利用 networkx 解决CTF_RE 图最短路径问题
前言
最近复现了了下今年L3HCTF的IDAAAAA题，然后通过此题又联想到了之前做的一道特殊的迷宫题invisible_maze-fix,发现通过python的networkx解决此类问题相当的方便，因此记录下解题过程，方便以后查询。
2道题目附件👇
链接：https://pan.baidu.com/s/1reVYGScanSCs5H4ykl60vw
提取码：kvhl
invisible_maze
常规的迷宫题目
在CTF逆向题目中，常规的迷宫题目一般是程序给你一个非常长的字符串，然后自己整理可以得到整个迷宫的全貌，比如下图这种
这种能很容易的得到整个迷宫的路径，可是这个invisible_maze这个题才可以说是是真正的迷宫题，因为它没有从上帝视角给你路径的全貌，而是把你放到了个迷宫中，每走一步，它告诉你，上下左右分别去哪
本题题解
分析
IDA打开程序分析
进入sub_401050函数， 程序告诉你上下左右走的话是什么东西，很明显，只有进入另一个函数路才是通的
直接查找字符串，交叉引用来到成功的地方
可以发现只有进入到sub_41F1E0,然后再按s才会成功，而整个迷宫的路径是非常复杂的
观察函数窗口，发现从sub_401050 到 sub_41F270 全是这样的结构，我们手动的去画出整个迷宫显然是不现实的，每个函数其实就是一个节点，然后两个节点就构成了一条边，比如：sub_401050就是一个节点，而sub_401050 ---> sub_4010E0就是一条边。
每个函数的结构基本差不多，考虑打算用IDAPython打印出每个节点，以及它对应的adsw对应的四个值，如果是进入另外一个函数的话，那么本函数和进入的那个函数就构造成了一条边，最后将节点和边传入python的networkx库就能构造出整个迷宫图，直接调用函数就能求最短路径了。
发现函数只有下面2种情况
当经过case表跳转后，如果第一条汇编指令是push xxx，那么肯定是不通的（除了成功的那个位置），如果是call sub_xxx的话，那么本条汇编指令就可以找到下一个函数（节点），如果是pop esi的话，下一条jmp xxx就是进入的下一个函数（节点）
编写IDAPython脚本
写IDAPython脚本
def get_edges_from_func(func_addr):
func_end_addr = idc.find_func_end(func_addr) # 找到此函数末尾地址
addr = func_addr
while addr < func_end_addr:
addr = idc.next_head(addr) # 得到下一条汇编指令的地址
if idc.print_insn_mnem(addr) == 'movzx': # 得到本条汇编指令的操作指令
index_table_addr = get_operand_value(addr ,1) # 得到adsw对应的索引表，对应上2图的0x4010C0 和 0x41E384
addr = idc.next_head(addr) # 来到Jmp ds:xxxx[eax * 4]的位置
switch_table_addr = get_operand_value(addr ,0) # 得到case表的地址
break
value = get_bytes(index_table_addr, 23)
index_adws = [value[0], value[3], value[18], value[22]] # 获取adsw对应的4个数
# print(index_adws)
edges = []
for i in index_adws: # 遍历
tmp = get_wide_dword(switch_table_addr + i * 4)
if idc.print_insn_mnem(tmp) == 'push':
edges.append(None)
elif idc.print_insn_mnem(tmp) == 'call':
edges.append(get_operand_value(tmp ,0)) # 得到call的那个函数的地址
elif idc.print_insn_mnem(tmp) == 'pop':
tmp = idc.next_head(tmp) # 来到jmp sub_xxx的地址
edges.append(get_operand_value(tmp ,0))
# print(edges)
return edges
func_list = list(Functions(0x401050, 0x41F271)) # 列出此范围所有的函数
all_edges = []
for i in func_list:
edges = get_edges_from_func(i)
all_edges.append(edges)
print(all_edges)
print("len(func_list): %d" % len(func_list))
print("len(all_edges): %d" % len(all_edges))
print(func_list)
输入结果
[[None, 4198624, None, None], [4198480, None, 4198784, None], [None, None, 4207712, 4198624], [None, 4199104, 4211312, None], [4198944, 4199264, None, None], [4199104, 4199424, None, None], [4199264, 4199584, None, None], [4199424, 4199744, None, None], [4199584, 4199904, 4211472, None], [4199744, 4200064, None, None], [4199904, 4200224, None, None], [4200064, 4200384, None, None], [4200224, 4200544, None, None], [4200384, 4200688, None, None], [4200544, 4200848, None, None], [4200688, 4201008, None, None], [4200848, 4201168, None, None], [4201008, 4201312, None, None], [4201168, 4201456, None, None], [4201312, 4201616, None, None], [4201456, 4201776, None, None], [4201616, 4201936, None, None], [4201776, 4202096, None, None], [4201936, 4202240, None, None], [4202096, 4202384, None, None], [4202240, 4202544, None, None], [4202384, 4202704, None, None], [4202544, 4202848, None, None], [4202704, 4203008, None, None], [4202848, 4203168, None, None], [4203008, 4203328, None, None], [4203168, 4203488, None, None], [4203328, 4203648, None, None], [4203488, 4203808, None, None], [4203648, 4203968, None, None], [4203808, 4204128, None, None], [4203968, 4204272, None, None], [4204128, 4204432, None, None], [4204272, 4204592, None, None], [4204432, 4204752, None, None], [4204592, 4204912, None, None], [4204752, 4205056, None, None], [4204912, 4205216, None, None], [4205056, 4205376, None, None], [4205216, 4205536, None, None], [4205376, None, 4211632, None], [None, 4205824, 4211792, None], [4205680, 4205984, None, None], [4205824, 4206144, None, None], [4205984, 4206304, None, None], [4206144, 4206448, None, None], [4206304, 4206608, None, None], [4206448, 4206768, None, None], [4206608, 4206928, None, None], [4206768, 4207088, None, None], [4206928, 4207232, None, None], [4207088, 4207392, None, None], [4207232, 4207552, None, None], [4207392, None, 4211952, None], [None, 4207872, None, 4198784], [4207712, 4208032, None, None], [4207872, 4208192, None, None], [4208032, 4208352, None, None], [4208192, 4208496, None, None], [4208352, 4208656, None, None], [4208496, 4208816, None, None], [4208656, 4208960, None, None], [4208816, 4209120, 4212112, None], [4208960, 4209280, None, None], [4209120, 4209440, None, None], [4209280, 4209600, None, None], [4209440, 4209760, None, None], [4209600, 4209904, None, None], [4209760, 4210064, None, None], [4209904, 4210224, None, None], [4210064, 4210368, None, None], [4210224, 4210528, None, None], [4210368, 4210688, 4212272, None], [4210528, 4210832, None, None], [4210688, 4210992, None, None], [4210832, 4211152, None, None], [4210992, 4211312, None, None], [4211152, None, None, 4198944], [None, None, 4212432, 4199744], [None, None, 4216832, 4205536], [None, None, 4216992, 4205680], [None, None, 4217136, 4207552], [None, None, 4218240, 4208960], [None, None, 4218400, 4210528], [None, None, 4218560, 4211472], [None, 4212752, 4218720, None], [4212592, 4212912, None, None], [4212752, 4213072, None, None], [4212912, 4213232, None, None], [4213072, 4213392, None, None], [4213232, 4213552, None, None], [4213392, 4213696, None, None], [4213552, 4213856, None, None], [4213696, 4214016, None, None], [4213856, 4214176, None, None], [4214016, 4214320, None, None], [4214176, 4214480, None, None], [4214320, 4214640, None, None], [4214480, 4214800, None, None], [4214640, 4214960, None, None], [4214800, 4215120, None, None], [4214960, 4215280, None, None], [4215120, 4215440, None, None], [4215280, 4215584, None, None], [4215440, 4215744, None, None], [4215584, 4215904, None, None], [4215744, 4216064, None, None], [4215904, 4216208, None, None], [4216064, 4216352, None, None], [4216208, 4216512, None, None], [4216352, 4216672, None, None], [4216512, None, 4218880, None], [None, None, 4219040, 4211632], [None, None, 4219200, 4211792], [None, None, 4219360, 4211952], [None, 4217440, 4219520, None], [4217296, 4217600, None, None], [4217440, 4217760, None, None], [4217600, 4217920, None, None], [4217760, 4218080, None, None], [4217920, None, 4219680, None], [None, None, 4219840, 4212112], [None, None, 4219984, 4212272], [None, None, 4220144, 4212432], [None, None, 4220304, 4212592], [None, None, 4220464, 4216672], [None, None, 4220608, 4216832], [None, None, 4220768, 4216992], [None, None, 4222032, 4217136], [None, None, 4222192, 4217296], [None, None, 4222352, 4218080], [None, None, 4222496, 4218240], [None, None, 4222640, 4218400], [None, None, 4223248, 4218560], [None, None, 4223856, 4218720], [None, None, 4225584, 4218880], [None, None, 4225744, 4219040], [None, 4220928, None, 4219200], [4220768, 4221088, None, None], [4220928, 4221232, None, None], [4221088, 4221392, None, None], [4221232, 4221552, None, None], [4221392, 4221712, None, None], [4221552, 4221872, None, None], [4221712, None, 4225888, None], [None, None, 4226048, 4219360], [None, None, 4226208, 4219520], [None, None, 4226688, 4219680], [None, None, 4227008, 4219840], [None, None, 4227168, 4219984], [None, 4222928, None, None], [4222800, 4223088, None, None], [4222928, 4223248, None, None], [4223088, 4223408, None, 4220144], [4223248, 4223568, None, None], [4223408, 4223712, None, None], [4223568, None, None, None], [None, None, 4227328, 4220304], [None, 4224176, 4227488, None], [4224016, 4224336, None, None], [4224176, 4224496, None, None], [4224336, 4224656, None, None], [4224496, 4224816, None, None], [4224656, 4224976, None, None], [4224816, 4225120, None, None], [4224976, 4225264, None, None], [4225120, 4225424, None, None], [4225264, None, 4227648, None], [None, None, 4227808, 4220464], [None, None, 4227968, 4220608], [None, None, 4228112, 4221872], [None, None, 4228272, 4222032], [None, None, 4228576, 4222192], [None, 4226528, 4228736, None], [4226368, 4226688, None, None], [4226528, None, None, 4222352], [None, 4227008, 4228896, None], [4226848, None, None, 4222496], [None, None, 4229056, 4222640], [None, None, 4229680, 4223856], [None, None, 4229840, 4224016], [None, None, 4230928, 4225424], [None, None, 4231088, 4225584], [None, None, 4231248, 4225744], [None, None, 4232208, 4225888], [None, 4228416, None, 4226048], [4228272, None, 4232368, None], [None, None, 4232672, 4226208], [None, None, 4232832, 4226368], [None, None, 4232992, 4226848], [None, None, 4233152, 4227168], [None, 4229376, 4233312, None], [4229216, 4229520, None, None], [4229376, 4229680, None, None], [4229520, None, None, 4227328], [None, 4229984, None, 4227488], [4229840, 4230144, None, None], [4229984, 4230288, None, None], [4230144, 4230448, None, None], [4230288, 4230608, None, None], [4230448, 4230768, None, None], [4230608, None, 4233472, None], [None, None, 4233616, 4227648], [None, None, 4233776, 4227808], [None, None, 4233920, 4227968], [None, 4231568, 4234080, None], [4231408, 4231728, None, None], [4231568, 4231888, None, None], [4231728, 4232048, None, None], [4231888, None, 4234240, None], [None, None, 4234400, 4228112], [None, 4232528, None, 4228416], [4232368, None, 4234560, None], [None, None, 4234880, 4228576], [None, None, 4235328, 4228736], [None, None, 4235792, 4228896], [None, None, 4236576, 4229056], [None, None, 4236736, 4229216], [None, None, 4238784, 4230768], [None, None, 4238944, 4230928], [None, None, 4239104, 4231088], [None, None, 4239264, 4231248], [None, None, 4239424, 4231408], [None, None, 4239584, 4232048], [None, None, 4239744, 4232208], [None, 4234720, None, 4232528], [4234560, None, 4239904, None], [None, 4235040, None, 4232672], [4234880, 4235200, None, None], [4235040, 4235328, None, None], [4235200, None, 4240064, 4232832], [None, 4235632, 4240368, None], [4235488, 4235792, None, None], [4235632, 4235952, None, 4232992], [4235792, 4236112, None, None], [4235952, 4236272, None, None], [4236112, 4236432, None, None], [4236272, None, None, None], [None, None, 4240528, 4233152], [None, 4236896, None, 4233312], [4236736, 4237056, None, None], [4236896, 4237216, None, None], [4237056, 4237376, None, None], [4237216, 4237520, None, None], [4237376, 4237664, None, None], [4237520, 4237824, None, None], [4237664, 4237984, None, None], [4237824, 4238144, None, None], [4237984, 4238304, None, None], [4238144, 4238464, None, None], [4238304, 4238624, None, None], [4238464, 4238784, None, None], [4238624, None, None, 4233472], [None, None, 4240688, 4233616], [None, None, 4240848, 4233776], [None, None, 4241008, 4233920], [None, None, 4241168, 4234080], [None, None, 4241312, 4234240], [None, None, 4241456, 4234400], [None, None, 4241616, 4234720], [None, 4240224, None, 4235328], [4240064, 4240368, None, None], [4240224, None, None, 4235488], [None, None, 4241776, 4236576], [None, None, 4246640, 4238944], [None, None, 4246800, 4239104], [None, None, 4246960, 4239264], [None, None, 4247120, 4239424], [None, None, 4247280, 4239584], [None, None, 4247440, 4239744], [None, None, 4247904, 