WaniCTF'21-spring licence を angr を使わず解く。
しかも，体力勝負ではなく Ghidra Script を書いて静的解析で解いた。
やったぜ！
Ghidraの勉強になったし，CTF本番中解けなかった問題にリベンジできて非常にうれしい。
このソリューションが難読化されたマルウェアを解析する力の足しになればと思う。
問題文
Reversing
licence
285pt Very hard
このプログラムは非常に強力なライセンス確認処理が実装されています。
ただ、今持っているライセンスファイルは間違っているようです。
正しいライセンスファイルを見つけて頂けますか？
$ ./licence key.dat
Failed to activate.
複雑な処理をシンボリック実行で解析してくれるツール「angr」を使えば簡単に解けるかも。
Ghidraでデコンパイルして main 関数をみていく
check関数の戻り値がゼロのときフラグが取れてることになる。
check関数の戻り値を設定してるところ
uVar1 が戻り値
check関数内には，if文がたくさんあり，Ghidraで見た感じ，2582行ある。
どうしてもangrで解かせようという腹だ。
uVar1 = 0;が当たりと思われるので，文字列検索する
当然だが１か所しかない。
1083行目だ。
ここから下は見る必要が無い。
この時点で，追うべきコードが2582行から1083行に減った。
1083行目から上に上がっていく
if (aaa ^ bbb == ccc) { uVar1 = 1; } のようなコードは全て無視していい。
下のスクショで赤線で囲った部分がそれ。
if (aaa ^ bbb == ccc) { uVar1 = 1; }からは正解は導けない。
「静的解析はあきらめて angr で解いたら？」と心を折るためのダミーコードだ。
上にあがっていくとuVar1 = 1;を設定しないif文が見える
これを集めるとフラグが構築できると思われる。
if ((int)(char)param_1[0x3e] - (int)(char)param_1[0x3d] == 0x11 ) {
また上に
if ((int)(char)param_1[0x3c] + (int)(char)param_1[0x3d] == 0x9c) {
if ((int)(char)param_1[0x3e] - (int)(char)param_1[0x3d] == 0x11) {
さらに上に
if ((int)(char)param_1[0x3a] - (int)(char)param_1[0x39] == -0x28) {
if ((int)(char)param_1[0x3b] - (int)(char)param_1[0x3a] == -7) {
if ((int)(char)param_1[0x3c] + (int)(char)param_1[0x3d] == 0x9c) {
if ((int)(char)param_1[0x3e] - (int)(char)param_1[0x3d] == 0x11) {
if 文の左辺の添え字がデクリメントされていく。
おそらく 0x3e がフラグの末尾。 添え字は0から始まるから フラグは63文字と推測。
今度は先頭にから見ていく
やはり上からだとif文の左辺の添え字がインクリメントされている。
if ((param_1[1] ^ param_1[2]) == 0xd) {
if ((param_1[2] ^ param_1[3]) == 6) {
if ((param_1[3] ^ param_1[4]) == 0x3c) {
（中略）
if ((int)(char)param_1[0x3a] - (int)(char)param_1[0x39] == -0x28) {
if ((int)(char)param_1[0x3b] - (int)(char)param_1[0x3a] == -7) {
if ((int)(char)param_1[0x3c] + (int)(char)param_1[0x3d] == 0x9c) {
if ((int)(char)param_1[0x3e] - (int)(char)param_1[0x3d] == 0x11) {
フラグは FLAG{ で始まるので，検証してみると
>>> hex(ord('L') ^ ord('A'))
'0xd'
>>> hex(ord('A') ^ ord('G'))
'0x6'
>>> hex(ord('G') ^ ord('{'))
'0x3c'
間違いない。
さて，本番中なら，このまま最後までやって，汗水たらしたことを隠して，しれっとフラグを提出するところだが，もうCTFは終わっている。
何が何でもGhidraで解きたい。
Ghidara Scriptの仕様書
if文の種類
if (flag[x] ^ flag[y] == z ){
if (flag[x] + flag[y] == z ){
if (flag[x] - flag[y] == z ){
if文がXORのパターン
ADD RAX, 即値
ADD RAX, 即値
XOR EAX, EDX
CMP AL. 即値
if文が + のパターン
ADD RAX, 即値
ADD RAX, 即値
ADD EAX, EDX
CMP EAX, 即値
if文が - のパターン
ADD RAX, 即値（引かれる数）
ADD RAX, 即値（引く数）
SUB EDX,EAX
CMP EAX, 即値
解析開始位置は，FLAG{ の A を求めるところから開始
解析終了条件は，uVar1 = 0; を設定しているところにぶつかったとき
ダミーのif文 と flagが取れるif文 の見分け方は，
uVar1 = 1;が登場したらダミー
uVar1 = 1;が登場しなかったらflagが取れる
後判定か。少しややこい。
しかも無い（現れない）ことを条件にするのむずい。
青線 flagがとれるif文
赤線 flagがとれないif文（ダミーコード）
プログラミングする上での問題点（工夫を要する点）
XOR や SUB は if文の式の中だけで使われるが，
ADD は，FLAG[0+即値]の即値部分を加算する処理でも使われており，区別が必要
以上を考慮し Ghidra Script を作成したが，途中でエラーになった。
エラーの原因を探るために行ったデバッグプリント
デバッグプリント
test_wani_licence.py> Running...
y= 0x2L
x= 0x1L
z= 0xdL
XOR
calc_count=1
y= 0x3L
x= 0x2bL
z= 0xc2L
y= 0x3L
x= 0x11L
z= -0x28L
y= 0x3L
x= 0x18L
z= 0x1aL
y= 0x3L
x= 0x2L
z= 0x6L
XOR
calc_count=2
y= 0x4L
x= 0x2aL
z= 0x1aL
y= 0x4L
x= 0x16L
z= 0x49L
y= 0x4L
x= 0x3L
z= 0xc6L
y= 0x4L
x= 0x3L
z= 0x3cL
XOR
calc_count=3
y= 0x5L
x= 0x7L
z= 0x6cL
y= 0x5L
x= 0x0
z= 0x7aL
y= 0x5L
x= 0x3bL
y= 0x5L
x= 0x4L
z= 0x4fL
XOR
calc_count=4
y= 0x6L
x= 0x1cL
z= 0x5cL
y= 0x6L
x= 0x1bL
z= 0x3L
y= 0x6L
x= 0x5L
z= 0x5aL
XOR
calc_count=5
y= 0x7L
x= 0x1L
z= -0x12L
y= 0x7L
x= 0x1fL
z= 0xb0L
y= 0x7L
x= 0x13L
z= 0x41L
y= 0x7L
x= 0x6L
z= -0x38L
SUB
calc_count=6
y= 0x8L
x= 0x20L
z= 0x6L
y= 0x8L
x= 0x32L
z= 0xaL
y= 0x8L
x= 0xaL
z= 0x4bL
y= 0x8L
x= 0x7L
z= 0x44L
XOR
calc_count=7
y= 0x9L
x= 0x24L
z= 0x67L
y= 0x9L
x= 0x36L
z= 0x9bL
y= 0x9L
x= 0xfL
z= 0x68L
y= 0x9L
x= 0x8L
z= -0x13L
SUB
calc_count=8
y= 0xaL
x= 0x2L
z= -0x7L
y= 0xaL
x= 0x22L
z= 0x6bL
y= 0xaL
x= 0x9L
z= 0x6eL
XOR
calc_count=9
y= 0xbL
x= 0x0
z= 0x7eL
y= 0xbL
x= 0x32L
z= -0x37L
y= 0xbL
x= 0x23L
z= 0xa2L
y= 0xbL
x= 0xaL
z= 0x66L
ADD
calc_count=10
y= 0xcL
x= 0x39L
z= 0x3cL
y= 0xcL
x= 0x17L
z= 0xdaL
y= 0xcL
x= 0xbL
z= 0x94L
ADD
calc_count=11
y= 0xdL
x= 0x27L
z= 0x2L
y= 0xdL
x= 0x2cL
z= 0xcL
y= 0xdL
x= 0x3bL
z= 0x6cL
y= 0xdL
x= 0xcL
z= -0x2bL
SUB
calc_count=12
y= 0xeL
x= 0xfL
z= 0x2fL
y= 0xeL
x= 0x3bL
z= 0x33L
y= 0xeL
x= 0x2dL
z= 0x64L
y= 0xeL
x= 0xdL
z= 0x6bL
XOR
calc_count=13
y= 0xfL
x= 0x31L
z= 0x2L
y= 0xfL
x= 0x27L
z= 0xdL
y= 0xfL
x= 0x2fL
z= 0x41L
y= 0xfL
x= 0xeL
z= 0x6aL
XOR
calc_count=14
y= 0x10L
x= 0x26L
z= 0xdaL
y= 0x10L
x= 0x20L
z= 0xe7L
y= 0x10L
x= 0x3bL
z= 0xa6L
y= 0x10L
x= 0xfL
z= 0x40L
XOR
calc_count=15
y= 0x11L
x= 0xbL
z= 0x4dL
y= 0x11L
x= 0x13L
z= -0x1L
y= 0x11L
x= 0x3cL
z= 0xa2L
y= 0x11L
x= 0x10L
z= 0xe5L
ADD
calc_count=16
y= 0x12L
x= 0x36L
z= 0x5L
y= 0x12L
x= 0x4L
z= -0x40L
y= 0x12L
x= 0x9L
z= 0x57L
y= 0x12L
x= 0x11L
z= -0x3dL
SUB
calc_count=17
y= 0x13L
x= 0x38L
z= 0xb1L
y= 0x13L
x= 0x6L
z= 0x1dL
y= 0x13L
x= 0xbL
z= 0xa8L
y= 0x13L
x= 0x12L
z= 0x41L
XOR
calc_count=18
y= 0x14L
x= 0x2L
z= 0x20L
y= 0x14L
x= 0x18L
z= 0x9bL
y= 0x14L
x= 0x2aL
z= 0x33L
y= 0x14L
x= 0x13L
z= 0x2dL
XOR
calc_count=19
y= 0x15L
x= 0x9L
z= 0x17L
y= 0x15L
x= 0x17L
z= 0xecL
y= 0x15L
x= 0x2fL
z= 0x8L
y= 0x15L
x= 0x14L
z= 0x2fL
XOR
calc_count=20
y= 0x16L
x= 0x33L
z= 0x6cL
y= 0x16L
x= 0x3L
z= 0x79L
y= 0x16L
x= 0x15L
z= 0x40L
XOR
calc_count=21
y= 0x17L
x= 0x2eL
z= 0xafL
y= 0x17L
x= 0x2bL
z= 0xedL
y= 0x17L
x= 0x11L
z= 0x11L
y= 0x17L
x= 0x16L
z= 0xa7L
ADD
calc_count=22
y= 0x18L
x= 0x37L
z= 0x6dL
y= 0x18L
x= 0x3eL
z= 0x4dL
y= 0x18L
x= 0x2cL
z= 0x1L
y= 0x18L
x= 0x17L
z= 0x44L
XOR
calc_count=23
y= 0x19L
x= 0x35L
z= -0x6L
y= 0x19L
x= 0x5L
z= 0x4fL
y= 0x19L
x= 0x22L
z= 0xa6L
y= 0x19L
x= 0x18L
z= 0xa5L
ADD
calc_count=24
y= 0x1aL
x= 0x0
z= 0x27L
y= 0x1aL
x= 0xeL
z= 0x8L
y= 0x1aL
x= 0x19L
z= -0xcL
SUB
calc_count=25
y= 0x1bL
x= 0x33L
z= 0xafL
y= 0x1bL
x= 0x21L
z= 0xe0L
y= 0x1bL
x= 0x1dL
z= 0x15L
y= 0x1bL
x= 0x1aL
z= 0xdbL
ADD
calc_count=26
y= 0x1cL
x= 0x20L
z= 0xa1L
y= 0x1cL
x= 0x35L
z= -0x45L
y= 0x1cL
x= 0x14L
z= 0x55L
y= 0x1cL
x= 0x1bL
z= 0xa6L
ADD
calc_count=27
y= 0x1dL
x= 0x32L
z= 0x2fL
y= 0x1dL
x= 0x34L
z= -0x4L
y= 0x1dL
x= 0x8L
z= 0x25L
y= 0x1dL
x= 0x1cL
z= 0x90L
ADD
calc_count=28
y= 0x1eL
x= 0x27L
z= 0xfL
y= 0x1eL
x= 0x2L
z= 0x71L
y= 0x1eL
x= 0x23L
z= 0x58L
y= 0x1eL
x= 0x1dL
z= -0x2aL
SUB
calc_count=29
y= 0x1fL
x= 0x14L
z= 0x1dL
