結束了呢

拔丝溜肆 (easy)

拉入IDA，找到加密函數，發現是個魔改的base64，它在每次加密前先調用了change_table()，進入查看

Untitled

根據隨機數來打亂base64的編碼表，而隨機數的亂數種已在main函數中給出，故可直接寫腳本解密

Untitled

這base64解密腳本是我之前學base64時手寫的，寫的很爛，但能用就行

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
#include<iostream>
#include<string>
using namespace std;

string codeTableForBase32And64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

string table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

/********************  BaseN解密   *************************/
string baseN_decode(string str, int N) {
	string s = table;

	//計算位數
	int bitSize = 0;
	while (N != 1) {
		N /= 2;
		bitSize++;
	}
	bitSize--;

	//逆向過程：
	string tmpStr = "";
	for (auto ch : str) {
		int i;
		if (ch == '=') {
			tmpStr += (char)0;
			continue;
		}

		for (i = 0; s[i] != ch; i++);
		tmpStr += (char)i;

	}
	int mark; //用來取得每個bit

	int tmp = 0;
	string res = "";
	int curBit = 7;

	//遍歷每個字符
	for (auto ch : tmpStr) {
		mark = 1;
		mark <<= bitSize; //只取後bitSize位

		while (mark) {
			//讀完8個bit後，將tmp值轉為字符串加到res中
			if (curBit < 0) {
				res += (char)tmp;
				tmp = 0;
				curBit = 7;
			}
			//2進制位轉為10進制
			if ((ch & mark) != 0) {
				tmp += pow(2, curBit);
			}
			curBit--;
			mark >>= 1;

		}
	}
	/* 處理最尾的部分 */
	if (curBit < 0) {
		res += (char)tmp;
	}
	return res;
}

void change_table_0()
{
	size_t result; // rax
	int v1; // [rsp+24h] [rbp+4h]
	int i; // [rsp+44h] [rbp+24h]

	v1 = rand() % 64;
	for (i = 0; i < 64; ++i)
	{
		table[i] = codeTableForBase32And64[(v1 + i) % 64];
	}
}

int main() {
	string enc = "CPaKBfUZFcNwW9qCKgyvuS2PGPQ9mttGc/wCNS0w6hDwGOSsOkOEkL5V";
	srand(0x1BF52u);
	int v1;
	for (int i = 0; i < 42; i += 3) {
		string tmp = enc;
		change_table_0();
		string res = baseN_decode(tmp, 64);
		for (int j = i; j < i + 3; j++)cout << res[j];
	}

}

E4sy_Mix (hard)

在main函數中看到下圖3處，可以看出在第3個紅框的地方進行了函數調用，而在此之前對loc_402000~`loc_402000+53`的地址進行了異或操作，所以可以看出這題考的是SMC自解密

Untitled

  • 通常做法是用ida的腳本先將loc_402000,loc_402000+53這區域的值異或0x54，將其還原成sub_402000函數
  • 點擊IDA左上的File→Script command…，Scripting language我用的是IDC
1
2
3
4
5
6
7
auto addr = 0x402000;
auto i = 0;
for(i = 0;i<53;i++){
     auto val = Byte(addr+i);
     val = val^0x54;
     PatchByte((addr+i),val);
}
  • 執行完腳本後，可以看到第1句匯編變成了push ebp，明顯符合函數的特徵
  • 然後選中該範圍→按u
  • 再選中該範圍→按c，選Analyze
  • 最後再選中該範圍→按p生成為函數，然後就可以按F5了

Untitled

看到有兩個函數，先進入sub_401080

Untitled

可以看出應該是RC4的初始化函數，key在byte_404018中，再進入sub_401110

Untitled

果然是RC4加密，且沒有任何修改，可直接解密

Untitled

Untitled

Virtual Self (middle)