4239904], [None, 4241936, None, 4240528], [4241776, 4242096, None, None], [4241936, 4242256, None, None], [4242096, 4242416, None, None], [4242256, 4242576, None, None], [4242416, 4242736, None, None], [4242576, 4242896, None, None], [4242736, 4243040, None, None], [4242896, 4243200, None, None], [4243040, 4243360, None, None], [4243200, 4243504, None, None], [4243360, 4243664, None, None], [4243504, 4243824, None, None], [4243664, 4243984, None, None], [4243824, 4244144, None, None], [4243984, 4244288, None, None], [4244144, 4244448, None, None], [4244288, 4244608, None, None], [4244448, 4244768, None, None], [4244608, 4244928, None, None], [4244768, 4245072, None, None], [4244928, 4245232, None, None], [4245072, 4245392, None, None], [4245232, 4245536, None, None], [4245392, 4245696, None, None], [4245536, 4245840, None, None], [4245696, 4246000, None, None], [4245840, 4246160, None, None], [4246000, 4246320, None, None], [4246160, 4246480, None, None], [4246320, 4246640, None, None], [4246480, None, None, 4240688], [None, None, 4248064, 4240848], [None, None, 4248224, 4241008], [None, None, 4248384, 4241168], [None, None, 4248544, 4241312], [None, None, 4248704, 4241456], [None, None, 4248864, None], [None, 4247904, 4249184, None], [4247744, None, None, 4241616], [None, None, 4257312, 4246800], [None, None, 4257472, 4246960], [None, None, 4257632, 4247120], [None, None, 4257760, 4247280], [None, None, 4257920, 4247440], [None, 4249024, 4258080, 4247600], [4248864, 4249184, None, None], [4249024, None, None, 4247744], [None, 4249504, 4258240, None], [4249344, 4249664, None, None], [4249504, 4249824, None, None], [4249664, 4249984, None, None], [4249824, 4250144, None, None], [4249984, 4250304, None, None], [4250144, 4250464, None, None], [4250304, 4250624, None, None], [4250464, 4250784, None, None], [4250624, 4250944, None, None], [4250784, 4251088, None, None], [4250944, 4251248, None, None], [4251088, 4251408, None, None], [4251248, 4251568, None, None], [4251408, 4251712, None, None], [4251568, 4251872, None, None], [4251712, 4252032, None, None], [4251872, 4252192, None, None], [4252032, 4252336, None, None], [4252192, 4252496, None, None], [4252336, 4252656, None, None], [4252496, 4252816, None, None], [4252656, 4252976, None, None], [4252816, 4253136, None, None], [4252976, 4253296, None, None], [4253136, 4253456, None, None], [4253296, 4253616, None, None], [4253456, 4253776, None, None], [4253616, 4253936, None, None], [4253776, 4254096, None, None], [4253936, 4254240, None, None], [4254096, 4254400, None, None], [4254240, 4254544, None, None], [4254400, 4254704, None, None], [4254544, 4254848, None, None], [4254704, 4255008, None, None], [4254848, 4255152, None, None], [4255008, 4255312, None, None], [4255152, 4255472, None, None], [4255312, 4255616, None, None], [4255472, 4255776, None, None], [4255616, 4255936, None, None], [4255776, 4256080, None, None], [4255936, 4256240, None, None], [4256080, 4256400, None, None], [4256240, 4256560, None, None], [4256400, 4256704, None, None], [4256560, 4256848, None, None], [4256704, 4257008, None, None], [4256848, 4257152, None, None], [4257008, None, 4258400, None], [None, None, 4258544, 4248064], [None, None, 4258704, 4248224], [None, None, None, 4248384], [None, None, 4258864, 4248544], [None, None, 4259024, 4248704], [None, None, 4259184, 4248864], [None, None, 4259344, 4249344], [None, None, 4263760, 4257152], [None, None, 4263920, 4257312], [None, None, 4264080, 4257472], [None, None, 4265200, 4257760], [None, None, 4265344, 4257920], [None, None, 4265504, 4258080], [None, None, 4265648, 4258240], [None, 4259648, 4265792, None], [4259488, 4259808, None, None], [4259648, 4259968, None, None], [4259808, 4260128, None, None], [4259968, None, 4265952, None], [None, 4260448, 4266112, None], [4260288, 4260592, None, None], [4260448, 4260752, None, None], [4260592, 4260912, None, None], [4260752, 4261072, None, None], [4260912, 4261232, None, None], [4261072, 4261392, None, None], [4261232, 4261552, None, None], [4261392, 4261712, None, None], [4261552, 4261872, None, None], [4261712, 4262032, None, None], [4261872, 4262176, None, None], [4262032, 4262320, None, None], [4262176, 4262480, None, None], [4262320, 4262640, None, None], [4262480, 4262800, None, None], [4262640, 4262960, None, None], [4262800, 4263120, None, None], [4262960, 4263280, None, None], [4263120, 4263440, None, None], [4263280, 4263600, None, None], [4263440, None, 4266272, None], [None, None, 4268496, 4258400], [None, None, 4268656, 4258544], [None, 4264240, None, 4258704], [4264080, 4264400, None, None], [4264240, 4264560, None, None], [4264400, 4264720, None, None], [4264560, 4264880, None, None], [4264720, 4265040, None, None], [4264880, 4265200, None, None], [4265040, None, None, 4258864], [None, None, 4268816, 4259024], [None, None, 4268976, 4259184], [None, None, 4269136, 4259344], [None, None, 4269296, 4259488], [None, None, 4269456, 4260128], [None, None, 4269616, 4260288], [None, 4266432, None, 4263600], [4266272, 4266592, None, None], [4266432, 4266752, None, None], [4266592, 4266912, None, None], [4266752, 4267072, None, None], [4266912, 4267232, None, None], [4267072, 4267392, None, None], [4267232, 4267552, None, None], [4267392, 4267712, None, None], [4267552, 4267872, None, None], [4267712, 4268032, None, None], [4267872, 4268192, None, None], [4268032, 4268352, None, None], [4268192, 4268496, None, None], [4268352, None, None, 4263760], [None, None, 4269760, 4263920], [None, None, 4272288, 4265344], [None, None, 4272448, 4265504], [None, None, 4272608, 4265648], [None, None, 4273392, 4265792], [None, None, 4273552, 4265952], [None, None, 4273696, 4266112], [None, 4269920, None, 4268656], [4269760, 4270080, None, None], [4269920, 4270240, None, None], [4270080, 4270400, None, None], [4270240, 4270560, None, None], [4270400, 4270720, None, None], [4270560, 4270880, None, None], [4270720, 4271040, None, None], [4270880, 4271184, None, None], [4271040, 4271328, None, None], [4271184, 4271488, None, None], [4271328, 4271648, None, None], [4271488, 4271808, None, None], [4271648, 4271968, None, None], [4271808, 4272128, None, None], [4271968, 4272288, None, None], [4272128, None, None, 4268816], [None, None, 4274480, 4268976], [None, 4272768, None, 4269136], [4272608, 4272928, None, None], [4272768, 4273088, None, None], [4272928, 4273248, None, None], [4273088, 4273392, None, None], [4273248, None, None, 4269296], [None, None, 4274640, 4269456], [None, None, 4274800, 4269616], [None, 4274000, 4277808, None], [4273840, 4274160, None, None], [4274000, 4274320, None, None], [4274160, None, 4277968, None], [None, None, 4284896, 4272448], [None, None, 4286496, 4273552], [None, 4274960, None, 4273696], [4274800, 4275120, None, None], [4274960, 4275280, None, None], [4275120, 4275440, None, None], [4275280, 4275584, None, None], [4275440, 4275744, None, None], [4275584, 4275904, None, None], [4275744, 4276064, None, None], [4275904, 4276208, None, None], [4276064, 4276368, None, None], [4276208, 4276528, None, None], [4276368, 4276688, None, None], [4276528, 4276848, None, None], [4276688, 4277008, None, None], [4276848, 4277168, None, None], [4277008, 4277328, None, None], [4277168, 4277488, None, None], [4277328, 4277648, None, None], [4277488, 4277808, None, None], [4277648, None, None, 4273840], [None, 4278128, None, 4274320], [4277968, 4278288, None, None], [4278128, 4278448, None, None], [4278288, 4278608, None, None], [4278448, 4278768, None, None], [4278608, 4278928, None, None], [4278768, 4279072, None, None], [4278928, 4279216, None, None], [4279072, 4279376, None, None], [4279216, 4279536, None, None], [4279376, 4279696, None, None], [4279536, 4279840, None, None], [4279696, 4280000, None, None], [4279840, 4280160, None, None], [4280000, 4280304, None, None], [4280160, 4280464, None, None], [4280304, 4280624, None, None], [4280464, 4280784, None, None], [4280624, 4280944, None, None], [4280784, 4281088, None, None], [4280944, 4281248, None, None], [4281088, 4281408, None, None], [4281248, 4281568, None, None], [4281408, 4281728, None, None], [4281568, 4281888, None, None], [4281728, 4282048, None, None], [4281888, 4282208, None, None], [4282048, 4282352, None, None], [4282208, 4282512, None, None], [4282352, 4282656, None, None], [4282512, 4282816, None, None], [4282656, 4282976, None, None], [4282816, 4283136, None, None], [4282976, 4283296, None, None], [4283136, 4283456, None, None], [4283296, 4283616, None, None], [4283456, 4283776, None, None], [4283616, 4283936, None, None], [4283776, 4284096, None, None], [4283936, 4284256, None, None], [4284096, 4284416, None, None], [4284256, 4284576, None, None], [4284416, 4284736, None, None], [4284576, 4284896, None, None], [4284736, None, None, 4274480], [None, 4285216, 4286656, None], [4285056, 4285376, None, None], [4285216, 4285536, None, None], [4285376, 4285696, None, None], [4285536, 4285856, None, None], [4285696, 4286016, None, None], [4285856, 4286176, None, None], [4286016, 4286336, None, None], [4286176, 4286496, None, None], [4286336, None, None, 4274640], [None, None, 4296976, 4285056], [None, 4286976, 4297136, None], [4286816, 4287120, None, None], [4286976, 4287264, None, None], [4287120, 4287424, None, None], [4287264, 4287584, None, None], [4287424, 4287744, None, None], [4287584, 4287904, None, None], [4287744, 4288064, None, None], [4287904, 4288224, None, None], [4288064, 4288384, None, None], [4288224, 4288528, None, None], [4288384, 4288688, None, None], [4288528, 4288848, None, None], [4288688, 4288992, None, None], [4288848, 4289152, None, None], [4288992, 4289312, None, None], [4289152, 4289472, None, None], [4289312, 4289632, None, None], [4289472, 4289792, None, None], [4289632, 4289952, None, None], [4289792, 4290112, None, None], [4289952, 4290272, None, None], [4290112, 4290432, None, None], [4290272, 4290592, None, None], [4290432, 4290752, None, None], [4290592, 4290912, None, None], [4290752, 4291072, None, None], [4290912, 4291232, None, None], [4291072, 4291376, None, None], [4291232, 4291536, None, None], [4291376, 4291696, None, None], [4291536, 4291856, None, None], [4291696, 4292000, None, None], [4291856, 4292144, None, None], [4292000, 4292288, None, None], [4292144, 4292448, None, None], [4292288, 4292608, None, None], [4292448, 4292768, None, None], [4292608, 4292928, None, None], [4292768, 4293088, None, None], [4292928, 4293248, None, None], [4293088, 4293392, None, None], [4293248, 4293552, None, None], [4293392, 4293696, None, None], [4293552, 4293856, None, None], [4293696, 4294016, None, None], [4293856, 4294160, None, None], [4294016, 4294320, None, None], [4294160, 4294480, 4297296, None], [4294320, 4294640, None, None], [4294480, 4294800, None, None], [4294640, 4294944, None, None], [4294800, 4295088, None, None], [4294944, 4295232, None, None], [4295088, 4295392, None, None], [4295232, 4295552, None, None], [4295392, 4295696, None, None], [4295552, 4295856, None, None], [4295696, 4296016, None, None], [4295856, 