y= 0x1fL
x= 0x37L
z= 0xacL
y= 0x1fL
x= 0x20L
z= 0x15L
y= 0x1fL
x= 0x1eL
z= 0x44L
SUB
calc_count=30
y= 0x20L
x= 0x37L
z= 0xa1L
y= 0x20L
x= 0x3aL
z= 0x55L
y= 0x20L
x= 0x8L
z= 0xe6L
y= 0x20L
x= 0x1fL
z= -0xcL
SUB
calc_count=31
y= 0x21L
x= 0x29L
z= 0x36L
y= 0x21L
x= 0x11L
z= 0xd9L
y= 0x21L
x= 0x0
z= 0x23L
y= 0x21L
x= 0x20L
z= -0xbL
SUB
calc_count=32
y= 0x22L
x= 0x30L
z= -0x2aL
y= 0x22L
x= 0x6L
z= -0x37L
y= 0x22L
x= 0x16L
z= 0x5L
y= 0x22L
x= 0x21L
z= 0x92L
ADD
calc_count=33
y= 0x23L
x= 0x3dL
z= 0x1dL
y= 0x23L
x= 0x19L
z= 0xe5L
y= 0x23L
x= 0x2bL
z= 0xeaL
y= 0x23L
x= 0x22L
z= 0x3cL
SUB
calc_count=34
y= 0x24L
x= 0x18L
z= 0xaL
y= 0x24L
x= 0x1aL
z= 0x9eL
y= 0x24L
x= 0xcL
z= 0x54L
y= 0x24L
x= 0x23L
z= -0x3bL
SUB
calc_count=35
y= 0x25L
x= 0x28L
z= 0x1fL
y= 0x25L
x= 0x23L
z= -0x8L
y= 0x25L
x= 0x13L
z= 0x16L
y= 0x25L
x= 0x24L
z= 0x32L
SUB
calc_count=36
y= 0x26L
x= 0x18L
z= 0x99L
y= 0x26L
x= 0x12L
z= 0x93L
y= 0x26L
x= 0x13L
z= 0xd2L
y= 0x26L
x= 0x25L
z= 0x3cL
XOR
calc_count=37
y= 0x27L
x= 0x21L
z= 0x5aL
y= 0x27L
x= 0x3cL
z= 0x2L
y= 0x27L
x= 0x23L
z= -0x30L
y= 0x27L
x= 0x26L
z= 0x92L
ADD
calc_count=38
y= 0x28L
x= 0x3cL
z= 0xafL
y= 0x28L
x= 0x2fL
z= 0xefL
y= 0x28L
x= 0x3eL
z= 0x2L
y= 0x28L
x= 0x27L
z= 0x4bL
XOR
calc_count=39
y= 0x29L
x= 0x1eL
z= 0xfL
y= 0x29L
x= 0x3bL
z= 0x65L
y= 0x29L
x= 0x2eL
z= 0x6dL
y= 0x29L
x= 0x28L
z= 0xabL
ADD
calc_count=40
y= 0x2aL
x= 0x28L
z= 0xdeL
y= 0x2aL
x= 0x2eL
z= 0x3cL
y= 0x2aL
x= 0xdL
z= 0x38L
y= 0x2aL
x= 0x29L
z= 0x50L
XOR
calc_count=41
y= 0x2bL
x= 0x30L
z= 0x1cL
y= 0x2bL
x= 0x4L
z= 0x8L
y= 0x2bL
x= 0x30L
z= 0x1aL
y= 0x2bL
x= 0x2aL
z= 0x12L
SUB
calc_count=42
y= 0x2cL
x= 0x1bL
z= -0x37L
y= 0x2cL
x= 0x31L
z= 0x73L
y= 0x2cL
x= 0x1fL
z= 0xb2L
y= 0x2cL
x= 0x2bL
z= 0x42L
XOR
calc_count=43
y= 0x2dL
x= 0xaL
z= 0x4L
y= 0x2dL
x= 0x2bL
z= -0x42L
y= 0x2dL
x= 0x3fL
z= 0x3dL
y= 0x2dL
x= 0x2cL
z= 0x6L
XOR
calc_count=44
y= 0x2eL
x= 0x16L
z= 0x67L
y= 0x2eL
x= 0x2dL
z= 0x1L
XOR
calc_count=45
y= 0x2fL
x= 0x31L
z= 0x56L
y= 0x2fL
x= 0x5L
z= 0x44L
y= 0x2fL
x= 0x2bL
z= 0xedL
y= 0x2fL
x= 0x2eL
z= 0x9eL
ADD
calc_count=46
y= 0x30L
x= 0x23L
z= 0x30L
y= 0x30L
x= 0xbL
z= 0x9bL
y= 0x30L
x= 0x2fL
z= 0x31L
XOR
calc_count=47
y= 0x31L
x= 0x17L
z= 0xb2L
y= 0x31L
x= 0x13L
z= 0xa7L
y= 0x31L
x= 0x1cL
z= 0x6L
y= 0x31L
x= 0x30L
z= 0x6bL
XOR
calc_count=48
y= 0x32L
x= 0x9L
z= 0xceL
y= 0x32L
x= 0x8L
z= 0x4L
y= 0x32L
x= 0x16L
z= 0x48L
y= 0x32L
x= 0x31L
z= 0x3aL
SUB
calc_count=49
y= 0x33L
x= 0x3cL
z= 0xdL
y= 0x33L
x= 0x11L
z= 0x42L
y= 0x33L
x= 0xcL
z= 0x55L
y= 0x33L
x= 0x32L
z= -0x3aL
SUB
calc_count=50
y= 0x34L
x= 0x1cL
z= 0xa4L
y= 0x34L
x= 0xbL
z= 0x39L
y= 0x34L
x= 0x2dL
z= 0x5fL
y= 0x34L
x= 0x33L
z= 0xa0L
ADD
calc_count=51
y= 0x35L
x= 0x13L
z= 0x11L
y= 0x35L
x= 0x14L
z= 0x1aL
y= 0x35L
x= 0x1bL
z= 0x6L
y= 0x35L
x= 0x34L
z= 0xdL
SUB
calc_count=52
y= 0x36L
x= 0x5L
y= 0x36L
x= 0x12L
z= 0x2L
y= 0x36L
x= 0x35L
z= 0x4cL
XOR
calc_count=53
y= 0x37L
x= 0x3cL
z= 0x6aL
y= 0x37L
x= 0x27L
z= 0x6eL
y= 0x37L
x= 0x4L
z= -0x46L
y= 0x37L
x= 0x36L
z= -0x4L
SUB
calc_count=54
y= 0x38L
x= 0x33L
z= 0xbL
y= 0x38L
x= 0x2L
z= 0x7dL
y= 0x38L
x= 0x2eL
z= 0x8L
y= 0x38L
x= 0x37L
z= 0x66L
ADD
calc_count=55
y= 0x39L
x= 0x2fL
z= 0x27L
y= 0x39L
x= 0x3cL
z= 0x36L
y= 0x39L
x= 0x34L
z= 0xd3L
y= 0x39L
x= 0x38L
z= 0x94L
ADD
calc_count=56
y= 0x3aL
x= 0x12L
z= 0xaL
y= 0x3aL
x= 0x9L
z= -0x26L
y= 0x3aL
x= 0x11L
z= 0xa9L
y= 0x3aL
x= 0x39L
z= -0x28L
SUB
calc_count=57
y= 0x3bL
x= 0x2aL
z= -0x29L
y= 0x3bL
x= 0x3cL
z= 0x66L
y= 0x3bL
x= 0x2fL
z= 0x48L
y= 0x3bL
x= 0x3aL
z= -0x7L
SUB
calc_count=58
y= 0x3cL
x= 0x11L
z= 0x4aL
y= 0x3cL
x= 0x33L
z= 0x65L
y= 0x3cL
x= 0xeL
z= 0x59L
y= 0x3cL
x= 0x3bL
y= 0x3dL
x= 0x3fL
z= 0x6aL
y= 0x3dL
x= 0x1aL
z= 0xd6L
y= 0x3dL
x= 0x15L
z= 0x19L
y= 0x3dL
x= 0x3cL
z= 0x9cL
ADD
calc_count=59
y= 0x3eL
x= 0x5L
z= 0x50L
y= 0x3eL
x= 0x19L
z= 0xf7L
y= 0x3eL
x= 0x31L
z= 0xbaL
y= 0x3eL
x= 0x3dL
z= 0x11L
SUB
calc_count=60
y= 0x3fL
x= 0x2bL
z= 0x75L
y= 0x3fL
x= 0x10L
z= 0x85L
y= 0x3fL
x= 0x6L
z= 0x80L
y= 0x3fL
x= 0x3eL
z= 0x87L
デバッグプリントつづき
dummy_count=174
[70, 76, 65L, 71L, 123L, 52L, 110L, 54L, 114L, 95L, 49L, 53L, 95L, 52L, 95L, 53L, 117L, 112L, 51L, 114L, 95L, 112L, 48L, 119L, 51L, 114L, 102L, 117L, 49L, 95L, 53L, 121L, 109L, 98L, 48L, 108L, 49L, 99L, 95L, 51L, 120L, 51L, 99L, 117L, 55L, 49L, 48L, 110L, 95L, 52L, 110L, 52L, 108L, 121L, 53L, 49L, 53L, 95L, 55L, 48L, 0, 156L, 173L]
flag=FLAG{4n6r_15_4_5up3r_p0w3rfu1_5ymb0l1c_3x3cu710n_4n4ly515_70
flag[0x3c] が 0 になっており，プリンタブルから外れてる。
Ghidraだとif文が複数行になって見にくいのでSYNCERで整形してみた。
SYNCERで整形したif文の山
undefined8 check(byte * param_1) {
undefined8 uVar1;
if ((param_1[0xb] ^ * param_1) == 0x7e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2d] + (int)(char) * param_1 == 0x80) {
uVar1 = 1;
} else {
if ((int)(char) * param_1 - (int)(char) param_1[0x1c] == 0x18) {
uVar1 = 1;
} else {
if ( * param_1 == 0x46) {
if ((int)(char) param_1[1] - (int)(char) param_1[0xd] == 0x1a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[1] - (int)(char) param_1[0x12] == 0x21) {
uVar1 = 1;
} else {
if ((param_1[0x11] ^ param_1[1]) == 0x34) {
uVar1 = 1;
} else {
if ((int)(char) param_1[1] - (int)(char) * param_1 == 6) {
if ((int)(char) param_1[2] - (int)(char) param_1[9] == -0x1c) {
uVar1 = 1;
} else {
if ((param_1[0x24] ^ param_1[2]) == 0x72) {
uVar1 = 1;
} else {
if ((int)(char) param_1[2] - (int)(char) param_1[0x1c] == 0x11) {
uVar1 = 1;
} else {
if ((param_1[1] ^ param_1[2]) == 0xd) {
if ((int)(char) param_1[0x2b] + (int)(char) param_1[3] == 0xc2) {
uVar1 = 1;
} else {
if ((int)(char) param_1[3] - (int)(char) param_1[0x11] == -0x28) {
uVar1 = 1;
} else {
if ((int)(char) param_1[3] - (int)(char) param_1[0x18] == 0x1a) {
uVar1 = 1;
} else {
if ((param_1[2] ^ param_1[3]) == 6) {
if ((int)(char) param_1[4] - (int)(char) param_1[0x2a] == 0x1a) {
uVar1 = 1;
} else {
if ((param_1[0x16] ^ param_1[4]) == 0x49) {
uVar1 = 1;
} else {
if ((int)(char) param_1[3] + (int)(char) param_1[4] == 0xc6) {
uVar1 = 1;
} else {
if ((param_1[3] ^ param_1[4]) == 0x3c) {
if ((int)(char) param_1[7] + (int)(char) param_1[5] == 0x6c) {
uVar1 = 1;
} else {
if (( * param_1 ^ param_1[5]) == 0x7a) {
uVar1 = 1;
} else {
if (param_1[5] == param_1[0x3b]) {
uVar1 = 1;
} else {
if ((param_1[4] ^ param_1[5]) == 0x4f) {
if ((param_1[0x1c] ^ param_1[6]) == 0x5c) {