可以看出這是一題最基礎的虛擬機類型的題目，先把所有操作打印出來看看

Untitled

  • 打印出來的結果如下 ( 打印的腳本與解密的腳本一同寫在了下方 )
  • 分析後發現加密流程為：取出input[i]放到reg[0]中 ( 每個input[i]都會且只會被取出一次 )，然後進行各種+、-、^ 操作，最後將reg[0]賦回給input[i]
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
reg[0] (123) = input[3] (123)
reg[1] (181) = 181
reg[2] (222) = 222
reg[3] (161) = 161
reg[1] (20) -= reg[3] (161)
reg[3] (0) -= reg[3] (0)
reg[0] (125) += 2
reg[0] (105) ^= reg[1] (20)
reg[3] (20) ^= reg[1] (20)
reg[0] (105) -= 0
reg[3] (0) -= reg[3] (0)
reg[1] (242) += reg[2] (222)
reg[0] (103) -= 2
reg[0] (103) -= 0
input[3] (103) = reg[0] (103)
reg[0] (27) = input[10] (27)
reg[1] (97) = 97
reg[2] (113) = 113
reg[3] (122) = 122
reg[0] (24) ^= 3
reg[0] (121) ^= reg[1] (97)
reg[3] (235) += reg[2] (113)
reg[2] (16) ^= reg[1] (97)
reg[2] (-219) -= reg[3] (235)
reg[0] (121) -= 0
reg[2] (-454) -= reg[3] (235)
reg[1] (-138) -= reg[3] (235)
reg[2] (-689) -= reg[3] (235)
reg[0] (121) += 0
input[10] (121) = reg[0] (121)
reg[0] (95) = input[17] (95)
reg[1] (197) = 197
reg[2] (162) = 162
reg[3] (123) = 123
reg[1] (359) += reg[2] (162)
reg[0] (94) ^= 1
reg[2] (453) ^= reg[1] (359)
reg[0] (94) += 0
reg[1] (0) ^= reg[1] (0)
reg[0] (94) ^= 0
reg[3] (123) ^= reg[1] (0)
reg[0] (92) -= 2
reg[1] (-123) -= reg[3] (123)
reg[0] (95) ^= 3
input[17] (95) = reg[0] (95)
reg[0] (151) = input[22] (151)
reg[1] (140) = 140
reg[2] (230) = 230
reg[3] (252) = 252
reg[0] (149) -= 2
reg[2] (106) ^= reg[1] (140)
reg[0] (-103) -= reg[3] (252)
reg[0] (-101) += 2
reg[0] (-102) ^= 1
reg[2] (230) ^= reg[1] (140)
reg[1] (0) ^= reg[1] (0)
reg[1] (230) += reg[2] (230)
reg[3] (482) += reg[2] (230)
reg[0] (-132) ^= reg[1] (230)
input[22] (124) = reg[0] (-132)
reg[0] (42) = input[5] (42)
reg[1] (74) = 74
reg[2] (112) = 112
reg[3] (23) = 23
reg[0] (19) -= reg[3] (23)
reg[0] (89) ^= reg[1] (74)
reg[0] (88) -= 1
reg[0] (65) -= reg[3] (23)
reg[0] (65) += 0
reg[0] (177) += reg[2] (112)
reg[0] (251) ^= reg[1] (74)
reg[0] (250) ^= 1
reg[0] (250) -= 0
reg[0] (251) += 1
input[5] (251) = reg[0] (251)
reg[0] (132) = input[0] (132)
reg[1] (31) = 31
reg[2] (11) = 11
reg[3] (217) = 217
reg[0] (-85) -= reg[3] (217)
reg[0] (-74) += reg[2] (11)
reg[0] (-74) ^= 0
reg[0] (-76) -= 2
reg[3] (228) += reg[2] (11)
reg[0] (-76) ^= 0
reg[3] (0) -= reg[3] (0)
reg[0] (-85) ^= reg[1] (31)
reg[0] (-88) -= 3
reg[0] (-86) ^= 2
input[0] (170) = reg[0] (-86)
reg[0] (99) = input[7] (99)
reg[1] (183) = 183
reg[2] (240) = 240
reg[3] (86) = 86
reg[0] (98) -= 1
reg[1] (0) ^= reg[1] (0)
reg[0] (96) ^= 2
reg[2] (154) -= reg[3] (86)
reg[3] (86) ^= reg[1] (0)
reg[0] (95) -= 1
reg[3] (86) ^= reg[1] (0)
reg[0] (92) -= 3
reg[2] (68) -= reg[3] (86)
reg[0] (90) -= 2
input[7] (90) = reg[0] (90)
reg[0] (153) = input[25] (153)
reg[1] (198) = 198
reg[2] (128) = 128
reg[3] (78) = 78
reg[0] (75) -= reg[3] (78)
reg[0] (75) += 0
reg[0] (203) += reg[2] (128)
reg[2] (50) -= reg[3] (78)
reg[0] (202) ^= 1
reg[0] (204) += 2
reg[2] (-28) -= reg[3] (78)
reg[0] (202) -= 2
reg[1] (120) -= reg[3] (78)
reg[0] (200) -= 2
input[25] (200) = reg[0] (200)
reg[0] (102) = input[23] (102)
reg[1] (198) = 198
reg[2] (212) = 212
reg[3] (41) = 41
reg[1] (0) ^= reg[1] (0)
reg[0] (100) -= 2
reg[0] (101) ^= 1
reg[0] (102) ^= 3
reg[0] (105) += 3
reg[3] (41) ^= reg[1] (0)
reg[0] (102) -= 3
reg[0] (102) -= 0
reg[0] (101) ^= 3
reg[2] (212) ^= reg[1] (0)
input[23] (101) = reg[0] (101)
reg[0] (150) = input[14] (150)
reg[1] (80) = 80
reg[2] (228) = 228
reg[3] (249) = 249
reg[0] (-99) -= reg[3] (249)
reg[3] (169) ^= reg[1] (80)
reg[2] (456) += reg[2] (456)
reg[0] (-99) += 0
reg[0] (-98) += 1
reg[0] (-267) -= reg[3] (169)
reg[0] (-268) -= 1
reg[3] (249) ^= reg[1] (80)
reg[0] (-271) -= 3
reg[0] (185) += reg[2] (456)
input[14] (185) = reg[0] (185)
reg[0] (103) = input[19] (103)
reg[1] (109) = 109
reg[2] (7) = 7
reg[3] (1) = 1
reg[0] (103) -= 0
reg[0] (103) ^= 0
reg[1] (108) -= reg[3] (1)
reg[2] (14) += reg[2] (14)
reg[0] (102) -= 1
reg[3] (109) ^= reg[1] (108)
reg[0] (102) += 0
reg[2] (98) ^= reg[1] (108)
reg[0] (102) += 0
reg[1] (206) += reg[2] (98)
input[19] (102) = reg[0] (102)
reg[0] (252) = input[26] (252)
reg[1] (177) = 177
reg[2] (58) = 58
reg[3] (79) = 79
reg[0] (310) += reg[2] (58)
reg[0] (391) ^= reg[1] (177)
reg[0] (389) ^= 2
reg[2] (-21) -= reg[3] (79)
reg[0] (368) += reg[2] (-21)
reg[0] (365) -= 3
reg[0] (362) -= 3
reg[0] (359) -= 3
reg[1] (156) += reg[2] (-21)
reg[0] (356) ^= 3
input[26] (100) = reg[0] (356)
reg[0] (205) = input[20] (205)
reg[1] (149) = 149
reg[2] (4) = 4
reg[3] (70) = 70
reg[0] (207) ^= 2
reg[2] (8) += reg[2] (8)
reg[0] (215) += reg[2] (8)
reg[0] (223) += reg[2] (8)
reg[2] (157) ^= reg[1] (149)
reg[0] (222) ^= 1
reg[2] (87) -= reg[3] (70)
reg[3] (157) += reg[2] (87)
reg[1] (-8) -= reg[3] (157)
reg[0] (309) += reg[2] (87)
input[20] (53) = reg[0] (309)
reg[0] (60) = input[2] (60)
reg[1] (244) = 244
reg[2] (122) = 122
reg[3] (24) = 24
reg[1] (366) += reg[2] (122)
reg[0] (36) -= reg[3] (24)
reg[3] (146) += reg[2] (122)
reg[2] (244) += reg[2] (244)
reg[0] (36) += 0
reg[3] (508) ^= reg[1] (366)
reg[0] (38) += 2
reg[0] (282) += reg[2] (244)
reg[0] (282) += 0
reg[0] (279) -= 3