4296176, None, None], [4296016, 4296336, None, None], [4296176, 4296496, None, None], [4296336, 4296656, None, None], [4296496, 4296816, None, None], [4296656, None, 4297424, None], [None, None, 4297584, 4286656], [None, None, 4297744, 4286816], [None, None, 4297904, 4294320], [None, None, 4299472, 4296816], [None, None, 4300720, 4296976], [None, None, 4302288, 4297136], [None, None, 4308576, 4297296], [None, 4298224, 4308720, None], [4298064, 4298384, None, None], [4298224, 4298528, None, None], [4298384, 4298688, None, None], [4298528, 4298848, None, None], [4298688, 4299008, None, None], [4298848, 4299168, None, None], [4299008, 4299312, None, None], [4299168, 4299472, None, None], [4299312, 4299632, None, 4297424], [4299472, 4299792, None, None], [4299632, 4299936, None, None], [4299792, 4300096, None, None], [4299936, 4300256, None, None], [4300096, 4300416, None, None], [4300256, 4300576, None, None], [4300416, None, None, None], [None, 4300864, None, 4297584], [4300720, 4301024, None, None], [4300864, 4301184, None, None], [4301024, 4301344, None, None], [4301184, 4301504, None, None], [4301344, 4301648, None, None], [4301504, 4301808, None, None], [4301648, 4301968, None, None], [4301808, 4302128, None, None], [4301968, 4302288, None, None], [4302128, 4302448, None, 4297744], [4302288, 4302608, None, None], [4302448, 4302768, None, None], [4302608, 4302912, None, None], [4302768, 4303072, None, None], [4302912, 4303232, None, None], [4303072, 4303392, None, None], [4303232, 4303552, None, None], [4303392, 4303712, None, None], [4303552, 4303872, None, None], [4303712, 4304032, None, None], [4303872, 4304192, None, None], [4304032, 4304352, None, None], [4304192, 4304496, None, None], [4304352, 4304656, None, None], [4304496, 4304816, None, None], [4304656, 4304976, None, None], [4304816, 4305136, None, None], [4304976, 4305296, None, None], [4305136, 4305456, None, None], [4305296, 4305616, None, None], [4305456, 4305776, None, None], [4305616, 4305936, None, None], [4305776, 4306096, None, None], [4305936, 4306256, None, None], [4306096, 4306400, None, None], [4306256, 4306560, None, None], [4306400, 4306720, None, None], [4306560, 4306880, None, None], [4306720, 4307024, None, None], [4306880, 4307184, None, None], [4307024, 4307344, None, None], [4307184, 4307504, None, None], [4307344, 4307664, None, None], [4307504, 4307808, None, None], [4307664, 4307968, None, None], [4307808, 4308128, None, None], [4307968, 4308288, None, None], [4308128, 4308448, None, None], [4308288, None, None, None], [None, None, 4308880, 4297904], [None, None, 4309040, 4298064], [None, None, 4311264, 4308576], [None, None, 4311888, 4308720], [None, 4309360, 4312336, None], [4309200, 4309520, 4312496, None], [4309360, None, 4312624, None], [None, None, 4313872, None], [None, 4309984, 4315312, None], [4309824, None, 4315472, None], [None, 4310304, 4316112, None], [4310144, 4310464, 4316272, None], [4310304, 4310624, 4316432, None], [4310464, 4310784, 4316592, None], [4310624, 4310944, 4316736, None], [4310784, 4311104, 4316896, None], [4310944, None, 4317024, None], [None, 4311424, 4317664, 4308880], [4311264, 4311584, 4317824, None], [4311424, 4311744, 4317984, None], [4311584, None, 4318112, None], [None, None, 4318752, 4309040], [None, 4312176, None, None], [4312048, 4312336, 4318896, None], [4312176, 4312496, None, 4309200], [4312336, 4312624, None, 4309360], [4312496, 4312784, None, 4309520], [4312624, 4312928, None, None], [4312784, 4313088, None, None], [4312928, 4313248, None, None], [4313088, 4313408, None, None], [4313248, 4313568, None, None], [4313408, 4313712, None, None], [4313568, 4313872, 4319056, None], [4313712, 4314032, None, 4309680], [4313872, 4314192, 4319200, None], [4314032, 4314352, None, None], [4314192, 4314512, None, None], [4314352, 4314672, None, None], [4314512, 4314832, None, None], [4314672, 4314992, None, None], [4314832, 4315152, None, None], [4314992, 4315312, 4319328, None], [4315152, 4315472, None, 4309824], [4315312, 4315632, None, 4309984], [4315472, 4315792, 4319472, None], [4315632, 4315952, None, None], [4315792, 4316112, None, None], [4315952, 4316272, None, 4310144], [4316112, 4316432, None, 4310304], [4316272, 4316592, None, 4310464], [4316432, 4316736, 4319616, 4310624], [4316592, 4316896, None, 4310784], [4316736, 4317024, None, 4310944], [4316896, 4317184, None, 4311104], [4317024, 4317344, None, None], [4317184, 4317504, None, None], [4317344, 4317664, 4319760, None], [4317504, 4317824, None, 4311264], [4317664, 4317984, None, 4311424], [4317824, 4318112, None, 4311584], [4317984, 4318272, None, 4311744], [4318112, 4318432, None, None], [4318272, 4318592, None, None], [4318432, 4318752, None, None], [4318592, None, None, 4311888], [None, None, 4319920, 4312176], [None, None, None, 4313712], [None, None, None, 4314032], [None, None, None, 4315152], [None, None, None, 4315632], [None, None, 4320080, 4316592], [None, None, 4320240, 4317504], [None, None, 4321472, 4318896], [None, None, 4321600, 4319616], [None, 4320400, 4321760, 4319760], [4320240, 4320560, None, None], [4320400, 4320720, None, None], [4320560, 4320880, None, None], [4320720, 4321024, None, None], [4320880, 4321184, None, None], [4321024, 4321344, None, None], [4321184, None, None, None], [None, None, None, 4319920], [None, None, 4321904, 4320080], [None, None, None, 4320240], [None, None, None, 4321600]]
len(func_list): 788
len(all_edges): 788
[4198480, 4198624, 4198784, 4198944, 4199104, 4199264, 4199424, 4199584, 4199744, 4199904, 4200064, 4200224, 4200384, 4200544, 4200688, 4200848, 4201008, 4201168, 4201312, 4201456, 4201616, 4201776, 4201936, 4202096, 4202240, 4202384, 4202544, 4202704, 4202848, 4203008, 4203168, 4203328, 4203488, 4203648, 4203808, 4203968, 4204128, 4204272, 4204432, 4204592, 4204752, 4204912, 4205056, 4205216, 4205376, 4205536, 4205680, 4205824, 4205984, 4206144, 4206304, 4206448, 4206608, 4206768, 4206928, 4207088, 4207232, 4207392, 4207552, 4207712, 4207872, 4208032, 4208192, 4208352, 4208496, 4208656, 4208816, 4208960, 4209120, 4209280, 4209440, 4209600, 4209760, 4209904, 4210064, 4210224, 4210368, 4210528, 4210688, 4210832, 4210992, 4211152, 4211312, 4211472, 4211632, 4211792, 4211952, 4212112, 4212272, 4212432, 4212592, 4212752, 4212912, 4213072, 4213232, 4213392, 4213552, 4213696, 4213856, 4214016, 4214176, 4214320, 4214480, 4214640, 4214800, 4214960, 4215120, 4215280, 4215440, 4215584, 4215744, 4215904, 4216064, 4216208, 4216352, 4216512, 4216672, 4216832, 4216992, 4217136, 4217296, 4217440, 4217600, 4217760, 4217920, 4218080, 4218240, 4218400, 4218560, 4218720, 4218880, 4219040, 4219200, 4219360, 4219520, 4219680, 4219840, 4219984, 4220144, 4220304, 4220464, 4220608, 4220768, 4220928, 4221088, 4221232, 4221392, 4221552, 4221712, 4221872, 4222032, 4222192, 4222352, 4222496, 4222640, 4222800, 4222928, 4223088, 4223248, 4223408, 4223568, 4223712, 4223856, 4224016, 4224176, 4224336, 4224496, 4224656, 4224816, 4224976, 4225120, 4225264, 4225424, 4225584, 4225744, 4225888, 4226048, 4226208, 4226368, 4226528, 4226688, 4226848, 4227008, 4227168, 4227328, 4227488, 4227648, 4227808, 4227968, 4228112, 4228272, 4228416, 4228576, 4228736, 4228896, 4229056, 4229216, 4229376, 4229520, 4229680, 4229840, 4229984, 4230144, 4230288, 4230448, 4230608, 4230768, 4230928, 4231088, 4231248, 4231408, 4231568, 4231728, 4231888, 4232048, 4232208, 4232368, 4232528, 4232672, 4232832, 4232992, 4233152, 4233312, 4233472, 4233616, 4233776, 4233920, 4234080, 4234240, 4234400, 4234560, 4234720, 4234880, 4235040, 4235200, 4235328, 4235488, 4235632, 4235792, 4235952, 4236112, 4236272, 4236432, 4236576, 4236736, 4236896, 4237056, 4237216, 4237376, 4237520, 4237664, 4237824, 4237984, 4238144, 4238304, 4238464, 4238624, 4238784, 4238944, 4239104, 4239264, 4239424, 4239584, 4239744, 4239904, 4240064, 4240224, 4240368, 4240528, 4240688, 4240848, 4241008, 4241168, 4241312, 4241456, 4241616, 4241776, 4241936, 4242096, 4242256, 4242416, 4242576, 4242736, 4242896, 4243040, 4243200, 4243360, 4243504, 4243664, 4243824, 4243984, 4244144, 4244288, 4244448, 4244608, 4244768, 4244928, 4245072, 4245232, 4245392, 4245536, 4245696, 4245840, 4246000, 4246160, 4246320, 4246480, 4246640, 4246800, 4246960, 4247120, 4247280, 4247440, 4247600, 4247744, 4247904, 4248064, 4248224, 4248384, 4248544, 4248704, 4248864, 4249024, 4249184, 4249344, 4249504, 4249664, 4249824, 4249984, 4250144, 4250304, 4250464, 4250624, 4250784, 4250944, 4251088, 4251248, 4251408, 4251568, 4251712, 4251872, 4252032, 4252192, 4252336, 4252496, 4252656, 4252816, 4252976, 4253136, 4253296, 4253456, 4253616, 4253776, 4253936, 4254096, 4254240, 4254400, 4254544, 4254704, 4254848, 4255008, 4255152, 4255312, 4255472, 4255616, 4255776, 4255936, 4256080, 4256240, 4256400, 4256560, 4256704, 4256848, 4257008, 4257152, 4257312, 4257472, 4257632, 4257760, 4257920, 4258080, 4258240, 4258400, 4258544, 4258704, 4258864, 4259024, 4259184, 4259344, 4259488, 4259648, 4259808, 4259968, 4260128, 4260288, 4260448, 4260592, 4260752, 4260912, 4261072, 4261232, 4261392, 4261552, 4261712, 4261872, 4262032, 4262176, 4262320, 4262480, 4262640, 4262800, 4262960, 4263120, 4263280, 4263440, 4263600, 4263760, 4263920, 4264080, 4264240, 4264400, 4264560, 4264720, 4264880, 4265040, 4265200, 4265344, 4265504, 4265648, 4265792, 4265952, 4266112, 4266272, 4266432, 4266592, 4266752, 4266912, 4267072, 4267232, 4267392, 4267552, 4267712, 4267872, 4268032, 4268192, 4268352, 4268496, 4268656, 4268816, 4268976, 4269136, 4269296, 4269456, 4269616, 4269760, 4269920, 4270080, 4270240, 4270400, 4270560, 4270720, 4270880, 4271040, 4271184, 4271328, 4271488, 4271648, 4271808, 4271968, 4272128, 4272288, 4272448, 4272608, 4272768, 4272928, 4273088, 4273248, 4273392, 4273552, 4273696, 4273840, 4274000, 4274160, 4274320, 4274480, 4274640, 4274800, 4274960, 4275120, 4275280, 4275440, 4275584, 4275744, 4275904, 4276064, 4276208, 4276368, 4276528, 4276688, 4276848, 4277008, 4277168, 4277328, 4277488, 4277648, 4277808, 4277968, 4278128, 4278288, 4278448, 4278608, 4278768, 4278928, 4279072, 4279216, 4279376, 4279536, 4279696, 4279840, 4280000, 4280160, 4280304, 4280464, 4280624, 4280784, 4280944, 4281088, 4281248, 4281408, 4281568, 4281728, 4281888, 4282048, 4282208, 4282352, 4282512, 4282656, 4282816, 4282976, 4283136, 4283296, 4283456, 4283616, 4283776, 4283936, 4284096, 4284256, 4284416, 4284576, 4284736, 4284896, 4285056, 4285216, 4285376, 4285536, 4285696, 4285856, 4286016, 4286176, 4286336, 4286496, 4286656, 4286816, 4286976, 4287120, 4287264, 4287424, 4287584, 4287744, 4287904, 4288064, 4288224, 4288384, 4288528, 4288688, 4288848, 4288992, 4289152, 4289312, 4289472, 4289632, 4289792, 4289952, 4290112, 4290272, 4290432, 4290592, 4290752, 4290912, 4291072, 4291232, 4291376, 4291536, 4291696, 4291856, 4292000, 4292144, 4292288, 4292448, 4292608, 4292768, 4292928, 4293088, 4293248, 4293392, 4293552, 4293696, 4293856, 4294016, 4294160, 4294320, 4294480, 4294640, 4294800, 4294944, 4295088, 4295232, 4295392, 4295552, 4295696, 4295856, 4296016, 4296176, 4296336, 4296496, 4296656, 4296816, 4296976, 4297136, 4297296, 4297424, 4297584, 4297744, 4297904, 4298064, 4298224, 4298384, 4298528, 4298688, 4298848, 4299008, 4299168, 4299312, 4299472, 4299632, 4299792, 4299936, 4300096, 4300256, 4300416, 4300576, 4300720, 4300864, 4301024, 4301184, 4301344, 4301504, 4301648, 4301808, 4301968, 4302128, 4302288, 4302448, 4302608, 4302768, 4302912, 4303072, 4303232, 4303392, 4303552, 4303712, 4303872, 4304032, 4304192, 4304352, 4304496, 4304656, 4304816, 4304976, 4305136, 4305296, 4305456, 4305616, 4305776, 4305936, 4306096, 4306256, 4306400, 4306560, 4306720, 4306880, 4307024, 4307184, 4307344, 4307504, 4307664, 4307808, 4307968, 4308128, 4308288, 4308448, 4308576, 4308720, 4308880, 4309040, 4309200, 4309360, 4309520, 4309680, 4309824, 4309984, 4310144, 4310304, 4310464, 4310624, 4310784, 4310944, 4311104, 4311264, 4311424, 4311584, 4311744, 4311888, 4312048, 4312176, 4312336, 4312496, 4312624, 4312784, 4312928, 4313088, 4313248, 4313408, 4313568, 4313712, 4313872, 4314032, 4314192, 4314352, 4314512, 4314672, 4314832, 4314992, 4315152, 4315312, 4315472, 4315632, 4315792, 4315952, 4316112, 4316272, 4316432, 4316592, 4316736, 4316896, 4317024, 4317184, 4317344, 4317504, 4317664, 4317824, 4317984, 4318112, 4318272, 4318432, 4318592, 4318752, 4318896, 4319056, 4319200, 4319328, 4319472, 4319616, 4319760, 4319920, 4320080, 4320240, 4320400, 4320560, 4320720, 4320880, 4321024, 4321184, 4321344, 4321472, 4321600, 4321760, 4321904]
