL;
var22.R[5] = 21LL;
var22.X[5] = -29LL;
var22.L[6] = 1LL;
var22.R[6] = 19LL;
var22.X[6] = 31LL;
var22.L[7] = 4LL;
var22.R[7] = 17LL;
var22.X[7] = -37LL;
for ( k = 0LL; k < 8; ++k )
{
v13 = var22.R[k];
v5 = var22.X[k];
v9 = var22.key[v13] - v5;
var22.key[var22.L[k]] += v5;
var22.key[v13] = v9;
}
for ( m = 1LL; m < 0x18; ++m )
var22.key[m] += var22.key[m - 1];
for ( n = 0LL; n < 0x17; ++n )
var22.key[n] = var22.key[n];
var24.L[0] = 0LL;
var24.R[0] = 12LL;
var24.X[0] = -19LL;
var24.L[1] = 9LL;
var24.R[1] = 10LL;
var24.X[1] = -10LL;
var24.L[2] = 9LL;
var24.R[2] = 12LL;
var24.X[2] = 3LL;
var24.L[3] = 8LL;
var24.R[3] = 19LL;
var24.X[3] = -11LL;
var24.L[4] = 10LL;
var24.R[4] = 12LL;
var24.X[4] = -9LL;
var24.L[5] = 9LL;
var24.R[5] = 13LL;
var24.X[5] = 3LL;
var24.L[6] = 1LL;
var24.R[6] = 22LL;
var24.X[6] = -19LL;
var24.L[7] = 0LL;
var24.R[7] = 23LL;
var24.X[7] = 7LL;
var24.key[0] = 12LL;
var24.key[1] = 31LL;
var24.key[2] = 31LL;
var24.key[3] = 31LL;
var24.key[4] = 31LL;
var24.key[5] = 31LL;
var24.key[6] = 31LL;
var24.key[7] = 31LL;
var24.key[8] = 42LL;
var24.key[9] = 46LL;
var24.key[10] = 45LL;
var24.key[11] = 45LL;
var24.key[12] = 20LL;
var24.key[13] = 23LL;
var24.key[14] = 23LL;
var24.key[15] = 23LL;
var24.key[16] = 23LL;
var24.key[17] = 23LL;
var24.key[18] = 23LL;
var24.key[19] = 12LL;
var24.key[20] = 12LL;
var24.key[21] = 12LL;
var24.key[22] = -7LL;
var24.key[23] = 0LL;
for ( ii = 23LL; ii; --ii )
var24.key[ii] -= var24.key[ii - 1];
for ( jj = 0LL; jj < 8; ++jj )
{
v14 = var24.R[jj];
v6 = var24.X[jj];
v10 = var24.key[v14] - v6;
var24.key[var24.L[jj]] += v6;
var24.key[v14] = v10;
}
for ( kk = 1LL; kk < 0x18; ++kk )
var24.key[kk] += var24.key[kk - 1];
var23.key[0] = 252LL;
var23.key[1] = 352LL;
var23.key[2] = 484LL;
var23.key[3] = 470LL;
var23.key[4] = 496LL;
var23.key[5] = 487LL;
var23.key[6] = 539LL;
var23.key[7] = 585LL;
var23.key[8] = 447LL;
var23.key[9] = 474LL;
var23.key[10] = 577LL;
var23.key[11] = 454LL;
var23.key[12] = 466LL;
var23.key[13] = 345LL;
var23.key[14] = 344LL;
var23.key[15] = 486LL;
var23.key[16] = 501LL;
var23.key[17] = 423LL;
var23.key[18] = 490LL;
var23.key[19] = 375LL;
var23.key[20] = 257LL;
var23.key[21] = 203LL;
var23.key[22] = 265LL;
var23.key[23] = 125LL;
for ( mm = 0LL; mm < 0x18; ++mm )
var23.key[mm] ^= var24.key[mm];
for ( nn = 0LL; nn < 8; ++nn )
var23.X[nn] = var22.key[3 * nn];
for ( i1 = 23LL; i1; --i1 )
var23.key[i1] -= var23.key[i1 - 1];
for ( i2 = 0LL; i2 < 8; ++i2 )