input[2] (23) = reg[0] (279)
reg[0] (123) = input[18] (123)
reg[1] (218) = 218
reg[2] (19) = 19
reg[3] (154) = 154
reg[1] (237) += reg[2] (19)
reg[0] (120) ^= 3
reg[0] (120) -= 0
reg[0] (149) ^= reg[1] (237)
reg[0] (148) ^= 1
reg[3] (119) ^= reg[1] (237)
reg[0] (121) ^= reg[1] (237)
reg[0] (123) += 2
reg[0] (126) += 3
reg[1] (118) -= reg[3] (119)
input[18] (126) = reg[0] (126)
reg[0] (185) = input[4] (185)
reg[1] (216) = 216
reg[2] (42) = 42
reg[3] (188) = 188
reg[0] (187) ^= 2
reg[1] (28) -= reg[3] (188)
reg[0] (188) += 1
reg[0] (230) += reg[2] (42)
reg[0] (250) ^= reg[1] (28)
reg[3] (0) -= reg[3] (0)
reg[0] (249) -= 1
reg[3] (28) ^= reg[1] (28)
reg[0] (251) += 2
reg[0] (251) ^= 0
input[4] (251) = reg[0] (251)
reg[0] (108) = input[6] (108)
reg[1] (110) = 110
reg[2] (74) = 74
reg[3] (53) = 53
reg[0] (111) ^= 3
reg[0] (113) += 2
reg[1] (57) -= reg[3] (53)
reg[3] (12) ^= reg[1] (57)
reg[0] (114) ^= 3
reg[0] (111) -= 3
reg[3] (0) -= reg[3] (0)
reg[0] (109) -= 2
reg[0] (112) += 3
reg[0] (111) -= 1
input[6] (111) = reg[0] (111)
reg[0] (8) = input[11] (8)
reg[1] (112) = 112
reg[2] (4) = 4
reg[3] (174) = 174
reg[0] (6) -= 2
reg[0] (10) += reg[2] (4)
reg[1] (-62) -= reg[3] (174)
reg[1] (-58) += reg[2] (4)
reg[0] (12) += 2
reg[0] (9) -= 3
reg[0] (-49) ^= reg[1] (-58)
reg[0] (-223) -= reg[3] (174)
reg[1] (0) ^= reg[1] (0)
reg[0] (-223) ^= 0
input[11] (33) = reg[0] (-223)
reg[0] (134) = input[21] (134)
reg[1] (153) = 153
reg[2] (7) = 7
reg[3] (229) = 229
reg[1] (160) += reg[2] (7)
reg[0] (133) ^= 3
reg[3] (236) += reg[2] (7)
reg[0] (-103) -= reg[3] (236)
reg[0] (-339) -= reg[3] (236)
reg[0] (-339) -= 0
reg[0] (-342) -= 3
reg[0] (-344) ^= 2
reg[3] (0) -= reg[3] (0)
reg[0] (-341) += 3
input[21] (171) = reg[0] (-341)
reg[0] (114) = input[9] (114)
reg[1] (119) = 119
reg[2] (10) = 10
reg[3] (0) = 0
reg[0] (113) -= 1
reg[2] (20) += reg[2] (20)
reg[0] (133) += reg[2] (20)
reg[0] (135) += 2
reg[3] (20) += reg[2] (20)
reg[0] (138) += 3
reg[1] (0) ^= reg[1] (0)
reg[0] (137) -= 1
reg[0] (139) ^= 2
reg[0] (137) -= 2
input[9] (137) = reg[0] (137)
reg[0] (129) = input[28] (129)
reg[1] (28) = 28
reg[2] (18) = 18
reg[3] (246) = 246
reg[0] (130) += 1
reg[0] (130) += 0
reg[0] (129) -= 1
reg[3] (264) += reg[2] (18)
reg[3] (276) ^= reg[1] (28)
reg[0] (132) += 3
reg[0] (152) ^= reg[1] (28)
reg[0] (153) += 1
reg[0] (133) ^= reg[1] (28)
reg[1] (-248) -= reg[3] (276)
input[28] (133) = reg[0] (133)
reg[0] (136) = input[15] (136)
reg[1] (165) = 165
reg[2] (53) = 53
reg[3] (177) = 177
reg[0] (139) ^= 3
reg[0] (139) += 0
reg[3] (20) ^= reg[1] (165)
reg[2] (33) -= reg[3] (20)
reg[0] (139) -= 0
reg[0] (137) -= 2
reg[0] (138) ^= 3
reg[0] (171) += reg[2] (33)
reg[1] (145) -= reg[3] (20)
reg[3] (133) ^= reg[1] (145)
input[15] (171) = reg[0] (171)
reg[0] (134) = input[16] (134)
reg[1] (227) = 227
reg[2] (190) = 190
reg[3] (97) = 97
reg[0] (136) += 2
reg[0] (136) -= 0
reg[0] (107) ^= reg[1] (227)
reg[0] (109) += 2
reg[1] (0) ^= reg[1] (0)
reg[0] (109) ^= 0
reg[0] (106) -= 3
reg[2] (93) -= reg[3] (97)
reg[1] (0) ^= reg[1] (0)
reg[0] (109) += 3
input[16] (109) = reg[0] (109)
reg[0] (164) = input[8] (164)
reg[1] (43) = 43
reg[2] (53) = 53
reg[3] (212) = 212
reg[0] (143) ^= reg[1] (43)
reg[0] (144) += 1
reg[0] (144) -= 0
reg[0] (147) += 3
reg[0] (144) -= 3
reg[3] (255) ^= reg[1] (43)
reg[2] (106) += reg[2] (106)
reg[2] (65) ^= reg[1] (43)
reg[0] (187) ^= reg[1] (43)
reg[0] (252) += reg[2] (65)
input[8] (252) = reg[0] (252)
reg[0] (31) = input[1] (31)
reg[1] (176) = 176
reg[2] (178) = 178
reg[3] (91) = 91
reg[1] (0) ^= reg[1] (0)
reg[0] (209) += reg[2] (178)
reg[1] (-91) -= reg[3] (91)
reg[0] (209) ^= 0
reg[0] (209) ^= 0
reg[0] (209) -= 0
reg[2] (356) += reg[2] (356)
reg[0] (209) -= 0
reg[1] (-182) -= reg[3] (91)
reg[0] (208) ^= 1
input[1] (208) = reg[0] (208)
reg[0] (95) = input[13] (95)
reg[1] (232) = 232
reg[2] (57) = 57
reg[3] (244) = 244
reg[2] (114) += reg[2] (114)
reg[0] (95) ^= 0
reg[0] (93) ^= 2
reg[3] (358) += reg[2] (114)
reg[2] (228) += reg[2] (228)
reg[2] (-130) -= reg[3] (358)
reg[0] (93) ^= 0
reg[2] (-106) ^= reg[1] (232)
reg[0] (94) ^= 3
reg[0] (95) ^= 1
input[13] (95) = reg[0] (95)
reg[0] (100) = input[24] (100)
reg[1] (114) = 114
reg[2] (161) = 161
reg[3] (124) = 124
reg[0] (101) ^= 1
reg[2] (322) += reg[2] (322)
reg[0] (101) += 0
reg[0] (101) ^= 0
reg[0] (101) += 0
reg[0] (101) -= 0
reg[0] (102) ^= 3
reg[3] (446) += reg[2] (322)
reg[0] (101) -= 1
reg[3] (0) -= reg[3] (0)
input[24] (101) = reg[0] (101)
reg[0] (118) = input[12] (118)
reg[1] (152) = 152
reg[2] (181) = 181
reg[3] (43) = 43
reg[0] (117) ^= 3
reg[0] (115) -= 2
reg[0] (115) -= 0
reg[0] (118) += 3
reg[3] (179) ^= reg[1] (152)
reg[0] (116) -= 2
reg[0] (117) += 1
reg[2] (362) += reg[2] (362)
reg[0] (117) += 0
reg[0] (117) ^= 0
input[12] (117) = reg[0] (117)
reg[0] (125) = input[27] (125)
reg[1] (141) = 141
reg[2] (57) = 57
reg[3] (78) = 78
reg[0] (122) -= 3
reg[0] (123) += 1
reg[0] (126) += 3
reg[0] (127) ^= 1
reg[0] (129) += 2
reg[1] (63) -= reg[3] (78)
reg[3] (135) += reg[2] (57)
reg[0] (129) -= 0
reg[0] (130) += 1
reg[0] (187) += reg[2] (57)
input[27] (187) = reg[0] (187)