对于IDAPython简单函数的学习，可以参考 https://zzzzsky.com/2021/12/08/LearnIDAPython/
至此，我们找到了所有的节点，以及每个节点对应的adsw对应的4个值，如果为None说明不通，如果不为None，说明是进入的另外一个函数，就可以构造一条边
networkx求最短路径
写python脚本
import networkx as nx
import hashlib
all_edges = [[None, 4198624, None, None], [4198480, None, 4198784, None], [None, None, 4207712, 4198624], [None, 4199104, 4211312, None], [4198944, 4199264, None, None], [4199104, 4199424, None, None], [4199264, 4199584, None, None], [4199424, 4199744, None, None], [4199584, 4199904, 4211472, None], [4199744, 4200064, None, None], [4199904, 4200224, None, None], [4200064, 4200384, None, None], [4200224, 4200544, None, None], [4200384, 4200688, None, None], [4200544, 4200848, None, None], [4200688, 4201008, None, None], [4200848, 4201168, None, None], [4201008, 4201312, None, None], [4201168, 4201456, None, None], [4201312, 4201616, None, None], [4201456, 4201776, None, None], [4201616, 4201936, None, None], [4201776, 4202096, None, None], [4201936, 4202240, None, None], [4202096, 4202384, None, None], [4202240, 4202544, None, None], [4202384, 4202704, None, None], [4202544, 4202848, None, None], [4202704, 4203008, None, None], [4202848, 4203168, None, None], [4203008, 4203328, None, None], [4203168, 4203488, None, None], [4203328, 4203648, None, None], [4203488, 4203808, None, None], [4203648, 4203968, None, None], [4203808, 4204128, None, None], [4203968, 4204272, None, None], [4204128, 4204432, None, None], [4204272, 4204592, None, None], [4204432, 4204752, None, None], [4204592, 4204912, None, None], [4204752, 4205056, None, None], [4204912, 4205216, None, None], [4205056, 4205376, None, None], [4205216, 4205536, None, None], [4205376, None, 4211632, None], [None, 4205824, 4211792, None], [4205680, 4205984, None, None], [4205824, 4206144, None, None], [4205984, 4206304, None, None], [4206144, 4206448, None, None], [4206304, 4206608, None, None], [4206448, 4206768, None, None], [4206608, 4206928, None, None], [4206768, 4207088, None, None], [4206928, 4207232, None, None], [4207088, 4207392, None, None], [4207232, 4207552, None, None], [4207392, None, 4211952, None], [None, 4207872, None, 4198784], [4207712, 4208032, None, None], [4207872, 4208192, None, None], [4208032, 4208352, None, None], [4208192, 4208496, None, None], [4208352, 4208656, None, None], [4208496, 4208816, None, None], [4208656, 4208960, None, None], [4208816, 4209120, 4212112, None], [4208960, 4209280, None, None], [4209120, 4209440, None, None], [4209280, 4209600, None, None], [4209440, 4209760, None, None], [4209600, 4209904, None, None], [4209760, 4210064, None, None], [4209904, 4210224, None, None], [4210064, 4210368, None, None], [4210224, 4210528, None, None], [4210368, 4210688, 4212272, None], [4210528, 4210832, None, None], [4210688, 4210992, None, None], [4210832, 4211152, None, None], [4210992, 4211312, None, None], [4211152, None, None, 4198944], [None, None, 4212432, 4199744], [None, None, 4216832, 4205536], [None, None, 4216992, 4205680], [None, None, 4217136, 4207552], [None, None, 4218240, 4208960], [None, None, 4218400, 4210528], [None, None, 4218560, 4211472], [None, 4212752, 4218720, None], [4212592, 4212912, None, None], [4212752, 4213072, None, None], [4212912, 4213232, None, None], [4213072, 4213392, None, None], [4213232, 4213552, None, None], [4213392, 4213696, None, None], [4213552, 4213856, None, None], [4213696, 4214016, None, None], [4213856, 4214176, None, None], [4214016, 4214320, None, None], [4214176, 4214480, None, None], [4214320, 4214640, None, None], [4214480, 4214800, None, None], [4214640, 4214960, None, None], [4214800, 4215120, None, None], [4214960, 4215280, None, None], [4215120, 4215440, None, None], [4215280, 4215584, None, None], [4215440, 4215744, None, None], [4215584, 4215904, None, None], [4215744, 4216064, None, None], [4215904, 4216208, None, None], [4216064, 4216352, None, None], [4216208, 4216512, None, None], [4216352, 4216672, None, None], [4216512, None, 4218880, None], [None, None, 4219040, 4211632], [None, None, 4219200, 4211792], [None, None, 4219360, 4211952], [None, 4217440, 4219520, None], [4217296, 4217600, None, None], [4217440, 4217760, None, None], [4217600, 4217920, None, None], [4217760, 4218080, None, None], [4217920, None, 4219680, None], [None, None, 4219840, 4212112], [None, None, 4219984, 4212272], [None, None, 4220144, 4212432], [None, None, 4220304, 4212592], [None, None, 4220464, 4216672], [None, None, 4220608, 4216832], [None, None, 4220768, 4216992], [None, None, 4222032, 4217136], [None, None, 4222192, 4217296], [None, None, 4222352, 4218080], [None, None, 4222496, 4218240], [None, None, 4222640, 4218400], [None, None, 4223248, 4218560], [None, None, 4223856, 4218720], [None, None, 4225584, 4218880], [None, None, 4225744, 4219040], [None, 4220928, None, 4219200], [4220768, 4221088, None, None], [4220928, 4221232, None, None], [4221088, 4221392, None, None], [4221232, 4221552, None, None], [4221392, 4221712, None, None], [4221552, 4221872, None, None], [4221712, None, 4225888, None], [None, None, 4226048, 4219360], [None, None, 4226208, 4219520], [None, None, 4226688, 4219680], [None, None, 4227008, 4219840], [None, None, 4227168, 4219984], [None, 4222928, None, None], [4222800, 4223088, None, None], [4222928, 4223248, None, None], [4223088, 4223408, None, 4220144], [4223248, 4223568, None, None], [4223408, 4223712, None, None], [4223568, None, None, None], [None, None, 4227328, 4220304], [None, 4224176, 4227488, None], [4224016, 4224336, None, None], [4224176, 4224496, None, None], [4224336, 4224656, None, None], [4224496, 4224816, None, None], [4224656, 4224976, None, None], [4224816, 4225120, None, None], [4224976, 4225264, None, None], [4225120, 4225424, None, None], [4225264, None, 4227648, None], [None, None, 4227808, 4220464], [None, None, 4227968, 4220608], [None, None, 4228112, 4221872], [None, None, 4228272, 4222032], [None, None, 4228576, 4222192], [None, 4226528, 4228736, None], [4226368, 4226688, None, None], [4226528, None, None, 4222352], [None, 4227008, 4228896, None], [4226848, None, None, 4222496], [None, None, 4229056, 4222640], [None, None, 4229680, 4223856], [None, None, 4229840, 4224016], [None, None, 4230928, 4225424], [None, None, 4231088, 4225584], [None, None, 4231248, 4225744], [None, None, 4232208, 4225888], [None, 4228416, None, 4226048], [4228272, None, 4232368, None], [None, None, 4232672, 4226208], [None, None, 4232832, 4226368], [None, None, 4232992, 4226848], [None, None, 4233152, 4227168], [None, 4229376, 4233312, None], [4229216, 4229520, None, None], [4229376, 4229680, None, None], [4229520, None, None, 4227328], [None, 4229984, None, 4227488], [4229840, 4230144, None, None], [4229984, 4230288, None, None], [4230144, 4230448, None, None], [4230288, 4230608, None, None], [4230448, 4230768, None, None], [4230608, None, 4233472, None], [None, None, 4233616, 4227648], [None, None, 4233776, 4227808], [None, None, 4233920, 4227968], [None, 4231568, 4234080, None], [4231408, 4231728, None, None], [4231568, 4231888, None, None], [4231728, 4232048, None, None], [4231888, None, 4234240, None], [None, None, 4234400, 4228112], [None, 4232528, None, 4228416], [4232368, None, 4234560, None], [None, None, 4234880, 4228576], [None, None, 4235328, 4228736], [None, None, 4235792, 4228896], [None, None, 4236576, 4229056], [None, None, 4236736, 4229216], [None, None, 4238784, 4230768], [None, None, 4238944, 4230928], [None, None, 4239104, 4231088], [None, None, 4239264, 4231248], [None, None, 4239424, 4231408], [None, None, 4239584, 4232048], [None, None, 4239744, 4232208], [None, 4234720, None, 4232528], [4234560, None, 4239904, None], [None, 4235040, None, 4232672], [4234880, 4235200, None, None], [4235040, 4235328, None, None], [4235200, None, 4240064, 4232832], [None, 4235632, 4240368, None], [4235488, 4235792, None, None], [4235632, 4235952, None, 4232992], [4235792, 4236112, None, None], [4235952, 4236272, None, None], [4236112, 4236432, None, None], [4236272, None, None, None], [None, None, 4240528, 4233152], [None, 4236896, None, 4233312], [4236736, 4237056, None, None], [4236896, 4237216, None, None], [4237056, 4237376, None, None], [4237216, 4237520, None, None], [4237376, 4237664, None, None], [4237520, 4237824, None, None], [4237664, 4237984, None, None], [4237824, 4238144, None, None], [4237984, 4238304, None, None], [4238144, 4238464, None, None], [4238304, 4238624, None, None], [4238464, 4238784, None, None], [4238624, None, None, 4233472], [None, None, 4240688, 4233616], [None, None, 4240848, 4233776], [None, None, 4241008, 4233920], [None, None, 4241168, 4234080], [None, None, 4241312, 4234240], [None, None, 4241456, 4234400], [None, None, 4241616, 4234720], [None, 4240224, None, 4235328], [4240064, 4240368, None, None], [4240224, None, None, 4235488], [None, None, 4241776, 4236576], [None, None, 4246640, 4238944], [None, None, 4246800, 4239104], [None, None, 4246960, 4239264], [None, None, 4247120, 4239424], [None, None, 4247280, 4239584], [None, None, 4247440, 4239744], [None, None, 4247904, 4239904], [None, 4241936, None, 4240528], [4241776, 4242096, None, None], [4241936, 4242256, None, None], [4242096, 4242416, None, None], [4242256, 4242576, None, None], [4242416, 4242736, None, None], [4242576, 4242896, None, None], [4242736, 4243040, None, None], [4242896, 4243200, None, None], [4243040, 4243360, None, None], [4243200, 4243504, None, None], [4243360, 4243664, None, None], [4243504, 4243824, None, None], [4243664, 4243984, None, None], [4243824, 4244144, None, None], [4243984, 4244288, None, None], [4244144, 