uVar1 = 1;
} else {
if ((int)(char) param_1[6] - (int)(char) param_1[0x1b] == 3) {
uVar1 = 1;
} else {
if ((param_1[5] ^ param_1[6]) == 0x5a) {
if ((int)(char) param_1[7] - (int)(char) param_1[1] == -0x12) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1f] + (int)(char) param_1[7] == 0xb0) {
uVar1 = 1;
} else {
if ((param_1[0x13] ^ param_1[7]) == 0x41) {
uVar1 = 1;
} else {
if ((int)(char) param_1[7] - (int)(char) param_1[6] == -0x38) {
if ((int)(char) param_1[8] - (int)(char) param_1[0x20] == 6) {
uVar1 = 1;
} else {
if ((param_1[0x32] ^ param_1[8]) == 10) {
uVar1 = 1;
} else {
if ((int)(char) param_1[8] - (int)(char) param_1[10] == 0x4b) {
uVar1 = 1;
} else {
if ((param_1[7] ^ param_1[8]) == 0x44) {
if ((param_1[0x24] ^ param_1[9]) == 0x67) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x36] + (int)(char) param_1[9] == 0x9b) {
uVar1 = 1;
} else {
if ((param_1[0xf] ^ param_1[9]) == 0x68) {
uVar1 = 1;
} else {
if ((int)(char) param_1[9] - (int)(char) param_1[8] == -0x13) {
if ((int)(char) param_1[10] - (int)(char) param_1[2] == -7) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x22] + (int)(char) param_1[10] == 0x6b) {
uVar1 = 1;
} else {
if ((param_1[9] ^ param_1[10]) == 0x6e) {
if ((int)(char) * param_1 + (int)(char) param_1[0xb] == 0x7e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xb] - (int)(char) param_1[0x32] == -0x37) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x23] + (int)(char) param_1[0xb] == 0xa2) {
uVar1 = 1;
} else {
if ((int)(char) param_1[10] + (int)(char) param_1[0xb] == 0x66) {
if ((param_1[0x39] ^ param_1[0xc]) == 0x3c) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0xc] == 0xda) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xb] + (int)(char) param_1[0xc] == 0x94) {
if ((param_1[0x27] ^ param_1[0xd]) == 2) {
uVar1 = 1;
} else {
if ((param_1[0x2c] ^ param_1[0xd]) == 0xc) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3b] + (int)(char) param_1[0xd] == 0x6c) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xd] - (int)(char) param_1[0xc] == -0x2b) {
if ((int)(char) param_1[0xe] - (int)(char) param_1[0xf] == 0x2f) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xe] - (int)(char) param_1[0x3b] == 0x33) {
uVar1 = 1;
} else {
if ((param_1[0x2d] ^ param_1[0xe]) == 100) {
uVar1 = 1;
} else {
if ((param_1[0xd] ^ param_1[0xe]) == 0x6b) {
if ((param_1[0x31] ^ param_1[0xf]) == 2) {
uVar1 = 1;
} else {
if ((param_1[0x27] ^ param_1[0xf]) == 0xd) {
uVar1 = 1;
} else {
if ((param_1[0x2f] ^ param_1[0xf]) == 0x41) {
uVar1 = 1;
} else {
if ((param_1[0xe] ^ param_1[0xf]) == 0x6a) {
if ((int)(char) param_1[0x26] + (int)(char) param_1[0x10] == 0xda) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x20] + (int)(char) param_1[0x10] == 0xe7) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3b] + (int)(char) param_1[0x10] == 0xa6) {
uVar1 = 1;
} else {
if ((param_1[0xf] ^ param_1[0x10]) == 0x40) {
if ((param_1[0xb] ^ param_1[0x11]) == 0x4d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x11] - (int)(char) param_1[0x13] == -1) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3c] + (int)(char) param_1[0x11] == 0xa2) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x10] + (int)(char) param_1[0x11] == 0xe5) {
if ((param_1[0x36] ^ param_1[0x12]) == 5) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x12] - (int)(char) param_1[4] == -0x40) {
uVar1 = 1;
} else {
if ((param_1[9] ^ param_1[0x12]) == 0x57) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x12] - (int)(char) param_1[0x11] == -0x3d) {
if ((int)(char) param_1[0x38] + (int)(char) param_1[0x13] == 0xb1) {
uVar1 = 1;
} else {
if ((param_1[6] ^ param_1[0x13]) == 0x1d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xb] + (int)(char) param_1[0x13] == 0xa8) {
uVar1 = 1;
} else {
if ((param_1[0x12] ^ param_1[0x13]) == 0x41) {
if ((int)(char) param_1[0x14] - (int)(char) param_1[2] == 0x20) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x18] + (int)(char) param_1[0x14] == 0x9b) {
uVar1 = 1;
} else {
if ((param_1[0x2a] ^ param_1[0x14]) == 0x33) {
uVar1 = 1;
} else {
if ((param_1[0x13] ^ param_1[0x14]) == 0x2d) {
if ((int)(char) param_1[0x15] - (int)(char) param_1[9] == 0x17) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0x15] == 0xec) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x15] - (int)(char) param_1[0x2f] == 8) {
uVar1 = 1;
} else {
if ((param_1[0x14] ^ param_1[0x15]) == 0x2f) {
if ((int)(char) param_1[0x33] + (int)(char) param_1[0x16] == 0x6c) {
uVar1 = 1;
} else {
if ((int)(char) param_1[3] + (int)(char) param_1[0x16] == 0x79) {
uVar1 = 1;
} else {
if ((param_1[0x15] ^ param_1[0x16]) == 0x40) {
if ((int)(char) param_1[0x2e] + (int)(char) param_1[0x17] == 0xaf) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2b] + (int)(char) param_1[0x17] == 0xed) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] - (int)(char) param_1[0x11] == 0x11) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x16] + (int)(char) param_1[0x17] == 0xa7) {
if ((int)(char) param_1[0x37] + (int)(char) param_1[0x18] == 0x6d) {
uVar1 = 1;
} else {
if ((param_1[0x3e] ^ param_1[0x18]) == 0x4d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x18] - (int)(char) param_1[0x2c] == 1) {
uVar1 = 1;
} else {
if ((param_1[0x17] ^ param_1[0x18]) == 0x44) {
if ((int)(char) param_1[0x19] - (int)(char) param_1[0x35] == -6) {
uVar1 = 1;
} else {
if ((param_1[5] ^ param_1[0x19]) == 0x4f) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x22] + (int)(char) param_1[0x19] == 0xa6) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x18] + (int)(char) param_1[0x19] == 0xa5) {
if ((int)(char) param_1[0x1a] - (int)(char) * param_1 == 0x27) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1a] - (int)(char) param_1[0xe] == 8) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1a] - (int)(char) param_1[0x19] == -0xc) {
if ((int)(char) param_1[0x33] + (int)(char) param_1[0x1b] == 0xaf) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x21] + (int)(char) param_1[0x1b] == 0xe0) {
uVar1 = 1;
} else {
if ((param_1[0x1d] ^ param_1[0x1b]) == 0x15) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1a] + (int)(char) param_1[0x1b] == 0xdb) {