所以我的解密思路為，按正常加密流程將所有xor、add、sub的值記錄下來，然後反向執行這些操作，實現解密，腳本如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
#include <stdint.h>
#include <iostream>
#include <Windows.h>
#include <vector>
using namespace std;

#define LODWORD(x)  (*((DWORD*)&(x)))  // low dword
#define WORDn(x, n)   (*((WORD*)&(x)+n))
#define WORD2(x)   WORDn(x,  2)

using _BYTE = BYTE;
using _QWORD = unsigned long long;

_QWORD reg[4] = { 0 };
vector<int> xorNum;
vector<int> subNum;
vector<int> addNum;
int i1 = 0, i2 = 0, i3 = 0;

_BYTE* __fastcall mov(unsigned __int8* a1, __int64* input)
{
    _BYTE result; // rax

    if (a1[1])
    {
        if (a1[1] == 1)                           // input[i]->reg
        {
            result = *((char*)input + a1[3]);
            reg[a1[2] - 0xD0] = result;
            printf("reg[%d] (%d) = input[%d] (%d)\n", (int)(a1[2] - 0xD0), (int)(reg[a1[2] - 0xD0]), (int)a1[3], (int)result);
        }
        else if (a1[1] == 2)                      // reg->input[i]
        {
            *((char*)input + a1[2]) = reg[a1[3] - 0xD0];
            printf("input[%d] (%d) = reg[%d] (%d) \n", (int)a1[2], (int)*((unsigned char*)input + a1[2]), (int)(a1[3] - 0xD0), (int)(reg[a1[3] - 0xD0]));
        }
        else
        {
            if (a1[1] == 3)
            {
                reg[a1[2] - 0xD0] = a1[3];
                printf("reg[%d] (%d) = %d\n", (int)(a1[2] - 0xD0), (int)reg[a1[2] - 0xD0], (int)a1[3]);
            }
        }
    }
    else
    {
        reg[a1[2] - 0xD0] = reg[a1[3] - 0xD0];
        printf(" reg[%d] (%d) = reg[%d] (%d) \n", (int)(a1[2] - 0xD0), (int)reg[a1[2] - 0xD0], (int)(a1[3] - 0xD0), (int)reg[a1[3] - 0xD0]);
    }
    return 0;
}