4244448, None, None], [4244288, 4244608, None, None], [4244448, 4244768, None, None], [4244608, 4244928, None, None], [4244768, 4245072, None, None], [4244928, 4245232, None, None], [4245072, 4245392, None, None], [4245232, 4245536, None, None], [4245392, 4245696, None, None], [4245536, 4245840, None, None], [4245696, 4246000, None, None], [4245840, 4246160, None, None], [4246000, 4246320, None, None], [4246160, 4246480, None, None], [4246320, 4246640, None, None], [4246480, None, None, 4240688], [None, None, 4248064, 4240848], [None, None, 4248224, 4241008], [None, None, 4248384, 4241168], [None, None, 4248544, 4241312], [None, None, 4248704, 4241456], [None, None, 4248864, None], [None, 4247904, 4249184, None], [4247744, None, None, 4241616], [None, None, 4257312, 4246800], [None, None, 4257472, 4246960], [None, None, 4257632, 4247120], [None, None, 4257760, 4247280], [None, None, 4257920, 4247440], [None, 4249024, 4258080, 4247600], [4248864, 4249184, None, None], [4249024, None, None, 4247744], [None, 4249504, 4258240, None], [4249344, 4249664, None, None], [4249504, 4249824, None, None], [4249664, 4249984, None, None], [4249824, 4250144, None, None], [4249984, 4250304, None, None], [4250144, 4250464, None, None], [4250304, 4250624, None, None], [4250464, 4250784, None, None], [4250624, 4250944, None, None], [4250784, 4251088, None, None], [4250944, 4251248, None, None], [4251088, 4251408, None, None], [4251248, 4251568, None, None], [4251408, 4251712, None, None], [4251568, 4251872, None, None], [4251712, 4252032, None, None], [4251872, 4252192, None, None], [4252032, 4252336, None, None], [4252192, 4252496, None, None], [4252336, 4252656, None, None], [4252496, 4252816, None, None], [4252656, 4252976, None, None], [4252816, 4253136, None, None], [4252976, 4253296, None, None], [4253136, 4253456, None, None], [4253296, 4253616, None, None], [4253456, 4253776, None, None], [4253616, 4253936, None, None], [4253776, 4254096, None, None], [4253936, 4254240, None, None], [4254096, 4254400, None, None], [4254240, 4254544, None, None], [4254400, 4254704, None, None], [4254544, 4254848, None, None], [4254704, 4255008, None, None], [4254848, 4255152, None, None], [4255008, 4255312, None, None], [4255152, 4255472, None, None], [4255312, 4255616, None, None], [4255472, 4255776, None, None], [4255616, 4255936, None, None], [4255776, 4256080, None, None], [4255936, 4256240, None, None], [4256080, 4256400, None, None], [4256240, 4256560, None, None], [4256400, 4256704, None, None], [4256560, 4256848, None, None], [4256704, 4257008, None, None], [4256848, 4257152, None, None], [4257008, None, 4258400, None], [None, None, 4258544, 4248064], [None, None, 4258704, 4248224], [None, None, None, 4248384], [None, None, 4258864, 4248544], [None, None, 4259024, 4248704], [None, None, 4259184, 4248864], [None, None, 4259344, 4249344], [None, None, 4263760, 4257152], [None, None, 4263920, 4257312], [None, None, 4264080, 4257472], [None, None, 4265200, 4257760], [None, None, 4265344, 4257920], [None, None, 4265504, 4258080], [None, None, 4265648, 4258240], [None, 4259648, 4265792, None], [4259488, 4259808, None, None], [4259648, 4259968, None, None], [4259808, 4260128, None, None], [4259968, None, 4265952, None], [None, 4260448, 4266112, None], [4260288, 4260592, None, None], [4260448, 4260752, None, None], [4260592, 4260912, None, None], [4260752, 4261072, None, None], [4260912, 4261232, None, None], [4261072, 4261392, None, None], [4261232, 4261552, None, None], [4261392, 4261712, None, None], [4261552, 4261872, None, None], [4261712, 4262032, None, None], [4261872, 4262176, None, None], [4262032, 4262320, None, None], [4262176, 4262480, None, None], [4262320, 4262640, None, None], [4262480, 4262800, None, None], [4262640, 4262960, None, None], [4262800, 4263120, None, None], [4262960, 4263280, None, None], [4263120, 4263440, None, None], [4263280, 4263600, None, None], [4263440, None, 4266272, None], [None, None, 4268496, 4258400], [None, None, 4268656, 4258544], [None, 4264240, None, 4258704], [4264080, 4264400, None, None], [4264240, 4264560, None, None], [4264400, 4264720, None, None], [4264560, 4264880, None, None], [4264720, 4265040, None, None], [4264880, 4265200, None, None], [4265040, None, None, 4258864], [None, None, 4268816, 4259024], [None, None, 4268976, 4259184], [None, None, 4269136, 4259344], [None, None, 4269296, 4259488], [None, None, 4269456, 4260128], [None, None, 4269616, 4260288], [None, 4266432, None, 4263600], [4266272, 4266592, None, None], [4266432, 4266752, None, None], [4266592, 4266912, None, None], [4266752, 4267072, None, None], [4266912, 4267232, None, None], [4267072, 4267392, None, None], [4267232, 4267552, None, None], [4267392, 4267712, None, None], [4267552, 4267872, None, None], [4267712, 4268032, None, None], [4267872, 4268192, None, None], [4268032, 4268352, None, None], [4268192, 4268496, None, None], [4268352, None, None, 4263760], [None, None, 4269760, 4263920], [None, None, 4272288, 4265344], [None, None, 4272448, 4265504], [None, None, 4272608, 4265648], [None, None, 4273392, 4265792], [None, None, 4273552, 4265952], [None, None, 4273696, 4266112], [None, 4269920, None, 4268656], [4269760, 4270080, None, None], [4269920, 4270240, None, None], [4270080, 4270400, None, None], [4270240, 4270560, None, None], [4270400, 4270720, None, None], [4270560, 4270880, None, None], [4270720, 4271040, None, None], [4270880, 4271184, None, None], [4271040, 4271328, None, None], [4271184, 4271488, None, None], [4271328, 4271648, None, None], [4271488, 4271808, None, None], [4271648, 4271968, None, None], [4271808, 4272128, None, None], [4271968, 4272288, None, None], [4272128, None, None, 4268816], [None, None, 4274480, 4268976], [None, 4272768, None, 4269136], [4272608, 4272928, None, None], [4272768, 4273088, None, None], [4272928, 4273248, None, None], [4273088, 4273392, None, None], [4273248, None, None, 4269296], [None, None, 4274640, 4269456], [None, None, 4274800, 4269616], [None, 4274000, 4277808, None], [4273840, 4274160, None, None], [4274000, 4274320, None, None], [4274160, None, 4277968, None], [None, None, 4284896, 4272448], [None, None, 4286496, 4273552], [None, 4274960, None, 4273696], [4274800, 4275120, None, None], [4274960, 4275280, None, None], [4275120, 4275440, None, None], [4275280, 4275584, None, None], [4275440, 4275744, None, None], [4275584, 4275904, None, None], [4275744, 4276064, None, None], [4275904, 4276208, None, None], [4276064, 4276368, None, None], [4276208, 4276528, None, None], [4276368, 4276688, None, None], [4276528, 4276848, None, None], [4276688, 4277008, None, None], [4276848, 4277168, None, None], [4277008, 4277328, None, None], [4277168, 4277488, None, None], [4277328, 4277648, None, None], [4277488, 4277808, None, None], [4277648, None, None, 4273840], [None, 4278128, None, 4274320], [4277968, 4278288, None, None], [4278128, 4278448, None, None], [4278288, 4278608, None, None], [4278448, 4278768, None, None], [4278608, 4278928, None, None], [4278768, 4279072, None, None], [4278928, 4279216, None, None], [4279072, 4279376, None, None], [4279216, 4279536, None, None], [4279376, 4279696, None, None], [4279536, 4279840, None, None], [4279696, 4280000, None, None], [4279840, 4280160, None, None], [4280000, 4280304, None, None], [4280160, 4280464, None, None], [4280304, 4280624, None, None], [4280464, 4280784, None, None], [4280624, 4280944, None, None], [4280784, 4281088, None, None], [4280944, 4281248, None, None], [4281088, 4281408, None, None], [4281248, 4281568, None, None], [4281408, 4281728, None, None], [4281568, 4281888, None, None], [4281728, 4282048, None, None], [4281888, 4282208, None, None], [4282048, 4282352, None, None], [4282208, 4282512, None, None], [4282352, 4282656, None, None], [4282512, 4282816, None, None], [4282656, 4282976, None, None], [4282816, 4283136, None, None], [4282976, 4283296, None, None], [4283136, 4283456, None, None], [4283296, 4283616, None, None], [4283456, 4283776, None, None], [4283616, 4283936, None, None], [4283776, 4284096, None, None], [4283936, 4284256, None, None], [4284096, 4284416, None, None], [4284256, 4284576, None, None], [4284416, 4284736, None, None], [4284576, 4284896, None, None], [4284736, None, None, 4274480], [None, 4285216, 4286656, None], [4285056, 4285376, None, None], [4285216, 4285536, None, None], [4285376, 4285696, None, None], [4285536, 4285856, None, None], [4285696, 4286016, None, None], [4285856, 4286176, None, None], [4286016, 4286336, None, None], [4286176, 4286496, None, None], [4286336, None, None, 4274640], [None, None, 4296976, 4285056], [None, 4286976, 4297136, None], [4286816, 4287120, None, None], [4286976, 4287264, None, None], [4287120, 4287424, None, None], [4287264, 4287584, None, None], [4287424, 4287744, None, None], [4287584, 4287904, None, None], [4287744, 4288064, None, None], [4287904, 4288224, None, None], [4288064, 4288384, None, None], [4288224, 4288528, None, None], [4288384, 4288688, None, None], [4288528, 4288848, None, None], [4288688, 4288992, None, None], [4288848, 4289152, None, None], [4288992, 4289312, None, None], [4289152, 4289472, None, None], [4289312, 4289632, None, None], [4289472, 4289792, None, None], [4289632, 4289952, None, None], [4289792, 4290112, None, None], [4289952, 4290272, None, None], [4290112, 4290432, None, None], [4290272, 4290592, None, None], [4290432, 4290752, None, None], [4290592, 4290912, None, None], [4290752, 4291072, None, None], [4290912, 4291232, None, None], [4291072, 4291376, None, None], [4291232, 4291536, None, None], [4291376, 4291696, None, None], [4291536, 4291856, None, None], [4291696, 4292000, None, None], [4291856, 4292144, None, None], [4292000, 4292288, None, None], [4292144, 4292448, None, None], [4292288, 4292608, None, None], [4292448, 4292768, None, None], [4292608, 4292928, None, None], [4292768, 4293088, None, None], [4292928, 4293248, None, None], [4293088, 4293392, None, None], [4293248, 4293552, None, None], [4293392, 4293696, None, None], [4293552, 4293856, None, None], [4293696, 4294016, None, None], [4293856, 4294160, None, None], [4294016, 4294320, None, None], [4294160, 4294480, 4297296, None], [4294320, 4294640, None, None], [4294480, 4294800, None, None], [4294640, 4294944, None, None], [4294800, 4295088, None, None], [4294944, 4295232, None, None], [4295088, 4295392, None, None], [4295232, 4295552, None, None], [4295392, 4295696, None, None], [4295552, 4295856, None, None], [4295696, 4296016, None, None], [4295856, 4296176, None, None], [4296016, 4296336, None, None], [4296176, 4296496, None, None], [4296336, 4296656, None, None], [4296496, 4296816, None, None], [4296656, None, 4297424, None], [None, None, 4297584, 4286656], [None, None, 4297744, 4286816], [None, None, 4297904, 4294320], [None, None, 4299472, 4296816], [None, None, 4300720, 4296976], [None, None, 4302288, 4297136], [None, None, 4308576, 4297296], [None, 4298224, 4308720, None], [4298064, 4298384, None, None], [4298224, 4298528, None, None], [4298384, 4298688, None, None], [4298528, 