if ((int)(char) param_1[0x20] + (int)(char) param_1[0x1c] == 0xa1) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1c] - (int)(char) param_1[0x35] == -0x45) {
uVar1 = 1;
} else {
if ((param_1[0x14] ^ param_1[0x1c]) == 0x55) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1b] + (int)(char) param_1[0x1c] == 0xa6) {
if ((param_1[0x32] ^ param_1[0x1d]) == 0x2f) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1d] - (int)(char) param_1[0x34] == -4) {
uVar1 = 1;
} else {
if ((param_1[8] ^ param_1[0x1d]) == 0x25) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1c] + (int)(char) param_1[0x1d] == 0x90) {
if ((param_1[0x27] ^ param_1[0x1e]) == 0xf) {
uVar1 = 1;
} else {
if ((param_1[2] ^ param_1[0x1e]) == 0x71) {
uVar1 = 1;
} else {
if ((param_1[0x23] ^ param_1[0x1e]) == 0x58) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1e] - (int)(char) param_1[0x1d] == -0x2a) {
if ((param_1[0x14] ^ param_1[0x1f]) == 0x1d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x37] + (int)(char) param_1[0x1f] == 0xac) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1f] - (int)(char) param_1[0x20] == 0x15) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1f] - (int)(char) param_1[0x1e] == 0x44) {
if ((int)(char) param_1[0x37] + (int)(char) param_1[0x20] == 0xa1) {
uVar1 = 1;
} else {
if ((param_1[0x3a] ^ param_1[0x20]) == 0x55) {
uVar1 = 1;
} else {
if ((int)(char) param_1[8] + (int)(char) param_1[0x20] == 0xe6) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x20] - (int)(char) param_1[0x1f] == -0xc) {
if ((int)(char) param_1[0x21] - (int)(char) param_1[0x29] == 0x36) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x11] + (int)(char) param_1[0x21] == 0xd9) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x21] - (int)(char) * param_1 == 0x23) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x21] - (int)(char) param_1[0x20] == -0xb) {
if ((int)(char) param_1[0x22] - (int)(char) param_1[0x30] == -0x2a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x22] - (int)(char) param_1[6] == -0x37) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x22] - (int)(char) param_1[0x16] == 5) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x21] + (int)(char) param_1[0x22] == 0x92) {
if ((param_1[0x3d] ^ param_1[0x23]) == 0x1d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x19] + (int)(char) param_1[0x23] == 0xe5) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2b] + (int)(char) param_1[0x23] == 0xea) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x23] - (int)(char) param_1[0x22] == 0x3c) {
if ((param_1[0x18] ^ param_1[0x24]) == 10) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1a] + (int)(char) param_1[0x24] == 0x9e) {
uVar1 = 1;
} else {
if ((param_1[0xc] ^ param_1[0x24]) == 0x54) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x24] - (int)(char) param_1[0x23] == -0x3b) {
if ((param_1[0x28] ^ param_1[0x25]) == 0x1f) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x25] - (int)(char) param_1[0x23] == -8) {
uVar1 = 1;
} else {
if ((param_1[0x13] ^ param_1[0x25]) == 0x16) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x25] - (int)(char) param_1[0x24] == 0x32) {
if ((int)(char) param_1[0x18] + (int)(char) param_1[0x26] == 0x99) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x12] + (int)(char) param_1[0x26] == 0x93) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x13] + (int)(char) param_1[0x26] == 0xd2) {
uVar1 = 1;
} else {
if ((param_1[0x25] ^ param_1[0x26]) == 0x3c) {
if ((param_1[0x21] ^ param_1[0x27]) == 0x5a) {
uVar1 = 1;
} else {
if ((param_1[0x3c] ^ param_1[0x27]) == 2) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x27] - (int)(char) param_1[0x23] == -0x30) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x26] + (int)(char) param_1[0x27] == 0x92) {
if ((int)(char) param_1[0x3c] + (int)(char) param_1[0x28] == 0xaf) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2f] + (int)(char) param_1[0x28] == 0xef) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x28] - (int)(char) param_1[0x3e] == 2) {
uVar1 = 1;
} else {
if ((param_1[0x27] ^ param_1[0x28]) == 0x4b) {
if ((param_1[0x1e] ^ param_1[0x29]) == 0xf) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3b] + (int)(char) param_1[0x29] == 0x65) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2e] + (int)(char) param_1[0x29] == 0x6d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x28] + (int)(char) param_1[0x29] == 0xab) {
if ((int)(char) param_1[0x28] + (int)(char) param_1[0x2a] == 0xde) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2a] - (int)(char) param_1[0x2e] == 0x3c) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2a] - (int)(char) param_1[0xd] == 0x38) {
uVar1 = 1;
} else {
if ((param_1[0x29] ^ param_1[0x2a]) == 0x50) {
if ((param_1[0x30] ^ param_1[0x2b]) == 0x1c) {
uVar1 = 1;
} else {
if ((param_1[4] ^ param_1[0x2b]) == 8) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2b] - (int)(char) param_1[0x30] == 0x1a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2b] - (int)(char) param_1[0x2a] == 0x12) {
if ((int)(char) param_1[0x2c] - (int)(char) param_1[0x1b] == -0x37) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x31] + (int)(char) param_1[0x2c] == 0x73) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1f] + (int)(char) param_1[0x2c] == 0xb2) {
uVar1 = 1;
} else {
if ((param_1[0x2b] ^ param_1[0x2c]) == 0x42) {
if ((int)(char) param_1[0x2d] - (int)(char) param_1[10] == 4) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2d] - (int)(char) param_1[0x2b] == -0x42) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3f] + (int)(char) param_1[0x2d] == 0x3d) {
uVar1 = 1;
} else {
if ((param_1[0x2c] ^ param_1[0x2d]) == 6) {
if ((int)(char) param_1[0x16] + (int)(char) param_1[0x2e] == 0x67) {
uVar1 = 1;
} else {
if ((param_1[0x2d] ^ param_1[0x2e]) == 1) {
if ((param_1[0x31] ^ param_1[0x2f]) == 0x56) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2f] - (int)(char) param_1[5] == 0x44) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2b] + (int)(char) param_1[0x2f] == 0xed) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2e] + (int)(char) param_1[0x2f] == 0x9e) {
if ((param_1[0x23] ^ param_1[0x30]) == 0x30) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xb] + (int)(char) param_1[0x30] == 0x9b) {