_QWORD* __fastcall xor (unsigned __int8* a1)
{
    _QWORD* result; // rax

    if (a1[1])
    {
        result = (_QWORD*)a1[1];
        if ((_BYTE)result == 1)
        {
            result = reg;
            reg[a1[2] - 208] ^= a1[3];
            if (a1[2] - 0xD0 == 0)xorNum.emplace_back(a1[3]);
            printf("reg[%d] (%d) ^= %d\n", (int)(a1[2] - 208), (int)reg[a1[2] - 208], (int)a1[3]);
        }
    }
    else
    {
        result = reg;
        reg[a1[2] - 208] ^= reg[a1[3] - 208];
        if (a1[2] - 0xD0 == 0)xorNum.emplace_back(reg[a1[3] - 0xD0]);
        printf("reg[%d] (%d) ^= reg[%d] (%d)\n", (int)(a1[2] - 0xD0), (int)reg[a1[2] - 208], (int)(a1[3] - 0xD0), (int)reg[a1[3] - 0xD0]);
    }
    return result;
}

_QWORD* __fastcall add(unsigned __int8* a1)
{
    _QWORD* result; // rax

    if (a1[1])
    {
        result = (_QWORD*)a1[1];
        if ((_BYTE)result == 1)
        {
            result = reg;
            reg[a1[2] - 208] += a1[3];
            if (a1[2] - 0xD0 == 0)addNum.emplace_back(a1[3]);
            printf("reg[%d] (%d) += %d\n", (int)(a1[2] - 208), (int)reg[a1[2] - 208], (int)a1[3]);
        }
    }
    else
    {
        result = reg;
        reg[a1[2] - 208] += reg[a1[3] - 208];
        if (a1[2] - 0xD0 == 0)addNum.emplace_back(reg[a1[3] - 208]);

        printf("reg[%d] (%d) += reg[%d] (%d)\n", (int)(a1[2] - 0xD0), (int)reg[a1[2] - 208], (int)(a1[3] - 0xD0), (int)reg[a1[3] - 0xD0]);
    }
    return result;
}

_QWORD* __fastcall sub(unsigned __int8* a1)
{
    _QWORD* result; // rax

    if (a1[1])
    {
        result = (_QWORD*)a1[1];
        if ((_BYTE)result == 1)
        {
            result = reg;
            reg[a1[2] - 208] -= a1[3];
            if (a1[2] - 0xD0 == 0)subNum.emplace_back(a1[3]);
            printf("reg[%d] (%d) -= %d \n", (int)(a1[2] - 208), (int)reg[a1[2] - 208], (int)a1[3]);
        }
    }
    else
    {
        result = reg;
        reg[a1[2] - 0xD0] -= reg[a1[3] - 0xD0];
        if (a1[2] - 0xD0 == 0)subNum.emplace_back(reg[a1[3] - 0xD0]);
        printf("reg[%d] (%d) -= reg[%d] (%d)\n", (int)(a1[2] - 0xD0), (int)reg[a1[2] - 208], (int)(a1[3] - 0xD0), (int)reg[a1[3] - 0xD0]);
    }
    return result;
}

int addLen, xorLen, subLen;

void __fastcall sub2(unsigned __int8* a1)
{
    if (a1[2] - 208 == 0) {
        reg[a1[2] - 208] += subNum[subLen - 1 - i2++]; //原本是-，所以要加上減了的值
    }
}

void __fastcall xor2(unsigned __int8* a1)
{
    if (a1[2] - 208 == 0) {
        reg[a1[2] - 208] ^= xorNum[xorLen - 1 - i3++];
    }
}

void __fastcall add2(unsigned __int8* a1)
{
    if (a1[2] - 208 == 0) {
        reg[a1[2] - 208] -= addNum[addLen - 1 - i1++]; //原本是+，所以要減上加了的值
    }
}

_BYTE* __fastcall mov2(unsigned __int8* a1, __int64* input)
{
    _BYTE result; // rax

    if (a1[1])
    {
        if (a1[1] == 1)                 // reg->input[i]     
        {
            *((char*)input + a1[3]) = reg[a1[2] - 0xD0];
        }
        else if (a1[1] == 2)                 // input[i]->reg
        {
            result = *((char*)input + a1[2]);
            reg[a1[3] - 0xD0] = result;
        }