4298848, None, None], [4298688, 4299008, None, None], [4298848, 4299168, None, None], [4299008, 4299312, None, None], [4299168, 4299472, None, None], [4299312, 4299632, None, 4297424], [4299472, 4299792, None, None], [4299632, 4299936, None, None], [4299792, 4300096, None, None], [4299936, 4300256, None, None], [4300096, 4300416, None, None], [4300256, 4300576, None, None], [4300416, None, None, None], [None, 4300864, None, 4297584], [4300720, 4301024, None, None], [4300864, 4301184, None, None], [4301024, 4301344, None, None], [4301184, 4301504, None, None], [4301344, 4301648, None, None], [4301504, 4301808, None, None], [4301648, 4301968, None, None], [4301808, 4302128, None, None], [4301968, 4302288, None, None], [4302128, 4302448, None, 4297744], [4302288, 4302608, None, None], [4302448, 4302768, None, None], [4302608, 4302912, None, None], [4302768, 4303072, None, None], [4302912, 4303232, None, None], [4303072, 4303392, None, None], [4303232, 4303552, None, None], [4303392, 4303712, None, None], [4303552, 4303872, None, None], [4303712, 4304032, None, None], [4303872, 4304192, None, None], [4304032, 4304352, None, None], [4304192, 4304496, None, None], [4304352, 4304656, None, None], [4304496, 4304816, None, None], [4304656, 4304976, None, None], [4304816, 4305136, None, None], [4304976, 4305296, None, None], [4305136, 4305456, None, None], [4305296, 4305616, None, None], [4305456, 4305776, None, None], [4305616, 4305936, None, None], [4305776, 4306096, None, None], [4305936, 4306256, None, None], [4306096, 4306400, None, None], [4306256, 4306560, None, None], [4306400, 4306720, None, None], [4306560, 4306880, None, None], [4306720, 4307024, None, None], [4306880, 4307184, None, None], [4307024, 4307344, None, None], [4307184, 4307504, None, None], [4307344, 4307664, None, None], [4307504, 4307808, None, None], [4307664, 4307968, None, None], [4307808, 4308128, None, None], [4307968, 4308288, None, None], [4308128, 4308448, None, None], [4308288, None, None, None], [None, None, 4308880, 4297904], [None, None, 4309040, 4298064], [None, None, 4311264, 4308576], [None, None, 4311888, 4308720], [None, 4309360, 4312336, None], [4309200, 4309520, 4312496, None], [4309360, None, 4312624, None], [None, None, 4313872, None], [None, 4309984, 4315312, None], [4309824, None, 4315472, None], [None, 4310304, 4316112, None], [4310144, 4310464, 4316272, None], [4310304, 4310624, 4316432, None], [4310464, 4310784, 4316592, None], [4310624, 4310944, 4316736, None], [4310784, 4311104, 4316896, None], [4310944, None, 4317024, None], [None, 4311424, 4317664, 4308880], [4311264, 4311584, 4317824, None], [4311424, 4311744, 4317984, None], [4311584, None, 4318112, None], [None, None, 4318752, 4309040], [None, 4312176, None, None], [4312048, 4312336, 4318896, None], [4312176, 4312496, None, 4309200], [4312336, 4312624, None, 4309360], [4312496, 4312784, None, 4309520], [4312624, 4312928, None, None], [4312784, 4313088, None, None], [4312928, 4313248, None, None], [4313088, 4313408, None, None], [4313248, 4313568, None, None], [4313408, 4313712, None, None], [4313568, 4313872, 4319056, None], [4313712, 4314032, None, 4309680], [4313872, 4314192, 4319200, None], [4314032, 4314352, None, None], [4314192, 4314512, None, None], [4314352, 4314672, None, None], [4314512, 4314832, None, None], [4314672, 4314992, None, None], [4314832, 4315152, None, None], [4314992, 4315312, 4319328, None], [4315152, 4315472, None, 4309824], [4315312, 4315632, None, 4309984], [4315472, 4315792, 4319472, None], [4315632, 4315952, None, None], [4315792, 4316112, None, None], [4315952, 4316272, None, 4310144], [4316112, 4316432, None, 4310304], [4316272, 4316592, None, 4310464], [4316432, 4316736, 4319616, 4310624], [4316592, 4316896, None, 4310784], [4316736, 4317024, None, 4310944], [4316896, 4317184, None, 4311104], [4317024, 4317344, None, None], [4317184, 4317504, None, None], [4317344, 4317664, 4319760, None], [4317504, 4317824, None, 4311264], [4317664, 4317984, None, 4311424], [4317824, 4318112, None, 4311584], [4317984, 4318272, None, 4311744], [4318112, 4318432, None, None], [4318272, 4318592, None, None], [4318432, 4318752, None, None], [4318592, None, None, 4311888], [None, None, 4319920, 4312176], [None, None, None, 4313712], [None, None, None, 4314032], [None, None, None, 4315152], [None, None, None, 4315632], [None, None, 4320080, 4316592], [None, None, 4320240, 4317504], [None, None, 4321472, 4318896], [None, None, 4321600, 4319616], [None, 4320400, 4321760, 4319760], [4320240, 4320560, None, None], [4320400, 4320720, None, None], [4320560, 4320880, None, None], [4320720, 4321024, None, None], [4320880, 4321184, None, None], [4321024, 4321344, None, None], [4321184, None, None, None], [None, None, None, 4319920], [None, None, 4321904, 4320080], [None, None, None, 4320240], [None, None, None, 4321600]]
func_list = [4198480, 4198624, 4198784, 4198944, 4199104, 4199264, 4199424, 4199584, 4199744, 4199904, 4200064, 4200224, 4200384, 4200544, 4200688, 4200848, 4201008, 4201168, 4201312, 4201456, 4201616, 4201776, 4201936, 4202096, 4202240, 4202384, 4202544, 4202704, 4202848, 4203008, 4203168, 4203328, 4203488, 4203648, 4203808, 4203968, 4204128, 4204272, 4204432, 4204592, 4204752, 4204912, 4205056, 4205216, 4205376, 4205536, 4205680, 4205824, 4205984, 4206144, 4206304, 4206448, 4206608, 4206768, 4206928, 4207088, 4207232, 4207392, 4207552, 4207712, 4207872, 4208032, 4208192, 4208352, 4208496, 4208656, 4208816, 4208960, 4209120, 4209280, 4209440, 4209600, 4209760, 4209904, 4210064, 4210224, 4210368, 4210528, 4210688, 4210832, 4210992, 4211152, 4211312, 4211472, 4211632, 4211792, 4211952, 4212112, 4212272, 4212432, 4212592, 4212752, 4212912, 4213072, 4213232, 4213392, 4213552, 4213696, 4213856, 4214016, 4214176, 4214320, 4214480, 4214640, 4214800, 4214960, 4215120, 4215280, 4215440, 4215584, 4215744, 4215904, 4216064, 4216208, 4216352, 4216512, 4216672, 4216832, 4216992, 4217136, 4217296, 4217440, 4217600, 4217760, 4217920, 4218080, 4218240, 4218400, 4218560, 4218720, 4218880, 4219040, 4219200, 4219360, 4219520, 4219680, 4219840, 4219984, 4220144, 4220304, 4220464, 4220608, 4220768, 4220928, 4221088, 4221232, 4221392, 4221552, 4221712, 4221872, 4222032, 4222192, 4222352, 4222496, 4222640, 4222800, 4222928, 4223088, 4223248, 4223408, 4223568, 4223712, 4223856, 4224016, 4224176, 4224336, 4224496, 4224656, 4224816, 4224976, 4225120, 4225264, 4225424, 4225584, 4225744, 4225888, 4226048, 4226208, 4226368, 4226528, 4226688, 4226848, 4227008, 4227168, 4227328, 4227488, 4227648, 4227808, 4227968, 4228112, 4228272, 4228416, 4228576, 4228736, 4228896, 4229056, 4229216, 4229376, 4229520, 4229680, 4229840, 4229984, 4230144, 4230288, 4230448, 4230608, 4230768, 4230928, 4231088, 4231248, 4231408, 4231568, 4231728, 4231888, 4232048, 4232208, 4232368, 4232528, 4232672, 4232832, 4232992, 4233152, 4233312, 4233472, 4233616, 4233776, 4233920, 4234080, 4234240, 4234400, 4234560, 4234720, 4234880, 4235040, 4235200, 4235328, 4235488, 4235632, 4235792, 4235952, 4236112, 4236272, 4236432, 4236576, 4236736, 4236896, 4237056, 4237216, 4237376, 4237520, 4237664, 4237824, 4237984, 4238144, 4238304, 4238464, 4238624, 4238784, 4238944, 4239104, 4239264, 4239424, 4239584, 4239744, 4239904, 4240064, 4240224, 4240368, 4240528, 4240688, 4240848, 4241008, 4241168, 4241312, 4241456, 4241616, 4241776, 4241936, 4242096, 4242256, 4242416, 4242576, 4242736, 4242896, 4243040, 4243200, 4243360, 4243504, 4243664, 4243824, 4243984, 4244144, 4244288, 4244448, 4244608, 4244768, 4244928, 4245072, 4245232, 4245392, 4245536, 4245696, 4245840, 4246000, 4246160, 4246320, 4246480, 4246640, 4246800, 4246960, 4247120, 4247280, 4247440, 4247600, 4247744, 4247904, 4248064, 4248224, 4248384, 4248544, 4248704, 4248864, 4249024, 4249184, 4249344, 4249504, 4249664, 4249824, 4249984, 4250144, 4250304, 4250464, 4250624, 4250784, 4250944, 4251088, 4251248, 4251408, 4251568, 4251712, 4251872, 4252032, 4252192, 4252336, 4252496, 4252656, 4252816, 4252976, 4253136, 4253296, 4253456, 4253616, 4253776, 4253936, 4254096, 4254240, 4254400, 4254544, 4254704, 4254848, 4255008, 4255152, 4255312, 4255472, 4255616, 4255776, 4255936, 4256080, 4256240, 4256400, 4256560, 4256704, 4256848, 4257008, 4257152, 4257312, 4257472, 4257632, 4257760, 4257920, 4258080, 4258240, 4258400, 4258544, 4258704, 4258864, 4259024, 4259184, 4259344, 4259488, 4259648, 4259808, 4259968, 4260128, 4260288, 4260448, 4260592, 4260752, 4260912, 4261072, 4261232, 4261392, 4261552, 4261712, 4261872, 4262032, 4262176, 4262320, 4262480, 4262640, 4262800, 4262960, 4263120, 4263280, 4263440, 4263600, 4263760, 4263920, 4264080, 4264240, 4264400, 4264560, 4264720, 4264880, 4265040, 4265200, 4265344, 4265504, 4265648, 4265792, 4265952, 4266112, 4266272, 4266432, 4266592, 4266752, 4266912, 4267072, 4267232, 4267392, 4267552, 4267712, 4267872, 4268032, 4268192, 4268352, 4268496, 4268656, 4268816, 4268976, 4269136, 4269296, 4269456, 4269616, 4269760, 4269920, 4270080, 4270240, 4270400, 4270560, 4270720, 4270880, 4271040, 4271184, 4271328, 4271488, 4271648, 4271808, 4271968, 4272128, 4272288, 4272448, 4272608, 4272768, 4272928, 4273088, 4273248, 4273392, 4273552, 4273696, 4273840, 4274000, 4274160, 4274320, 4274480, 4274640, 4274800, 4274960, 4275120, 4275280, 4275440, 4275584, 4275744, 4275904, 4276064, 4276208, 4276368, 4276528, 4276688, 4276848, 4277008, 4277168, 4277328, 4277488, 4277648, 4277808, 4277968, 4278128, 4278288, 4278448, 4278608, 4278768, 4278928, 4279072, 4279216, 4279376, 4279536, 4279696, 4279840, 4280000, 4280160, 4280304, 4280464, 4280624, 4280784, 4280944, 4281088, 4281248, 4281408, 4281568, 4281728, 4281888, 4282048, 4282208, 4282352, 4282512, 4282656, 4282816, 4282976, 4283136, 4283296, 4283456, 4283616, 4283776, 4283936, 4284096, 4284256, 4284416, 4284576, 4284736, 4284896, 4285056, 4285216, 4285376, 4285536, 4285696, 4285856, 4286016, 4286176, 4286336, 4286496, 4286656, 4286816, 4286976, 4287120, 4287264, 4287424, 4287584, 4287744, 4287904, 4288064, 4288224, 4288384, 4288528, 4288688, 4288848, 4288992, 4289152, 4289312, 4289472, 4289632, 4289792, 4289952, 4290112, 4290272, 4290432, 4290592, 4290752, 4290912, 4291072, 4291232, 4291376, 4291536, 4291696, 4291856, 4292000, 4292144, 4292288, 4292448, 4292608, 4292768, 4292928, 4293088, 4293248, 4293392, 4293552, 4293696, 4293856, 4294016, 4294160, 4294320, 4294480, 4294640, 4294800, 4294944, 4295088, 4295232, 4295392, 4295552, 4295696, 4295856, 4296016, 4296176, 4296336, 4296496, 4296656, 4296816, 4296976, 4297136, 4297296, 4297424, 4297584, 4297744, 4297904, 4298064, 4298224, 4298384, 4298528, 4298688, 4298848, 4299008, 4299168, 4299312, 4299472, 4299632, 4299792, 4299936, 4300096, 4300256, 4300416, 4300576, 4300720, 4300864, 4301024, 4301184, 4301344, 4301504, 4301648, 4301808, 4301968, 4302128, 4302288, 4302448, 4302608, 4302768, 4302912, 4303072, 4303232, 4303392, 4303552, 4303712, 4303872, 4304032, 4304192, 4304352, 4304496, 4304656, 4304816, 4304976, 4305136, 4305296, 4305456, 4305616, 4305776, 4305936, 4306096, 4306256, 4306400, 4306560, 4306720, 4306880, 4307024, 4307184, 4307344, 4307504, 4307664, 4307808, 4307968, 4308128, 4308288, 4308448, 4308576, 4308720, 4308880, 4309040, 4309200, 4309360, 4309520, 4309680, 4309824, 4309984, 4310144, 4310304, 4310464, 4310624, 4310784, 4310944, 4311104, 4311264, 4311424, 4311584, 4311744, 4311888, 4312048, 4312176, 4312336, 4312496, 4312624, 4312784, 4312928, 4313088, 4313248, 4313408, 4313568, 4313712, 4313872, 4314032, 4314192, 4314352, 4314512, 4314672, 4314832, 4314992, 4315152, 4315312, 4315472, 4315632, 4315792, 4315952, 4316112, 4316272, 4316432, 4316592, 4316736, 4316896, 4317024, 4317184, 4317344, 4317504, 4317664, 4317824, 4317984, 4318112, 4318272, 4318432, 4318592, 4318752, 4318896, 4319056, 4319200, 4319328, 4319472, 4319616, 4319760, 4319920, 4320080, 4320240, 4320400, 4320560, 4320720, 4320880, 4321024, 4321184, 4321344, 4321472, 4321600, 4321760, 4321904]