{
v15 = var22.R[i2];
v7 = var23.X[i2];
v11 = v7 + var23.key[v15];
var23.key[var22.L[i2]] -= v7;
var23.key[v15] = v11;
}
for ( i3 = 1LL; i3 < 0x18; ++i3 )
var23.key[i3] += var23.key[i3 - 1];
for ( i4 = 0LL; i4 < 7; ++i4 )
{
v3 = var22.R[i4 - 7] ^ var22.L[i4];
if ( v3 > 0x17 )
v3 = 23LL;
var25.L[i4] = v3;
}
var25.L[7] = 0LL;
for ( i5 = 0LL; i5 < 7; ++i5 )
{
v4 = var22.X[i5 - 7] ^ var22.R[i5];
if ( v4 > 0x17 )
v4 = 23LL;
var25.R[i5] = v4;
}
var25.R[7] = 23LL;
for ( i6 = 0LL; i6 < 7; ++i6 )
var25.X[i6] = var22.X[i6 + 1] ^ var22.X[i6];
var25.X[7] = 12LL;
var25.key[0] = 127LL;
var25.key[1] = 111LL;
var25.key[2] = 188LL;
var25.key[3] = 174LL;
var25.key[4] = 195LL;
var25.key[5] = 128LL;
var25.key[6] = 88LL;
var25.key[7] = 121LL;
var25.key[8] = 123LL;
var25.key[9] = 103LL;
var25.key[10] = 57LL;
var25.key[11] = 123LL;
var25.key[12] = 97LL;
var25.key[13] = 74LL;
var25.key[14] = 37LL;
var25.key[15] = 59LL;
var25.key[16] = 21LL;
var25.key[17] = 47LL;
var25.key[18] = 54LL;
var25.key[19] = 28LL;
var25.key[20] = 49LL;
var25.key[21] = 0x37LL;
var25.key[22] = *(_QWORD *)&v37;
var25.key[23] = 0x7DLL;
for ( i7 = 23LL; i7; --i7 )
var25.key[i7] -= var25.key[i7 - 1];
for ( i8 = 0LL; i8 < 8; ++i8 )
{
v16 = var25.R[i8];
v8 = var25.X[i8];
v12 = v8 + var25.key[v16];
var25.key[var25.L[i8]] -= v8;
var25.key[v16] = v12;
}
for ( i9 = 1LL; i9 < 0x18; ++i9 )
var25.key[i9] += var25.key[i9 - 1];
for ( i10 = 0LL; i10 < 0x18; ++i10 )
{
if ( var23.key[i10] != var22.key[i10] )
{
writef();
exit();
}
}
writes();
exit();
}
然后z3解即可
偷一份
from z3 import *
class exp:
def __init__(self):
self.key = [0] * 24
self.L = [0] * 8
self.R = [0] * 8
self.X = [0] * 8
var22 = exp()
flag = [BitVec(f"flag[{i}]", 8) for i in range(24)]
for i in range(0x18):
var22.key[i] = flag[i]
for i in range(23, 0, -1):
var22.key[i] -= var22.key[i - 1]
var22.L = [0, 15, 2, 10, 6, 9, 1, 4]
var22.R = [8, 23, 11, 20, 13, 21, 19, 17]
var22.X = [11, -13, 17, -19, 23, -29, 31, -37]
for k in range(8):
var22.key[var22.L[k]] += var22.X[k]
var22.key[var22.R[k]] -= var22.X[k]
for m in range(1, 0x18):
var22.key[m] += var22.key[m - 1]
var24 = exp()
var24.key = [12, 31, 31, 31, 31, 31, 31, 31, 42, 46, 45, 45, 20, 23, 23, 23, 23, 23, 23, 12, 12, 12, -7, 0]
var24.L = [0, 9, 9, 8, 10, 9, 1, 0]
var24.R = [12, 10, 12, 19, 12, 13, 22, 23]
var24.X = [-19, -10, 3, -11, -9, 3, -19, 7]
for i in range(23, 0, -1):
var24.key[i] -= var24.key[i - 1]
for k in range(8):