uVar1 = 1;
} else {
if ((param_1[0x2f] ^ param_1[0x30]) == 0x31) {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0x31] == 0xb2) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x13] + (int)(char) param_1[0x31] == 0xa7) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x31] - (int)(char) param_1[0x1c] == 6) {
uVar1 = 1;
} else {
if ((param_1[0x30] ^ param_1[0x31]) == 0x6b) {
if ((int)(char) param_1[9] + (int)(char) param_1[0x32] == 0xce) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x32] - (int)(char) param_1[8] == 4) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x32] - (int)(char) param_1[0x16] == 0x48) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x32] - (int)(char) param_1[0x31] == 0x3a) {
if ((param_1[0x3c] ^ param_1[0x33]) == 0xd) {
uVar1 = 1;
} else {
if ((param_1[0x11] ^ param_1[0x33]) == 0x42) {
uVar1 = 1;
} else {
if ((param_1[0xc] ^ param_1[0x33]) == 0x55) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x33] - (int)(char) param_1[0x32] == -0x3a) {
if ((int)(char) param_1[0x1c] + (int)(char) param_1[0x34] == 0xa4) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x34] - (int)(char) param_1[0xb] == 0x39) {
uVar1 = 1;
} else {
if ((param_1[0x2d] ^ param_1[0x34]) == 0x5f) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x33] + (int)(char) param_1[0x34] == 0xa0) {
if ((int)(char) param_1[0x35] - (int)(char) param_1[0x13] == 0x11) {
uVar1 = 1;
} else {
if ((param_1[0x14] ^ param_1[0x35]) == 0x1a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x35] - (int)(char) param_1[0x1b] == 6) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x35] - (int)(char) param_1[0x34] == 0xd) {
if (param_1[0x36] == param_1[5]) {
uVar1 = 1;
} else {
if ((param_1[0x12] ^ param_1[0x36]) == 2) {
uVar1 = 1;
} else {
if ((param_1[0x35] ^ param_1[0x36]) == 0x4c) {
if ((int)(char) param_1[0x3c] + (int)(char) param_1[0x37] == 0x6a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x27] + (int)(char) param_1[0x37] == 0x6e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x37] - (int)(char) param_1[4] == -0x46) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x37] - (int)(char) param_1[0x36] == -4) {
if ((int)(char) param_1[0x38] - (int)(char) param_1[0x33] == 0xb) {
uVar1 = 1;
} else {
if ((param_1[2] ^ param_1[0x38]) == 0x7d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x38] - (int)(char) param_1[0x2e] == 8) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x37] + (int)(char) param_1[0x38] == 0x66) {
if ((param_1[0x2f] ^ param_1[0x39]) == 0x27) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x39] - (int)(char) param_1[0x3c] == 0x36) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x34] + (int)(char) param_1[0x39] == 0xd3) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x38] + (int)(char) param_1[0x39] == 0x94) {
if ((param_1[0x12] ^ param_1[0x3a]) == 10) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3a] - (int)(char) param_1[9] == -0x26) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x11] + (int)(char) param_1[0x3a] == 0xa9) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3a] - (int)(char) param_1[0x39] == -0x28) {
if ((int)(char) param_1[0x3b] - (int)(char) param_1[0x2a] == -0x29) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3c] + (int)(char) param_1[0x3b] == 0x66) {
uVar1 = 1;
} else {
if ((param_1[0x2f] ^ param_1[0x3b]) == 0x48) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3b] - (int)(char) param_1[0x3a] == -7) {
if ((param_1[0x11] ^ param_1[0x3c]) == 0x4a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x33] + (int)(char) param_1[0x3c] == 0x65) {
uVar1 = 1;
} else {
if ((param_1[0xe] ^ param_1[0x3c]) == 0x59) {
uVar1 = 1;
} else {
if (param_1[0x3c] == param_1[0x3b]) {
if ((int)(char) param_1[0x3d] - (int)(char) param_1[0x3f] == 0x6a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1a] + (int)(char) param_1[0x3d] == 0xd6) {
uVar1 = 1;
} else {
if ((param_1[0x15] ^ param_1[0x3d]) == 0x19) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3c] + (int)(char) param_1[0x3d] == 0x9c) {
if ((int)(char) param_1[0x3e] - (int)(char) param_1[5] == 0x50) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x19] + (int)(char) param_1[0x3e] == 0xf7) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x31] + (int)(char) param_1[0x3e] == 0xba) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3e] - (int)(char) param_1[0x3d] == 0x11) {
if ((param_1[0x2b] ^ param_1[0x3f]) == 0x75) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x10] + (int)(char) param_1[0x3f] == 0x85) {
uVar1 = 1;
} else {
if ((int)(char) param_1[6] + (int)(char) param_1[0x3f] == 0x80) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3e] + (int)(char) param_1[0x3f] == 0x87) {
uVar1 = 0;
} else {
if ((int)(char) param_1[0x3f] - (int)(char) param_1[9] == -0x4f) {
uVar1 = 1;
} else {
if ((param_1[0x21] ^ param_1[0x3f]) == 0x6e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3f] - (int)(char) param_1[0x26] == -0x52) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x13] ^ param_1[0x3e]) == 6) {
uVar1 = 1;
} else {
if ((param_1[0x36] ^ param_1[0x3e]) == 0x4a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3b] + (int)(char) param_1[0x3e] == 0xb1) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x3d] - (int)(char) param_1[0xe] == 0x16) {
uVar1 = 1;
} else {
if ((param_1[0x35] ^ param_1[0x3d]) == 0x13) {
uVar1 = 1;
} else {
if ((param_1[0x36] ^ param_1[0x3d]) == 0x52) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x1b] + (int)(char) param_1[0x3c] == 0xa9) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3c] - (int)(char) param_1[0x3b] == 5) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3c] - (int)(char) param_1[0x34] == -0x37) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[7] ^ param_1[0x3b]) == 0xb) {
uVar1 = 1;
} else {
if ((param_1[1] ^ param_1[0x3b]) == 100) {
uVar1 = 1;
} else {
if ((param_1[0x2c] ^ param_1[0x3b]) == 0xf) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x29] + (int)(char) param_1[0x3a] == 0x70) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3a] - (int)(char) param_1[0x15] == -0x2f) {
uVar1 = 1;
} else {