src_node = 0x401050 # 起点
target_node = 0x41F1E0 # 终点
G = nx.MultiDiGraph() # 生成一张空图，Mul允许2个节点之间存在多个边，Di代表边是有方向的
for i in func_list:
G.add_node(i) # 添加节点
for i, value in enumerate(all_edges):
src = func_list[i]
for j in value:
if j != None: # 不为None,就可以构造一条边
dst = j
G.add_edge(src, dst)
path = nx.shortest_path(G, source = src_node, target = target_node) # 直接调用此函数就可以求出最短路径经过的那几个节点
print(len(path))
print([hex(i) for i in path])
s = ""
for i in range(1, len(path)): # 根据得到的结果来求出每一步走的方向
func_index = func_list.index(path[i - 1])
index = all_edges[func_index].index(path[i])
if index == 0:
s += 'a'
elif index == 1:
s += 'd'
elif index == 2:
s += 's'
else:
s += 'w'
# 成功的地方在41F1E0处
# case 's':
# result = printf("Great!!!you got it!flag is DASCTF{md5{your input}\n");
# break;
input_ = s + 's'
print(input_)
# DASCTF{md5{your input}\n")
print("DASCTF{%s}" % hashlib.md5(input_.encode()).hexdigest())、
输出
496
['0x401050', '0x4010e0', '0x401180', '0x403460', '0x403500', '0x4035a0', '0x403640', '0x4036e0', '0x403770', '0x403810', '0x4038b0', '0x403940', '0x4039e0', '0x403a80', '0x403b20', '0x403bc0', '0x403c60', '0x403cf0', '0x403d90', '0x403e30', '0x403ec0', '0x403f60', '0x404630', '0x405e20', '0x406450', '0x406eb0', '0x408060', '0x4087c0', '0x4097c0', '0x40a520', '0x40b490', '0x40b970', '0x40ba10', '0x40bab0', '0x40bb50', '0x40bbf0', '0x40bc90', '0x40bd30', '0x40bdd0', '0x40be60', '0x40bf00', '0x40bfa0', '0x40c030', '0x40c0d0', '0x40c170', '0x40c210', '0x40c2b0', '0x40c340', '0x40c3e0', '0x40c480', '0x40c520', '0x40c5c0', '0x40c650', '0x40c6f0', '0x40c790', '0x40c820', '0x40c8c0', '0x40c950', '0x40c9f0', '0x40ca90', '0x40cb30', '0x40cbd0', '0x40cc70', '0x40b530', '0x40ae60', '0x409990', '0x408f10', '0x408240', '0x407990', '0x4078f0', '0x407860', '0x4077d0', '0x407730', '0x407690', '0x4075f0', '0x407550', '0x4074b0', '0x407410', '0x4081a0', '0x408ad0', '0x408b60', '0x408c00', '0x408c90', '0x408d30', '0x408dd0', '0x408e70', '0x409900', '0x40adc0', '0x40ad20', '0x40ac80', '0x40abe0', '0x40ab40', '0x40aaa0', '0x40aa00', '0x40a960', '0x40a8d0', '0x40a840', '0x40a7a0', '0x40a700', '0x40a660', '0x40a5c0', '0x409860', '0x408860', '0x408900', '0x408990', '0x408a30', '0x408100', '0x407370', '0x406590', '0x405f60', '0x404770', '0x404810', '0x4048b0', '0x404950', '0x4049f0', '0x404a90', '0x404b30', '0x404bc0', '0x404c60', '0x404d00', '0x404da0', '0x404e30', '0x404ed0', '0x404f70', '0x405010', '0x4050b0', '0x405150', '0x4051f0', '0x405290', '0x405320', '0x4053c0', '0x405460', '0x405500', '0x405590', '0x405620', '0x4056c0', '0x405760', '0x406000', '0x406630', '0x407a30', '0x4082e0', '0x408fb0', '0x409a30', '0x40af00', '0x40b5d0', '0x40cd10', '0x40d200', '0x40f620', '0x40faf0', '0x410ff0', '0x412270', '0x4126c0', '0x412760', '0x412800', '0x4128a0', '0x412940', '0x4129e0', '0x412a80', '0x412b20', '0x412bc0', '0x412c50', '0x412ce0', '0x412d80', '0x412e20', '0x412ec0', '0x412f60', '0x413000', '0x4130a0', '0x412310', '0x411580', '0x40fcd0', '0x40f880', '0x40d480', '0x40cf90', '0x40b830', '0x40b180', '0x409ca0', '0x409410', '0x408410', '0x407b60', '0x406bb0', '0x406b10', '0x406a70', '0x4069d0', '0x406930', '0x4068a0', '0x406800', '0x406760', '0x406140', '0x4058a0', '0x404450', '0x402c70', '0x402d00', '0x402da0', '0x402e40', '0x402ee0', '0x402f70', '0x403010', '0x4030b0', '0x403150', '0x4031f0', '0x403280', '0x403320', '0x4033c0', '0x4044f0', '0x405930', '0x4061e0', '0x406c50', '0x407c00', '0x4084b0', '0x408540', '0x4094b0', '0x409550', '0x409d40', '0x409de0', '0x40b220', '0x40b8d0', '0x40d160', '0x40d0c0', '0x40d660', '0x40d5c0', '0x40d520', '0x40f920', '0x40fd70', '0x411620', '0x4123b0', '0x413140', '0x413930', '0x4161e0', '0x416140', '0x4160a0', '0x416000', '0x415f60', '0x415ec0', '0x415e20', '0x415d80', '0x415ce0', '0x415c40', '0x415ba0', '0x415b00', '0x415a60', '0x4159c0', '0x415920', '0x415890', '0x4157f0', '0x415760', '0x4156c0', '0x415620', '0x415580', '0x4154e0', '0x415440', '0x4153a0', '0x415300', '0x415270', '0x4151d0', '0x415130', '0x415090', '0x414ff0', '0x414f60', '0x414ec0', '0x414e20', '0x414d90', '0x414cf0', '0x414c50', '0x414bb0', '0x414b20', '0x414a90', '0x4149f0', '0x414950', '0x4148b0', '0x414810', '0x414770', '0x4146d0', '0x413890', '0x4137f0', '0x413750', '0x4136b0', '0x414630', '0x414590', '0x4144f0', '0x414450', '0x4143b0', '0x414310', '0x414270', '0x4141d0', '0x414130', '0x414090', '0x413ff0', '0x413f60', '0x413ec0', '0x413e20', '0x413d80', '0x413cf0', '0x413c50', '0x413bb0', '0x413b10', '0x413a70', '0x413620', '0x412630', '0x411880', '0x4101c0', '0x410260', '0x4102f0', '0x410390', '0x410430', '0x4104d0', '0x410570', '0x410610', '0x4106b0', '0x410750', '0x4107f0', '0x410890', '0x410920', '0x4109b0', '0x410a50', '0x410af0', '0x410b90', '0x410c30', '0x410cd0', '0x410d70', '0x410e10', '0x410eb0', '0x411920', '0x4119c0', '0x411a60', '0x411b00', '0x411ba0', '0x411c40', '0x411ce0', '0x411d80', '0x411e20', '0x411ec0', '0x411f60', '0x412000', '0x4120a0', '0x412140', '0x4121d0', '0x410f50', '0x40fa60', '0x40f580', '0x40f4f0', '0x40f450', '0x40f3c0', '0x40f330', '0x40f290', '0x40f1f0', '0x40f150', '0x40f0c0', '0x40f020', '0x40ef80', '0x40eef0', '0x40ee50', '0x40edb0', '0x40ed20', '0x40ec80', '0x40ebf0', '0x40eb50', '0x40eac0', '0x40ea20', '0x40e990', '0x40e8f0', '0x40e850', '0x40e7b0', '0x40e710', '0x40e670', '0x40e5d0', '0x40e530', '0x40e490', '0x40e3f0', '0x40e350', '0x40e2b0', '0x40e220', '0x40e180', '0x40e0e0', '0x40e040', '0x40dfb0', '0x40df10', '0x40de70', '0x40ddd0', '0x40dd40', '0x40dca0', '0x40dc00', '0x40db60', '0x40dac0', '0x40da20', '0x40d980', '0x40d8e0', '0x40d840', '0x40d7a0', '0x40d700', '0x40f9c0', '0x40fe10', '0x4116b0', '0x412450', '0x4131e0', '0x413280', '0x413320', '0x4133c0', '0x413460', '0x4134f0', '0x4124f0', '0x411740', '0x40fea0', '0x40ff40', '0x40ffe0', '0x410080', '0x410120', '0x4117e0', '0x412590', '0x413590', '0x4139d0', '0x416820', '0x416780', '0x4166e0', '0x416640', '0x4165a0', '0x416500', '0x416460', '0x4163c0', '0x416320', '0x416280', '0x4168c0', '0x419110', '0x419370', '0x419fb0', '0x41a040', '0x41a0e0', '0x41a180', '0x41a220', '0x41a2c0', '0x41a350', '0x41a3f0', '0x41a490', '0x41a530', '0x41a5d0', '0x419410', '0x4191b0', '0x416960', '0x416a00', '0x416a90', '0x416b20', '0x416bc0', '0x416c60', '0x416d00', '0x416da0', '0x416e40', '0x416ee0', '0x416f80', '0x417010', '0x4170b0', '0x417150', '0x4171e0', '0x417280', '0x417320', '0x4173c0', '0x417460', '0x417500', '0x4175a0', '0x417640', '0x4176e0', '0x417780', '0x417820', '0x4178c0', '0x417960', '0x417a00', '0x417aa0', '0x417b30', '0x417bd0', '0x417c70', '0x417d10', '0x417da0', '0x417e30', '0x417ec0', '0x417f60', '0x418000', '0x4180a0', '0x418140', '0x4181e0', '0x418280', '0x418310', '0x4183b0', '0x418440', '0x4184e0', '0x418580', '0x418610', '0x4186b0', '0x419250', '0x4194b0', '0x41be60', '0x41bf90', '0x41c8e0', '0x41e1e0', '0x41e140', '0x41ea10', '0x41ebf0', '0x41f1e0']
dssddddddddddddddddddssssssssssdddddddddddddddddddddddddddddddwwwwwwaaaaaaaaassddddddssaaaaaaaaaaaaawwdddwwwwwddddddddddddddddddddddddddsssssssssssssssddddddddddddddddwwwwwwwwwwwwwaaaaaaawwwwddddddddddddssssssdsdsdsssasaasssssssaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaawaaasaaaaaaaaaaaaaaaaaaawwwwdddddddddddddddddddddsddddddddddddddwwwaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaasssssdddddwwwddddsssssaaaaaaaaassssddddddddddwwwddddddddddddddddddddddddddddddddddddddddddddddddssssssassss
DASCTF{0a80fbe4b623aa3c09173ecf9147601e}
对于networkx的学习，可以参考此文档 https://www.osgeo.cn/networkx/tutorial.html
对于求最短路径来说，基本就是
- 创建合适的图
- 添加节点，添加边
- 调用shortest_path，求出最短路径，这里求出的是经过的节点
- 然后再根据具体题目要求，根据经过的节点，把操作的步骤打印出来即可
IDAAAAAA
分析
此题为今年L3HCTF的一道re题，题目仅给了一个i64文件，没有给可执行文件，IDA打开分析
sub_401E97函数返回1，则正确, 进入此函数发现有5个方程，用z3解
发现无解
再次观察，发现这里有个断点，来到断点窗口
发现是个条件断点，将conditon的数据复制出来
global jIS40A
jIS40A = [xxx, xxx, xxx。。。。] # 很长的密文 是个列表，长度是1000
N4QKUt = 0
EpUdLx = 4728923 # 0x048285B
idaapi.add_bpt(EpUdLx) # 0x048285B
uwGgnM = idaapi.bpt_t()
idaapi.get_bpt(EpUdLx, uwGgnM)
uwGgnM.elang = "Python"
uwGgnM.condition = "N4QKUt = {}\n".format(N4QKUt) + 'VLzxDy = idaapi.get_byte(5127584 + N4QKUt)\nVLzxDy -= ord(\'a\')\nif VLzxDy == 0:\n bYsMTa = 287\n LjzrdT = b\'lqAT7pNI3BX\'\nelif VLzxDy == 1:\n bYsMTa = 96\n LjzrdT = b\'z3Uhis74aPq\'\nelif VLzxDy == 2:\n bYsMTa = 8\n LjzrdT = b\'9tjseMGBHR5\'\nelif VLzxDy == 3:\n bYsMTa = 777\n LjzrdT = b\'FhnvgMQjexH\'\nelif VLzxDy == 4:\n bYsMTa = 496\n LjzrdT = b\'SKnZ51f9WsE\'\nelif VLzxDy == 5:\n bYsMTa = 822\n LjzrdT = b\'gDJy104BSHW\'\nelif VLzxDy == 6:\n bYsMTa = 914\n LjzrdT = b\'PbRV4rSM7fd\'\nelif VLzxDy == 7:\n bYsMTa = 550\n LjzrdT = b\'WHPnoMTsbx3\'\nelif VLzxDy == 8:\n bYsMTa = 273\n LjzrdT = b\'mLx5hvlqufG\'\nelif VLzxDy == 9:\n bYsMTa = 259\n LjzrdT = b\'QvKgNmUFTnW\'\nelif VLzxDy == 10:\n bYsMTa = 334\n LjzrdT = b\'TCrHaitRfY1\'\nelif VLzxDy == 11:\n bYsMTa = 966\n LjzrdT = b\'m26IAvjq1zC\'\nelif VLzxDy == 12:\n bYsMTa = 331\n LjzrdT = b\'dQb2ufTZwLX\'\nelif VLzxDy == 13:\n bYsMTa = 680\n LjzrdT = b\'Y6Sr7znOeHL\'\nelif VLzxDy == 14:\n bYsMTa = 374\n LjzrdT = b\'hLFj1wl5A0U\'\nelif VLzxDy == 15:\n bYsMTa = 717\n LjzrdT = b\'H6W03R7TLFe\'\nelif VLzxDy == 16:\n bYsMTa = 965\n LjzrdT = b\'fphoJwDKsTv\'\nelif VLzxDy == 17:\n bYsMTa = 952\n LjzrdT = b\'CMF1Vk7NH4O\'\nelif VLzxDy == 18:\n bYsMTa = 222\n LjzrdT = b\'43PSbAlgLqj\'\nelse:\n bYsMTa = -1\nif bYsMTa < 0:\n cpu.rsp -= 8\n cpu.rdi = 4927649\n cpu.rax = 0\n idaapi.patch_qword(cpu.rsp, 4202616)\n idaapi.del_bpt(cpu.rip)\n cpu.rip = 4263680\nelse:\n zaqhdD = 0x486195\n bYsMTa = jIS40A[bYsMTa]\n\n idaapi.patch_bytes(5117568, bYsMTa)\n idaapi.patch_bytes(5117488, LjzrdT)\n\n cpu.rsp -= 8\n idaapi.patch_qword(cpu.rsp, zaqhdD)\n cpu.rdi = 5117568\n cpu.rsi = len(bYsMTa)\n cpu.rdx = 5117488\n cpu.rcx = 11\n cpu.r8 = 5117568\n cpu.rax = 5117568\n\n idaapi.add_bpt(zaqhdD)\n jQfwUA = idaapi.bpt_t()\n idaapi.get_bpt(zaqhdD, jQfwUA)\n jQfwUA.elang = "Python"\n jQfwUA.condition = "N4QKUt = {}\\nSdjOr3 = {}\\n".format(N4QKUt, len(bYsMTa)) + \'bYsMTa = idaapi.get_bytes(cpu.rax, SdjOr3).decode()\\nzaqhdD = 4767838\\nidaapi.add_bpt(zaqhdD)\\njQfwUA = idaapi.bpt_t()\\nidaapi.get_bpt(zaqhdD, jQfwUA)\\njQfwUA.elang = "Python"\\njQfwUA.condition = "N4QKUt = {}\\\\n".format(N4QKUt+1) + bYsMTa\\nidaapi.del_bpt(zaqhdD)\\nidaapi.add_bpt(jQfwUA)\\nidaapi.del_bpt(cpu.rip)\\ncpu.rsp -= 8\\nidaapi.patch_qword(cpu.rsp, zaqhdD)\\ncpu.rip = 4447160\\n\'\n idaapi.del_bpt(zaqhdD)\n idaapi.add_bpt(jQfwUA)\n idaapi.del_bpt(cpu.rip)\n cpu.rip = 4201909\n'