    }

    return 0;
}

int main() {

    unsigned char opcode[] =
    {
      0xE0, 0x01, 0xD0, 0x03, 0xE0, 0x03, 0xD1, 0xB5, 0xE0, 0x03,
      0xD2, 0xDE, 0xE0, 0x03, 0xD3, 0xA1, 0xA2, 0x00, 0xD1, 0xD3,
      0xA2, 0x00, 0xD3, 0xD3, 0xA1, 0x01, 0xD0, 0x02, 0xA0, 0x00,
      0xD0, 0xD1, 0xA0, 0x00, 0xD3, 0xD1, 0xA2, 0x01, 0xD0, 0x00,
      0xA2, 0x00, 0xD3, 0xD3, 0xA1, 0x00, 0xD1, 0xD2, 0xA2, 0x01,
      0xD0, 0x02, 0xA2, 0x01, 0xD0, 0x00, 0xE0, 0x02, 0x03, 0xD0,
      0xE0, 0x01, 0xD0, 0x0A, 0xE0, 0x03, 0xD1, 0x61, 0xE0, 0x03,
      0xD2, 0x71, 0xE0, 0x03, 0xD3, 0x7A, 0xA0, 0x01, 0xD0, 0x03,
      0xA0, 0x00, 0xD0, 0xD1, 0xA1, 0x00, 0xD3, 0xD2, 0xA0, 0x00,
      0xD2, 0xD1, 0xA2, 0x00, 0xD2, 0xD3, 0xA2, 0x01, 0xD0, 0x00,
      0xA2, 0x00, 0xD2, 0xD3, 0xA2, 0x00, 0xD1, 0xD3, 0xA2, 0x00,
      0xD2, 0xD3, 0xA1, 0x01, 0xD0, 0x00, 0xE0, 0x02, 0x0A, 0xD0,
      0xE0, 0x01, 0xD0, 0x11, 0xE0, 0x03, 0xD1, 0xC5, 0xE0, 0x03,
      0xD2, 0xA2, 0xE0, 0x03, 0xD3, 0x7B, 0xA1, 0x00, 0xD1, 0xD2,
      0xA0, 0x01, 0xD0, 0x01, 0xA0, 0x00, 0xD2, 0xD1, 0xA1, 0x01,
      0xD0, 0x00, 0xA0, 0x00, 0xD1, 0xD1, 0xA0, 0x01, 0xD0, 0x00,
      0xA0, 0x00, 0xD3, 0xD1, 0xA2, 0x01, 0xD0, 0x02, 0xA2, 0x00,
      0xD1, 0xD3, 0xA0, 0x01, 0xD0, 0x03, 0xE0, 0x02, 0x11, 0xD0,
      0xE0, 0x01, 0xD0, 0x16, 0xE0, 0x03, 0xD1, 0x8C, 0xE0, 0x03,
      0xD2, 0xE6, 0xE0, 0x03, 0xD3, 0xFC, 0xA2, 0x01, 0xD0, 0x02,
      0xA0, 0x00, 0xD2, 0xD1, 0xA2, 0x00, 0xD0, 0xD3, 0xA1, 0x01,
      0xD0, 0x02, 0xA0, 0x01, 0xD0, 0x01, 0xA0, 0x00, 0xD2, 0xD1,
      0xA0, 0x00, 0xD1, 0xD1, 0xA1, 0x00, 0xD1, 0xD2, 0xA1, 0x00,
      0xD3, 0xD2, 0xA0, 0x00, 0xD0, 0xD1, 0xE0, 0x02, 0x16, 0xD0,
      0xE0, 0x01, 0xD0, 0x05, 0xE0, 0x03, 0xD1, 0x4A, 0xE0, 0x03,
      0xD2, 0x70, 0xE0, 0x03, 0xD3, 0x17, 0xA2, 0x00, 0xD0, 0xD3,
      0xA0, 0x00, 0xD0, 0xD1, 0xA2, 0x01, 0xD0, 0x01, 0xA2, 0x00,
      0xD0, 0xD3, 0xA1, 0x01, 0xD0, 0x00, 0xA1, 0x00, 0xD0, 0xD2,
      0xA0, 0x00, 0xD0, 0xD1, 0xA0, 0x01, 0xD0, 0x01, 0xA2, 0x01,
      0xD0, 0x00, 0xA1, 0x01, 0xD0, 0x01, 0xE0, 0x02, 0x05, 0xD0,
      0xE0, 0x01, 0xD0, 0x00, 0xE0, 0x03, 0xD1, 0x1F, 0xE0, 0x03,
      0xD2, 0x0B, 0xE0, 0x03, 0xD3, 0xD9, 0xA2, 0x00, 0xD0, 0xD3,
      0xA1, 0x00, 0xD0, 0xD2, 0xA0, 0x01, 0xD0, 0x00, 0xA2, 0x01,
      0xD0, 0x02, 0xA1, 0x00, 0xD3, 0xD2, 0xA0, 0x01, 0xD0, 0x00,
      0xA2, 0x00, 0xD3, 0xD3, 0xA0, 0x00, 0xD0, 0xD1, 0xA2, 0x01,
      0xD0, 0x03, 0xA0, 0x01, 0xD0, 0x02, 0xE0, 0x02, 0x00, 0xD0,
      0xE0, 0x01, 0xD0, 0x07, 0xE0, 0x03, 0xD1, 0xB7, 0xE0, 0x03,
      0xD2, 0xF0, 0xE0, 0x03, 0xD3, 0x56, 0xA2, 0x01, 0xD0, 0x01,
      0xA0, 0x00, 0xD1, 0xD1, 0xA0, 0x01, 0xD0, 0x02, 0xA2, 0x00,
      0xD2, 0xD3, 0xA0, 0x00, 0xD3, 0xD1, 0xA2, 0x01, 0xD0, 0x01,