var24.key[var24.L[k]] += var24.X[k]
var24.key[var24.R[k]] -= var24.X[k]
for m in range(1, 0x18):
var24.key[m] += var24.key[m - 1]
var23 = exp()
var23.key = [252, 352, 484, 470, 496, 487, 539, 585, 447, 474, 577, 454, 466, 345, 344, 486, 501, 423, 490, 375, 257,
203, 265, 125]
for mm in range(0x18):
var23.key[mm] ^= var24.key[mm]
for nn in range(0x8):
var23.X[nn] = var22.key[3 * nn]
for i1 in range(23, 0, -1):
var23.key[i1] -= var23.key[i1 - 1]
for k in range(8):
var23.key[var22.L[k]] -= var23.X[k]
var23.key[var22.R[k]] += var23.X[k]
for i in range(1, 0x18):
var23.key[i] += var23.key[i - 1]
s = Solver()
for i in range(0x18):
s.add(var23.key[i] == var22.key[i])
s.add(flag[i] > 0)
s.add(flag[i] < 0x7f)
print(s.check())
r = s.model()
print(r)
for i in range(0x18):
print(chr(r[flag[i]].as_long()), end="")
sctf{r5cbsumyqpjy0stc7u}
Digital_circuit_learning
stm32固件逆向
参照[原创]固件安全之加载地址分析-智能设备-看雪-安全社区|安全招聘|kanxue.com
[原创]一个简单的STM32固件分析-智能设备-看雪-安全社区|安全招聘|kanxue.com
这里使用binaryninja
设置基址0x8000000
memory map设置
通过字符串找到main
逻辑就是接受输入 检测flag头 然后strcpy复制走去掉flag{}的那部分
然后hex2int得到10位int
然后
赋值到input中
给一堆东西赋予初值
然后encode
前面都是没啥用的函数
最后走一个调用
call的定义如下
func记录要调用的函数
value记录那一位flag
但是ptr是空的，查找在哪赋值
交叉引用未果
从start函数开始跟
start即为0x4的值
bd8没啥玩的
570中将地址当函数用了 uint32_t
直接跳转过去
调用了0x3和0x7处的函数，参数就是函数前面的三个值
分析易知是赋值
直接看参数即可
将0x8001f68开始0x50个赋值到2000000处
即
而ptr在
hex(0x1f68+0x24)
'0x1f8c'
所以ptr的值即为check1到j
除了check1以外形式都一致，为path的当前位赋值为一个字符，然后对arg1的每一位变换
看看这些函数在哪调用 交叉应用call数组找到check函数
根据cond和value的关系来决定调用顺序
而cond的初值是
再查看check1函数
要求path相同
至此逻辑就清晰了
cond的初值确定，经过十次变换，变换函数确定
所以十次cond的值是一定的
而程序会根据value和cond的对应关系来决定函数的调用顺序，调用顺序已经确定，所以value即输入也是确定的
上脚本
import ctypes
def ts(arg1):
return ((1 & (~((arg1 >> 6) & (arg1 >> 2)))) | (arg1 << 1)) & 0xff
cond = [0] * 10
cond[0] = 0x77
for i in range(1, 10):
cond[i] = ts(cond[i - 1])
print(cond)
t1 = "abcdefghij"
t2 = "bdgfciejha"
flag = [0] * 10
for i in range(10):
flag[t1.index(t2[i])] = cond[i]
print(flag)
for i in range(10):
flag[i] = flag[i] - 1 & 0xff
for i in range(10):
flag[i] ^= 0x35
for i in range(10):
flag[i] = (flag[i] >> 4) | (flag[i] << 4) & 0xff
for i in range(10):
flag[i] ^= flag[(i + 1) % 10]
for i in range(10):
flag[i] = flag[i] + 1 & 0xff
for i in range(10):
flag[i] = (flag[i] >> 3) | (flag[i] << 5) & 0xff
for i in range(10):
flag[i] ^= flag[9 - i]
for i in range(10):
flag[i] ^= 0xf7
for i in range(10):
flag[i] = (flag[i] >> 2) | (flag[i] << 6) & 0xff
print(f'SCTF{{{bytes(flag).hex()}}}')