idaapi.del_bpt(EpUdLx)
idaapi.add_bpt(uwGgnM) # 改为条件断点
cpu.rsp -= 8
idaapi.patch_qword(cpu.rsp, EpUdLx) # 0x48285B
cpu.rip = 4202096 # retn -->来到刚才条件断点的位置
可以发现，大致流程为，触发0x40201F处的断点的时候，设置一个新的条件断点，跳转过去，触发新的条件断点的condition，由此可见验证flag的算法全部在这些condition中
将uwGgnM.condition 稍作整理，然后分析
N4QKUt = 0
VLzxDy = idaapi.get_byte(5127584 + N4QKUt) # 5127584(0x4e3da0) 为程序中输入的flag的地址 flag[N4QKUt]
VLzxDy -= ord('a')
if VLzxDy == 0: # 根据VLzxDy初始化2个值
bYsMTa = 287 # jIS40A的索引
LjzrdT = b'lqAT7pNI3BX' # 解密 jIS40A[bYsMTa] 的key
elif VLzxDy == 1:
bYsMTa = 96
LjzrdT = b'z3Uhis74aPq'
elif VLzxDy == 2:
bYsMTa = 8
LjzrdT = b'9tjseMGBHR5'
elif VLzxDy == 3:
bYsMTa = 777
LjzrdT = b'FhnvgMQjexH'
elif VLzxDy == 4:
bYsMTa = 496
LjzrdT = b'SKnZ51f9WsE'
elif VLzxDy == 5:
bYsMTa = 822
LjzrdT = b'gDJy104BSHW'
elif VLzxDy == 6:
bYsMTa = 914
LjzrdT = b'PbRV4rSM7fd'
elif VLzxDy == 7:
bYsMTa = 550
LjzrdT = b'WHPnoMTsbx3'
elif VLzxDy == 8:
bYsMTa = 273
LjzrdT = b'mLx5hvlqufG'
elif VLzxDy == 9:
bYsMTa = 259
LjzrdT = b'QvKgNmUFTnW'
elif VLzxDy == 10:
bYsMTa = 334
LjzrdT = b'TCrHaitRfY1'
elif VLzxDy == 11:
bYsMTa = 966
LjzrdT = b'm26IAvjq1zC'
elif VLzxDy == 12:
bYsMTa = 331
LjzrdT = b'dQb2ufTZwLX'
elif VLzxDy == 13:
bYsMTa = 680
LjzrdT = b'Y6Sr7znOeHL'
elif VLzxDy == 14:
bYsMTa = 374
LjzrdT = b'hLFj1wl5A0U'
elif VLzxDy == 15:
bYsMTa = 717
LjzrdT = b'H6W03R7TLFe'
elif VLzxDy == 16:
bYsMTa = 965
LjzrdT = b'fphoJwDKsTv'
elif VLzxDy == 17:
bYsMTa = 952
LjzrdT = b'CMF1Vk7NH4O'
elif VLzxDy == 18:
bYsMTa = 222
LjzrdT = b'43PSbAlgLqj'
else:
bYsMTa = -1
if bYsMTa < 0: # Wrong的位置
cpu.rsp -= 8
cpu.rdi = 4927649 # 0x4b30a1: "O, no" # 传递参数
cpu.rax = 0
idaapi.patch_qword(cpu.rsp, 4202616) # leave retn
idaapi.del_bpt(cpu.rip)
cpu.rip = 4263680 # 0410F00 printf("O, no")
else:
zaqhdD = 0x486195
bYsMTa = jIS40A[bYsMTa] # 从一长串密文中取出数据
idaapi.patch_bytes(5117568, bYsMTa) # 0x4e1680 # 取出的密文
idaapi.patch_bytes(5117488, LjzrdT) # 0x4e1630 # 取出的key
# rdi, rsi, rdx, rcx, r8, r9
cpu.rsp -= 8
idaapi.patch_qword(cpu.rsp, zaqhdD) # 0x486195
# 设置参数
cpu.rdi = 5117568 # 0x4e1680 # 密文地址
cpu.rsi = len(bYsMTa) # 密文长度
cpu.rdx = 5117488 # 0x4e1630 # key地址
cpu.rcx = 11 # key长度
cpu.r8 = 5117568 # 0x4e1680 # 密文地址
cpu.rax = 5117568 # 0x4e1680 # 返回值
idaapi.add_bpt(zaqhdD)
jQfwUA = idaapi.bpt_t()
idaapi.get_bpt(zaqhdD, jQfwUA)
jQfwUA.elang = "Python"
jQfwUA.condition = "N4QKUt = {}\nSdjOr3 = {}\n".format(N4QKUt, len(bYsMTa)) + 'bYsMTa = idaapi.get_bytes(cpu.rax, SdjOr3).decode()\nzaqhdD = 4767838\nidaapi.add_bpt(zaqhdD)\njQfwUA = idaapi.bpt_t()\nidaapi.get_bpt(zaqhdD, jQfwUA)\njQfwUA.elang = "Python"\njQfwUA.condition = "N4QKUt = {}\\n".format(N4QKUt+1) + bYsMTa\nidaapi.del_bpt(zaqhdD)\nidaapi.add_bpt(jQfwUA)\nidaapi.del_bpt(cpu.rip)\ncpu.rsp -= 8\nidaapi.patch_qword(cpu.rsp, zaqhdD)\ncpu.rip = 4447160\n'
idaapi.del_bpt(zaqhdD)
idaapi.add_bpt(jQfwUA)
idaapi.del_bpt(cpu.rip)
cpu.rip = 4201909 #0x401db5 # 5个参数 先执行解密，然后再->0x486195(因为上面已经把cpu.esp-8的位置改为了0x486195), 触发条件断点
可以发现流程就是，根据输入的flag的每个字符，来判断进入下一个节点
解密函数是一个简单的异或, 先随便找几个解密看看，key的长度都是11
def dec(_x, _key):
m = []
for i in range(len(encs[_x])):
m.append(encs[_x][i] ^ ord(_key[i % 11]))
print(bytes(m).decode())
dec(287, 'lqAT7pNI3BX')
print('===============================================================')
dec(96, 'z3Uhis74aPq')
NyPGpw = idaapi.get_byte(5127584 + N4QKUt)
NyPGpw -= ord('a')
if NyPGpw == 0:
afvkwL = 667
hsYnNw = b'vjHiPd4bBuf'
elif NyPGpw == 1:
afvkwL = 667
hsYnNw = b'vjHiPd4bBuf'
elif NyPGpw == 2:
afvkwL = 667
hsYnNw = b'vjHiPd4bBuf'
else:
afvkwL = -1
if afvkwL < 0:
cpu.rsp -= 8
cpu.rdi = 4927649
cpu.rax = 0
idaapi.patch_qword(cpu.rsp, 4202616)
idaapi.del_bpt(cpu.rip)
cpu.rip = 4263680
else:
RrNlIm = 0x4438d8
afvkwL = jIS40A[afvkwL]
idaapi.patch_bytes(5117568, afvkwL)
idaapi.patch_bytes(5117488, hsYnNw)
cpu.rsp -= 8
idaapi.patch_qword(cpu.rsp, RrNlIm)
cpu.rdi = 5117568
cpu.rsi = len(afvkwL)
cpu.rdx = 5117488
cpu.rcx = 11
cpu.r8 = 5117568
cpu.rax = 5117568
idaapi.add_bpt(RrNlIm)
XKDdOn = idaapi.bpt_t()
idaapi.get_bpt(RrNlIm, XKDdOn)
XKDdOn.elang = "Python"
XKDdOn.condition = "N4QKUt = {}\nSdjOr3 = {}\n".format(N4QKUt, len(afvkwL)) + 'afvkwL = idaapi.get_bytes(cpu.rax, SdjOr3).decode()\nRrNlIm = 4370382\nidaapi.add_bpt(RrNlIm)\nXKDdOn = idaapi.bpt_t()\nidaapi.get_bpt(RrNlIm, XKDdOn)\nXKDdOn.elang = "Python"\nXKDdOn.condition = "N4QKUt = {}\\n".format(N4QKUt+1) + afvkwL\nidaapi.del_bpt(RrNlIm)\nidaapi.add_bpt(XKDdOn)\nidaapi.del_bpt(cpu.rip)\ncpu.rsp -= 8\nidaapi.patch_qword(cpu.rsp, RrNlIm)\ncpu.rip = 4220940\n'
idaapi.del_bpt(RrNlIm)
idaapi.add_bpt(XKDdOn)
idaapi.del_bpt(cpu.rip)
cpu.rip = 4201909
===============================================================
XxrupR = idaapi.get_byte(5127584 + N4QKUt)
XxrupR -= ord('a')
if XxrupR == 0:
SAoBHX = 667
EOlVWv = b'vjHiPd4bBuf'
elif XxrupR == 1:
SAoBHX = 667
EOlVWv = b'vjHiPd4bBuf'
elif XxrupR == 2:
SAoBHX = 667
EOlVWv = b'vjHiPd4bBuf'
else:
SAoBHX = -1
if SAoBHX < 0:
cpu.rsp -= 8
cpu.rdi = 4927649
cpu.rax = 0
idaapi.patch_qword(cpu.rsp, 4202616)
idaapi.del_bpt(cpu.rip)
cpu.rip = 4263680
else:
uBEeMD = 0x45e68a
SAoBHX = jIS40A[SAoBHX]
idaapi.patch_bytes(5117568, SAoBHX)
idaapi.patch_bytes(5117488, EOlVWv)
cpu.rsp -= 8
idaapi.patch_qword(cpu.rsp, uBEeMD)
cpu.rdi = 5117568
cpu.rsi = len(SAoBHX)
cpu.rdx = 5117488
cpu.rcx = 11
cpu.r8 = 5117568
cpu.rax = 5117568
idaapi.add_bpt(uBEeMD)
piHsvj = idaapi.bpt_t()
idaapi.get_bpt(uBEeMD, piHsvj)
piHsvj.elang = "Python"
piHsvj.condition = "N4QKUt = {}\nSdjOr3 = {}\n".format(N4QKUt, len(SAoBHX)) + 'SAoBHX = idaapi.get_bytes(cpu.rax, SdjOr3).decode()\nuBEeMD = 4808702\nidaapi.add_bpt(uBEeMD)\npiHsvj = idaapi.bpt_t()\nidaapi.get_bpt(uBEeMD, piHsvj)\npiHsvj.elang = "Python"\npiHsvj.condition = "N4QKUt = {}\\n".format(N4QKUt+1) + SAoBHX\nidaapi.del_bpt(uBEeMD)\nidaapi.add_bpt(piHsvj)\nidaapi.del_bpt(cpu.rip)\ncpu.rsp -= 8\nidaapi.patch_qword(cpu.rsp, uBEeMD)\ncpu.rip = 4405922\n'
idaapi.del_bpt(uBEeMD)
idaapi.add_bpt(piHsvj)
idaapi.del_bpt(cpu.rip)
cpu.rip = 4201909
可以发现都符合一个框架
xxxx = idaapi.get_byte(5127584 + N4QKUt)
xxxx -= ord('a')
if xxxx == 0:
afvkwL = 667
hsYnNw = b'vjHiPd4bBuf'
elif xxxx == 1:
afvkwL = 667
hsYnNw = b'vjHiPd4bBuf'
.......
else:
afvkwL = -1
if afvkwL < 0:
........
因为解密出来都含有idaapi.get_byte(5127584 + N4QKUt)，而key的长度都是11，因此可以对key全部爆破出来
encs = [....]
def get_keys():
sign = [ord(i) for i in 'XxrupR = idaapi.get_byte(5127584 + N4QKUt)'[11:22]]
keys = [0]*1000 # encs的长度是1000， 对应1000个key
for i in range(len(encs)):
tmp = encs[i][11:22]
tmp_key = [tmp[j] ^ sign[j] for j in range(11)] # 获得key
sign_1 = [tmp_key[j] ^ encs[i][j] for j in range(11)]
if b'= id' in bytes(sign_1):
keys[i] = bytes(tmp_key)
else:
keys[i] = None # i = 426
return keys
keys = get_keys()
print(keys.count(None)) # 1
只有1个节点没有解密成功，即没有指向，应该就是终点，结合题目，是个最短路径问题
终点的索引是426，写脚本找到索引426的key
def dec(_src, _key):
m = []
for i in range(len(_src)):
m.append(_src[i] ^ _key[i % 11])
return bytes(m).decode("utf-8")
def get_keys():
sign = [ord(i) for i in 'XxrupR = idaapi.get_byte(5127584 + N4QKUt)'[11:22]]
keys = [0]*1000 # encs的长度是1000， 对应1000个key
for i in range(len(encs)):
tmp = encs[i][11:22]
tmp_key = [tmp[j] ^ sign[j] for j in range(11)] # 获得key
sign_1 = [tmp_key[j] ^ encs[i][j] for j in range(11)]
if b'= id' in bytes(sign_1):
keys[i] = bytes(tmp_key)
else:
keys[i] = None
return keys
def get_node_edges(_dec_src): # 获取每条边，2个点即构成一条边
# 传入解密后的脚本
i = _dec_src.index('<')
_dec_src = _dec_src[:i]
m = re.findall(r' = (\d+)', _dec_src)
nodes = [int(i) for i in m]
return nodes
keys = get_keys()
for i, value in enumerate(encs):
if keys[i] == None:
target_node = i
else:
dec_src = dec(value, keys[i])
nodes = get_node_edges(dec_src)
# 添加边
for j in range(len(nodes)):
if nodes[j]==426:
print(i)
print(dec_src)
exit()
# 705
# GKjYbv = idaapi.get_byte(5127584 + N4QKUt)
# GKjYbv -= ord('a')
# if GKjYbv == 0:
# NizaZl = 426
# BCTfiu = b'akUx3IWl29V'
# else:
# ......
key为akUx3IWl29V, 解密得到
idaapi.del_bpt(cpu.rip)
cpu.rax = 0
cpu.rip = 4202594 # 0x402062
是终点无疑了，现在需要找出所有的节点，以及边（2个节点就是1个边，有方向）,然后用networkx求解
networkx求最短路径
直接贴脚本了，就是通过正则表达式匹配出node,然后构造边，添加边，用networkx求出路径，再写出控制方向的的flag字符即可
import re
import networkx
import hashlib
encs = [....]
def dec(_src, _key):
m = []
for i in range(len(_src)):
m.append(_src[i] ^ _key[i % 11])
return bytes(m).decode("utf-8")
def get_keys():
sign = [ord(i) for i in 'XxrupR = idaapi.get_byte(5127584 + N4QKUt)'[11:22]]
keys = [0]*1000 # encs的长度是1000， 对应1000个key
for i in range(len(encs)):
tmp = encs[i][11:22]
tmp_key = [tmp[j] ^ sign[j] for j in range(11)] # 获得key
sign_1 = [tmp_key[j] ^ encs[i][j] for j in range(11)]
if b'= id' in bytes(sign_1):
keys[i] = bytes(tmp_key)
else:
keys[i] = None
return keys
def get_node_edges(_dec_src): # 获取每个节点指向的其他的节点，然后通过此来获取边
# 传入解密后的脚本
i = _dec_src.index('<')
_dec_src = _dec_src[:i]
m = re.findall(r' = (\d+)', _dec_src)
nodes = [int(i) for i in m]
return nodes
keys = get_keys()
edges = []
node2node = []
for i, value in enumerate(encs):
if keys[i] == None:
target_node = i # 终点
nodes = []
else:
dec_src = dec(value, keys[i])
nodes = get_node_edges(dec_src)
# 添加边
for j in range(len(nodes)): # 根据获取的指向的节点来添加边
edges.append([i, nodes[j]])
node2node.append(nodes)
src_node = -1 # 最开始还有1个节点
src_edge = [287, 96, 8, 777, 496, 822, 914, 550, 273, 259, 334, 966, 331, 680, 374, 717, 965, 952, 222]
# 将最初的边添加进去
for i in src_edge:
edges.append([src_node, i])
G = networkx.DiGraph()
G.add_node(-1)
for i in range(len(encs)):
G.add_node(i)
for i in edges:
G.add_edge(i[0], i[1])
path = networkx.shortest_path(G, source=src_node, target=target_node)
print(path) # 打印出路径来
s = []
s.append(src_edge.index(path[1]))
for i in range(2, len(path)):
s.append(node2node[path[i-1]].index(path[i]))
print(s)
s = "".join([chr(ord('a') + i) for i in s])
print(s)
print("L3HCTF{" + hashlib.md5(s.encode()).hexdigest() + "}")
# [-1, 331, 578, 255, 875, 765, 687, 209, 119, 963, 939, 443, 250, 366, 65, 504, 920, 849, 720, 893, 728, 580, 114, 665, 72, 51, 241, 519, 473, 970, 984, 557, 90, 793, 487, 67, 428, 236, 263, 24, 39, 104, 505, 491, 95, 223, 486, 798, 873, 872, 64, 229, 37, 274, 329, 601, 372, 750, 446, 3, 332, 698, 277, 740, 816, 845, 570, 828, 21, 36, 839, 770, 343, 451, 151, 994, 937, 760, 644, 9, 614, 302, 454, 153, 840, 76, 424, 352, 950, 238, 613, 497, 898, 858, 415, 205, 393, 927, 522, 705, 426]
# [12, 2, 0, 4, 1, 0, 2, 4, 3, 0, 0, 1, 5, 0, 2, 0, 2, 0, 1, 6, 0, 6, 1, 1, 0, 0, 4, 0, 2, 0, 1, 2, 1, 0, 2, 4, 1, 0, 6, 0, 0, 0, 1, 2, 3, 1, 6, 1, 3, 1, 2, 1, 3, 0, 2, 6, 0, 1,
# 5, 1, 1, 4, 1, 0, 1, 0, 1, 1, 1, 1, 1, 2, 0, 0, 1, 3, 0, 1, 0, 1, 0, 5, 0, 2, 2, 0, 2, 3, 0, 6, 3, 0, 0, 1, 0, 1, 0, 0, 0, 0]
# mcaebacedaabfacacabgagbbaaeacabcbacebagaaabcdbgbdbcbdacgabfbbebababbbbbcaabdababafaccacdagdaababaaaa
# L3HCTF{6584ed9fd9497981117f22a6c572caee}
flag为 L3HCTF{6584ed9fd9497981117f22a6c572caee}
参考： https://www.anquanke.com/post/id/259494#h3-2
[复制链接]
发表于 2021-12-9 15:51