      0xA0, 0x00, 0xD3, 0xD1, 0xA2, 0x01, 0xD0, 0x03, 0xA2, 0x00,
      0xD2, 0xD3, 0xA2, 0x01, 0xD0, 0x02, 0xE0, 0x02, 0x07, 0xD0,
      0xE0, 0x01, 0xD0, 0x19, 0xE0, 0x03, 0xD1, 0xC6, 0xE0, 0x03,
      0xD2, 0x80, 0xE0, 0x03, 0xD3, 0x4E, 0xA2, 0x00, 0xD0, 0xD3,
      0xA1, 0x01, 0xD0, 0x00, 0xA1, 0x00, 0xD0, 0xD2, 0xA2, 0x00,
      0xD2, 0xD3, 0xA0, 0x01, 0xD0, 0x01, 0xA1, 0x01, 0xD0, 0x02,
      0xA2, 0x00, 0xD2, 0xD3, 0xA2, 0x01, 0xD0, 0x02, 0xA2, 0x00,
      0xD1, 0xD3, 0xA2, 0x01, 0xD0, 0x02, 0xE0, 0x02, 0x19, 0xD0,
      0xE0, 0x01, 0xD0, 0x17, 0xE0, 0x03, 0xD1, 0xC6, 0xE0, 0x03,
      0xD2, 0xD4, 0xE0, 0x03, 0xD3, 0x29, 0xA0, 0x00, 0xD1, 0xD1,
      0xA2, 0x01, 0xD0, 0x02, 0xA0, 0x01, 0xD0, 0x01, 0xA0, 0x01,
      0xD0, 0x03, 0xA1, 0x01, 0xD0, 0x03, 0xA0, 0x00, 0xD3, 0xD1,
      0xA2, 0x01, 0xD0, 0x03, 0xA2, 0x01, 0xD0, 0x00, 0xA0, 0x01,
      0xD0, 0x03, 0xA0, 0x00, 0xD2, 0xD1, 0xE0, 0x02, 0x17, 0xD0,
      0xE0, 0x01, 0xD0, 0x0E, 0xE0, 0x03, 0xD1, 0x50, 0xE0, 0x03,
      0xD2, 0xE4, 0xE0, 0x03, 0xD3, 0xF9, 0xA2, 0x00, 0xD0, 0xD3,
      0xA0, 0x00, 0xD3, 0xD1, 0xA1, 0x00, 0xD2, 0xD2, 0xA1, 0x01,
      0xD0, 0x00, 0xA1, 0x01, 0xD0, 0x01, 0xA2, 0x00, 0xD0, 0xD3,
      0xA2, 0x01, 0xD0, 0x01, 0xA0, 0x00, 0xD3, 0xD1, 0xA2, 0x01,
      0xD0, 0x03, 0xA1, 0x00, 0xD0, 0xD2, 0xE0, 0x02, 0x0E, 0xD0,
      0xE0, 0x01, 0xD0, 0x13, 0xE0, 0x03, 0xD1, 0x6D, 0xE0, 0x03,
      0xD2, 0x07, 0xE0, 0x03, 0xD3, 0x01, 0xA2, 0x01, 0xD0, 0x00,
      0xA0, 0x01, 0xD0, 0x00, 0xA2, 0x00, 0xD1, 0xD3, 0xA1, 0x00,
      0xD2, 0xD2, 0xA2, 0x01, 0xD0, 0x01, 0xA0, 0x00, 0xD3, 0xD1,
      0xA1, 0x01, 0xD0, 0x00, 0xA0, 0x00, 0xD2, 0xD1, 0xA1, 0x01,
      0xD0, 0x00, 0xA1, 0x00, 0xD1, 0xD2, 0xE0, 0x02, 0x13, 0xD0,
      0xE0, 0x01, 0xD0, 0x1A, 0xE0, 0x03, 0xD1, 0xB1, 0xE0, 0x03,
      0xD2, 0x3A, 0xE0, 0x03, 0xD3, 0x4F, 0xA1, 0x00, 0xD0, 0xD2,
      0xA0, 0x00, 0xD0, 0xD1, 0xA0, 0x01, 0xD0, 0x02, 0xA2, 0x00,
      0xD2, 0xD3, 0xA1, 0x00, 0xD0, 0xD2, 0xA2, 0x01, 0xD0, 0x03,
      0xA2, 0x01, 0xD0, 0x03, 0xA2, 0x01, 0xD0, 0x03, 0xA1, 0x00,
      0xD1, 0xD2, 0xA0, 0x01, 0xD0, 0x03, 0xE0, 0x02, 0x1A, 0xD0,
      0xE0, 0x01, 0xD0, 0x14, 0xE0, 0x03, 0xD1, 0x95, 0xE0, 0x03,
      0xD2, 0x04, 0xE0, 0x03, 0xD3, 0x46, 0xA0, 0x01, 0xD0, 0x02,
      0xA1, 0x00, 0xD2, 0xD2, 0xA1, 0x00, 0xD0, 0xD2, 0xA1, 0x00,
      0xD0, 0xD2, 0xA0, 0x00, 0xD2, 0xD1, 0xA0, 0x01, 0xD0, 0x01,
      0xA2, 0x00, 0xD2, 0xD3, 0xA1, 0x00, 0xD3, 0xD2, 0xA2, 0x00,
      0xD1, 0xD3, 0xA1, 0x00, 0xD0, 0xD2, 0xE0, 0x02, 0x14, 0xD0,
      0xE0, 0x01, 0xD0, 0x02, 0xE0, 0x03, 0xD1, 0xF4, 0xE0, 0x03,
      0xD2, 0x7A, 0xE0, 0x03, 0xD3, 0x18, 0xA1, 0x00, 0xD1, 0xD2,
      0xA2, 0x00, 0xD0, 0xD3, 0xA1, 0x00, 0xD3, 0xD2, 0xA1, 0x00,