if ((param_1[0x32] ^ param_1[0x3a]) == 0x45) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x25] ^ param_1[0x39]) == 0x33) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x30] + (int)(char) param_1[0x39] == 0xc6) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x38] + (int)(char) param_1[0x39] == 0x9e) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x20] + (int)(char) param_1[0x38] == 0xa3) {
uVar1 = 1;
} else {
if ((param_1[6] ^ param_1[0x38]) == 0x40) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x26] + (int)(char) param_1[0x38] == 0x9b) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x37] - (int)(char) param_1[0x2c] == 1) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xc] + (int)(char) param_1[0x37] == 0x94) {
uVar1 = 1;
} else {
if ((param_1[0x29] ^ param_1[0x37]) == 0xd) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x35] ^ param_1[0x36]) == 0x4e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x36] - (int)(char) param_1[0x22] == 0xd) {
uVar1 = 1;
} else {
if (param_1[0x36] == param_1[0x3a]) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x35] - (int)(char) param_1[0xe] == 0x1d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1e] + (int)(char) param_1[0x35] == 0xb4) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x35] - (int)(char) param_1[0xb] == 0x49) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x26] + (int)(char) param_1[0x34] == 0xcd) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x37] + (int)(char) param_1[0x34] == 0xa3) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1b] + (int)(char) param_1[0x34] == 0xe6) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[1] ^ param_1[0x33]) == 0x60) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x33] - (int)(char) param_1[0x20] == -0x32) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x32] - (int)(char) param_1[0xb] == 0x3d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[3] + (int)(char) param_1[0x32] == 0xba) {
uVar1 = 1;
} else {
if ((param_1[0x28] ^ param_1[0x32]) == 0x11) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[10] ^ param_1[0x31]) == 0xe) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x23] + (int)(char) param_1[0x31] == 0xa2) {
uVar1 = 1;
} else {
if ((int)(char) param_1[7] + (int)(char) param_1[0x31] == 0x6d) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x2d] + (int)(char) param_1[0x30] == 0x99) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x31] + (int)(char) param_1[0x30] == 0x98) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x13] + (int)(char) param_1[0x30] == 0xd8) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x26] + (int)(char) param_1[0x2f] == 0xd1) {
uVar1 = 1;
} else {
if ((param_1[9] ^ param_1[0x2f]) == 0xd) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((param_1[0x20] ^ param_1[0x2e]) == 0x40) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xd] + (int)(char) param_1[0x2e] == 0x6c) {
uVar1 = 1;
} else {
if ((param_1[0x2f] ^ param_1[0x2e]) == 0x45) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
} else {
if ((param_1[0x1a] ^ param_1[0x2d]) == 0x5e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1d] + (int)(char) param_1[0x2d] == 0x95) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2d] - (int)(char) param_1[0x3a] == 1) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0xe] ^ param_1[0x2c]) == 0x50) {
uVar1 = 1;
} else {
if ((param_1[0x16] ^ param_1[0x2c]) == 5) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x30] + (int)(char) param_1[0x2c] == 0x9d) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x37] + (int)(char) param_1[0x2b] == 0xac) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x11] + (int)(char) param_1[0x2b] == 0xed) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2b] - (int)(char) param_1[0x2d] == 0x4d) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[2] ^ param_1[0x2a]) == 0x2b) {
uVar1 = 1;
} else {
if ((param_1[0x3f] ^ param_1[0x2a]) == 0x6e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2a] - (int)(char) param_1[0x27] == 0x36) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x38] + (int)(char) param_1[0x29] == 0x6c) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x27] + (int)(char) param_1[0x29] == 0x69) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x29] - (int)(char) param_1[0x10] == -0x3d) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x2e] ^ param_1[0x28]) == 0x4d) {
uVar1 = 1;
} else {
if ((param_1[0x37] ^ param_1[0x28]) == 0x43) {
uVar1 = 1;
} else {
if ((param_1[0x12] ^ param_1[0x28]) == 0x42) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x12] ^ param_1[0x27]) == 0xb) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x34] + (int)(char) param_1[0x27] == 0xa7) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2a] + (int)(char) param_1[0x27] == 0x98) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x26] - (int)(char) param_1[0x22] == 0x38) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x26] - (int)(char) param_1[0x1f] == -0x19) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x26] - (int)(char) param_1[0x2b] == -0x14) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[6] + (int)(char) param_1[0x25] == 0xd9) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
} else {
if ((int)(char) param_1[0x15] + (int)(char) param_1[0x24] == 0xa2) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x24] - (int)(char) param_1[0x1a] == -0x2e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[9] + (int)(char) param_1[0x24] == 0x9a) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x2b] ^ param_1[0x23]) == 0x17) {
uVar1 = 1;
} else {
if ((param_1[0x36] ^ param_1[0x23]) == 0x50) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x23] - (int)(char) param_1[0x30] == 0x17) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x22] - (int)(char) param_1[0x30] == -0x26) {
uVar1 = 1;
} else {
if ((param_1[0x3b] ^ param_1[0x22]) == 3) {
uVar1 = 1;
} else {
if ((param_1[0x19] ^ param_1[0x22]) == 0x48) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x11] + (int)(char) param_1[0x21] == 0xdc) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x15] + (int)(char) param_1[0x21] == 0xd7) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0x21] == 0xe0) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x31] ^ param_1[0x20]) == 0x53) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0x20] == 0xea) {
uVar1 = 1;
} else {
if ((param_1[0xd] ^ param_1[0x20]) == 0x55) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x32] ^ param_1[0x1f]) == 0xe) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x28] + (int)(char) param_1[0x1f] == 0xf8) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x21] + (int)(char) param_1[0x1f] == 0xe1) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x27] + (int)(char) param_1[0x1e] == 0x69) {
uVar1 = 1;
} else {
if ((param_1[8] ^ param_1[0x1e]) == 0x40) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1e] - (int)(char) param_1[0x25] == -0x29) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x15] ^ param_1[0x1d]) == 0x29) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x23] + (int)(char) param_1[0x1d] == 0xd4) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1d] - (int)(char) param_1[0xb] == 0x31) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x16] ^ param_1[0x1c]) == 8) {
uVar1 = 1;
} else {
if ((param_1[0x16] ^ param_1[0x1c]) == 9) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x2c] + (int)(char) param_1[0x1c] == 0x71) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x1b] - (int)(char) param_1[0x3d] == 0xe) {
uVar1 = 1;
} else {
if ((int)(char) param_1[2] + (int)(char) param_1[0x1b] == 0xbf) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3e] + (int)(char) param_1[0x1b] == 0xfc) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x3c] ^ param_1[0x1a]) == 0x53) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1a] - (int)(char) param_1[0x33] == 0x34) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1a] - (int)(char) param_1[0x24] == 0x37) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((param_1[1] ^ param_1[0x19]) == 0x23) {
uVar1 = 1;
} else {
if ((param_1[4] ^ param_1[0x19]) == 0xc) {
uVar1 = 1;
} else {
if ((param_1[0x1f] ^ param_1[0x19]) == 9) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[7] ^ param_1[0x18]) == 9) {
uVar1 = 1;
} else {
if ((param_1[0x12] ^ param_1[0x18]) == 4) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x18] - (int)(char) param_1[0x14] == -0x2b) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x17] - (int)(char) param_1[0x1d] == 0x22) {
uVar1 = 1;
} else {
if ((param_1[0x25] ^ param_1[0x17]) == 0x1e) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x11] + (int)(char) param_1[0x16] == 0xa5) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x31] + (int)(char) param_1[0x16] == 0x65) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0x16] == 0xad) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x15] - (int)(char) param_1[0x12] == 0x44) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x1e] + (int)(char) param_1[0x15] == 0xad) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x15] - (int)(char) param_1[0x1d] == 0x12) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x14] - (int)(char) param_1[0x1e] == 0x34) {
uVar1 = 1;
} else {
if ((int)(char) param_1[9] + (int)(char) param_1[0x14] == 0xbf) {
uVar1 = 1;
} else {
if ((param_1[0x2d] ^ param_1[0x14]) == 0x6a) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x13] - (int)(char) param_1[5] == 0x42) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x13] - (int)(char) param_1[0x1c] == 0x48) {
uVar1 = 1;
} else {
if ((param_1[0xf] ^ param_1[0x13]) == 0x4a) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[6] ^ param_1[0x12]) == 0x5c) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x12] - (int)(char) param_1[0x23] == -0x31) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xd] + (int)(char) param_1[0x12] == 0x6e) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x11] - (int)(char) param_1[0x3c] == 0x41) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x11] - (int)(char) param_1[7] == 0x3f) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0x11] == 0xea) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[1] + (int)(char) param_1[0x10] == 0xc5) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x15] + (int)(char) param_1[0x10] == 0xeb) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x10] - (int)(char) param_1[0x1e] == 0x41) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x29] + (int)(char) param_1[0xf] == 0x69) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0xf] == 0xb5) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xf] - (int)(char) param_1[0x33] == 3) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0xe] - (int)(char) param_1[0x31] == 0x34) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3d] + (int)(char) param_1[0xe] == 0xcc) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x17] + (int)(char) param_1[0xe] == 0xd8) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x3a] ^ param_1[0xd]) == 0xd) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xd] - (int)(char) param_1[0x32] == -0x37) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xd] - (int)(char) param_1[0x23] == -0x37) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x32] + (int)(char) param_1[0xc] == 0xcf) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x27] + (int)(char) param_1[0xc] == 0x95) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xc] - (int)(char) param_1[0xe] == 4) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0xb] - (int)(char) param_1[0x23] == -0x2d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xb] - (int)(char) param_1[0x16] == 10) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0xb] - (int)(char) param_1[0x15] == -0x32) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[10] - (int)(char) param_1[0x3d] == -0x33) {
uVar1 = 1;
} else {
if ((param_1[0x31] ^ param_1[10]) == 0xc) {
uVar1 = 1;
} else {
if ((param_1[0x21] ^ param_1[10]) == 0x5a) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((int)(char) param_1[9] - (int)(char) param_1[0xb] == 0x32) {
uVar1 = 1;
} else {
if ((param_1[0x1a] ^ param_1[9]) == 0x33) {
uVar1 = 1;
} else {
if ((int)(char) param_1[9] - (int)(char) param_1[0x2b] == -0x13) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x35] + (int)(char) param_1[8] == 0xf4) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x3f] + (int)(char) param_1[8] == 0x86) {
uVar1 = 1;
} else {
if ((int)(char) param_1[8] - (int)(char) param_1[0x2a] == 0x15) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0xb] + (int)(char) param_1[7] == 0x6e) {
uVar1 = 1;
} else {
if ((int)(char) param_1[5] + (int)(char) param_1[7] == 0x72) {
uVar1 = 1;
} else {
if (param_1[7] == param_1[0x3b]) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x38] ^ param_1[6]) == 0x58) {
uVar1 = 1;
} else {
if ((int)(char) param_1[6] - (int)(char) param_1[0x2a] == 0x11) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x10] + (int)(char) param_1[6] == 0xeb) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((param_1[0x1c] ^ param_1[5]) == 0xf) {
uVar1 = 1;
} else {
if ((int)(char) param_1[5] - (int)(char) param_1[0x17] == -0x41) {
uVar1 = 1;
} else {
if ((param_1[0x1c] ^ param_1[5]) == 0xe) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((param_1[0x2a] ^ param_1[4]) == 0x11) {
uVar1 = 1;
} else {
if ((param_1[0x18] ^ param_1[4]) == 0x41) {
uVar1 = 1;
} else {
if ((int)(char) param_1[4] - (int)(char) param_1[5] == 0x4f) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0xc] + (int)(char) param_1[3] == 0xab) {
uVar1 = 1;
} else {
if ((int)(char) param_1[3] - (int)(char) param_1[0x11] == -0x26) {
uVar1 = 1;
} else {
if ((int)(char) param_1[3] - (int)(char) param_1[0x1d] == -0x11) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x32] + (int)(char) param_1[2] == 0xb8) {
uVar1 = 1;
} else {
if ((int)(char) param_1[6] + (int)(char) param_1[2] == 0xb7) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
} else {
if ((param_1[0xd] ^ param_1[1]) == 0x74) {
uVar1 = 1;
} else {
if ((int)(char) param_1[1] - (int)(char) param_1[0x1c] == 0x1d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[1] - (int)(char) param_1[10] == 0x1f) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
} else {
if ((int)(char) param_1[0x36] + (int)(char) * param_1 == 0x7d) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x37] + (int)(char) * param_1 == 0x7a) {
uVar1 = 1;
} else {
if ((int)(char) param_1[0x10] + (int)(char) * param_1 == 0xc3) {
uVar1 = 1;
} else {
uVar1 = 1;
}
}
}
}
}
}
}
return uVar1;
}
原因は，今まで発見できていなかった
if (param_1[0x3c] == param_1[0x3b]) {
のパターン。
これに対処した最終版の Ghidra Script
solver.py
# coding: UTF-8
# solver for WaniCTF'21-spring licence
# author @housu_jp
# ダミーif文のカウント
dummy_count = 0
# flagを導けるif文のカウント
calc_count = 0
# FLAG{の A を求めるところから開始
start_addr = toAddr(0x001013a9)
# flagの開始は，"FLAG{
# flagの文字長は63
flag=[70,76,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
# モドポスちゃん。即値がif文の左辺のものか右辺のものかを特定するために使う y , x を交互に設定
mod_pos = "y"
# if文で使われる添え字や即値を格納する変数
# xorのif文を例にするとこんな感じ if flag[x] ^ flag[y] == z:
x=-1
y=-1
z=-1
# XOR SUB ADD などを保存，flagがとれるif文とわかった時だけ計算するので，いったん保存しておく
sv_opcode = ""
# １件目のコードの読み込み
inst = getInstructionAt(start_addr)
mnemonic = inst.getMnemonicString()
dst = inst.getOpObjects(0)
src = inst.getOpObjects(1)
end_flag = 0
while end_flag < 1:
#print(mnemonic)
#print(dst)
#print(src)
# uVar1 = 1;を検出したら，sv_opcodeコードをクリアし，計算しない。
if mnemonic == 'MOV':
if isinstance(dst[0], ghidra.program.model.lang.Register):
if dst[0].getName() == 'EAX':
if not isinstance(src[0], ghidra.program.model.lang.Register):
if inst.getOpObjects(1)[0].getValue() == 0x1:
sv_opcode = ""
dummy_count = dummy_count + 1
# MOV RAX, qword ptr [RBP + local_10]がこのスクリプトのキモ
if mnemonic == 'MOV':
if isinstance(dst[0], ghidra.program.model.lang.Register):
if dst[0].getName() == 'RAX':
if isinstance(src[0], ghidra.program.model.lang.Register):
if src[0].getName() == 'RBP':
if src[1].getValue() == -0x8:
# sv_opcodeが設定された状態で，このパターンを検出すると
# x,yを取得する前に保存していた式からflagを計算する
if not sv_opcode == "":
if sv_opcode == "XOR":
#print("XOR")
flag[y] = flag[x] ^ z
if sv_opcode == "ADD":
#print("ADD")
flag[y] = z - flag[x]
if sv_opcode == "SUB":
#print("SUB")
flag[y] = flag[x] + z
calc_count = calc_count + 1
#print("calc_count="+str(calc_count))
sv_opcode = ""
# y の値を取得する状態の場合
if mod_pos == "y":
# 次のコードに進める
inst = inst.getNext()
mnemonic = inst.getMnemonicString()
dst = inst.getOpObjects(0)
src = inst.getOpObjects(1)
# flag[0]に即値をADDしている場合は次にADDが来る
if mnemonic == 'ADD':
y = inst.getOpObjects(1)[0].getValue()
# ADDが来なけりゃflag[0]
else:
y = 0
#print("y= "+str(hex(y)))
# 状態を y から x に遷移させる
mod_pos = "x"
# x の値を取得する状態の場合
elif mod_pos == "x":
# 次のコードに進める
inst = inst.getNext()
mnemonic = inst.getMnemonicString()
dst = inst.getOpObjects(0)
src = inst.getOpObjects(1)
# flag[0]に即値をADDしている場合は次にADDが来る
if mnemonic == 'ADD':
x = inst.getOpObjects(1)[0].getValue()
# ADDが来なけりゃflag[0]
else:
x = 0
#print("x= "+str(hex(x)))
# 状態を x から y に遷移させる
mod_pos = "y"
# if文がXOR
if mnemonic == 'XOR':
sv_opcode = "XOR"
# if文がADD
if mnemonic == 'ADD':
if isinstance(dst[0], ghidra.program.model.lang.Register):
if dst[0].getName() == 'EAX':
if isinstance(src[0], ghidra.program.model.lang.Register):
if src[0].getName() == 'EDX':
sv_opcode = "ADD"
# if文がSUB
if mnemonic == 'SUB':
sv_opcode = "SUB"
# 例外処理（１か所だけ，XOR，ADD，SUBを使わないif文があった）
# if (param_1[0x3c] == param_1[0x3b]) { に対応するための
if mnemonic == 'CMP':
if isinstance(dst[0], ghidra.program.model.lang.Register):
if dst[0].getName() == 'DL':
if isinstance(src[0], ghidra.program.model.lang.Register):
if src[0].getName() == 'AL':
flag[y] = flag[x]
sv_opcode = ""
calc_count = calc_count + 1
#print("calc_count="+str(calc_count))
# CMPの即値から z を保存する処理
if mnemonic == 'CMP':
if not isinstance(src[0], ghidra.program.model.lang.Register):
z = inst.getOpObjects(1)[0].getValue()
#print("z= "+str(hex(z)))
# 無限ループ全体のインクリメント処理
inst = inst.getNext()
mnemonic = inst.getMnemonicString()
dst = inst.getOpObjects(0)
src = inst.getOpObjects(1)
# 終了判定（uVar1 = 0;）
if mnemonic == 'MOV':
if isinstance(dst[0], ghidra.program.model.lang.Register):
if dst[0].getName() == 'EAX':
if not isinstance(src[0], ghidra.program.model.lang.Register):
if inst.getOpObjects(1)[0].getValue() == 0x0:
end_flag = 1
print("calc_count="+str(calc_count))
print("dummy_count="+str(dummy_count))
print(flag)
print("flag="+''.join(map(chr,flag)))
実行結果
やったぜ！ Ghidraの静的解析で angr問題を倒したぜい！
ちなみに，昨日の15時から着手し，のべ11時間かかりました。
作問者writeup
参考にしたサイト