      0xD2, 0xD2, 0xA1, 0x01, 0xD0, 0x00, 0xA0, 0x00, 0xD3, 0xD1,
      0xA1, 0x01, 0xD0, 0x02, 0xA1, 0x00, 0xD0, 0xD2, 0xA1, 0x01,
      0xD0, 0x00, 0xA2, 0x01, 0xD0, 0x03, 0xE0, 0x02, 0x02, 0xD0,
      0xE0, 0x01, 0xD0, 0x12, 0xE0, 0x03, 0xD1, 0xDA, 0xE0, 0x03,
      0xD2, 0x13, 0xE0, 0x03, 0xD3, 0x9A, 0xA1, 0x00, 0xD1, 0xD2,
      0xA0, 0x01, 0xD0, 0x03, 0xA2, 0x01, 0xD0, 0x00, 0xA0, 0x00,
      0xD0, 0xD1, 0xA0, 0x01, 0xD0, 0x01, 0xA0, 0x00, 0xD3, 0xD1,
      0xA0, 0x00, 0xD0, 0xD1, 0xA1, 0x01, 0xD0, 0x02, 0xA1, 0x01,
      0xD0, 0x03, 0xA2, 0x00, 0xD1, 0xD3, 0xE0, 0x02, 0x12, 0xD0,
      0xE0, 0x01, 0xD0, 0x04, 0xE0, 0x03, 0xD1, 0xD8, 0xE0, 0x03,
      0xD2, 0x2A, 0xE0, 0x03, 0xD3, 0xBC, 0xA0, 0x01, 0xD0, 0x02,
      0xA2, 0x00, 0xD1, 0xD3, 0xA1, 0x01, 0xD0, 0x01, 0xA1, 0x00,
      0xD0, 0xD2, 0xA0, 0x00, 0xD0, 0xD1, 0xA2, 0x00, 0xD3, 0xD3,
      0xA2, 0x01, 0xD0, 0x01, 0xA0, 0x00, 0xD3, 0xD1, 0xA1, 0x01,
      0xD0, 0x02, 0xA0, 0x01, 0xD0, 0x00, 0xE0, 0x02, 0x04, 0xD0,
      0xE0, 0x01, 0xD0, 0x06, 0xE0, 0x03, 0xD1, 0x6E, 0xE0, 0x03,
      0xD2, 0x4A, 0xE0, 0x03, 0xD3, 0x35, 0xA0, 0x01, 0xD0, 0x03,
      0xA1, 0x01, 0xD0, 0x02, 0xA2, 0x00, 0xD1, 0xD3, 0xA0, 0x00,
      0xD3, 0xD1, 0xA0, 0x01, 0xD0, 0x03, 0xA2, 0x01, 0xD0, 0x03,
      0xA2, 0x00, 0xD3, 0xD3, 0xA2, 0x01, 0xD0, 0x02, 0xA1, 0x01,
      0xD0, 0x03, 0xA2, 0x01, 0xD0, 0x01, 0xE0, 0x02, 0x06, 0xD0,
      0xE0, 0x01, 0xD0, 0x0B, 0xE0, 0x03, 0xD1, 0x70, 0xE0, 0x03,
      0xD2, 0x04, 0xE0, 0x03, 0xD3, 0xAE, 0xA2, 0x01, 0xD0, 0x02,
      0xA1, 0x00, 0xD0, 0xD2, 0xA2, 0x00, 0xD1, 0xD3, 0xA1, 0x00,
      0xD1, 0xD2, 0xA1, 0x01, 0xD0, 0x02, 0xA2, 0x01, 0xD0, 0x03,
      0xA0, 0x00, 0xD0, 0xD1, 0xA2, 0x00, 0xD0, 0xD3, 0xA0, 0x00,
      0xD1, 0xD1, 0xA0, 0x01, 0xD0, 0x00, 0xE0, 0x02, 0x0B, 0xD0,
      0xE0, 0x01, 0xD0, 0x15, 0xE0, 0x03, 0xD1, 0x99, 0xE0, 0x03,
      0xD2, 0x07, 0xE0, 0x03, 0xD3, 0xE5, 0xA1, 0x00, 0xD1, 0xD2,
      0xA0, 0x01, 0xD0, 0x03, 0xA1, 0x00, 0xD3, 0xD2, 0xA2, 0x00,
      0xD0, 0xD3, 0xA2, 0x00, 0xD0, 0xD3, 0xA2, 0x01, 0xD0, 0x00,
      0xA2, 0x01, 0xD0, 0x03, 0xA0, 0x01, 0xD0, 0x02, 0xA2, 0x00,
      0xD3, 0xD3, 0xA1, 0x01, 0xD0, 0x03, 0xE0, 0x02, 0x15, 0xD0,
      0xE0, 0x01, 0xD0, 0x09, 0xE0, 0x03, 0xD1, 0x77, 0xE0, 0x03,
      0xD2, 0x0A, 0xE0, 0x03, 0xD3, 0x00, 0xA2, 0x01, 0xD0, 0x01,
      0xA1, 0x00, 0xD2, 0xD2, 0xA1, 0x00, 0xD0, 0xD2, 0xA1, 0x01,
      0xD0, 0x02, 0xA1, 0x00, 0xD3, 0xD2, 0xA1, 0x01, 0xD0, 0x03,
      0xA0, 0x00, 0xD1, 0xD1, 0xA2, 0x01, 0xD0, 0x01, 0xA0, 0x01,
      0xD0, 0x02, 0xA2, 0x01, 0xD0, 0x02, 0xE0, 0x02, 0x09, 0xD0,
      0xE0, 0x01, 0xD0, 0x1C, 0xE0, 0x03, 0xD1, 0x1C, 0xE0, 0x03,
      0xD2, 0x12, 0xE0, 0x03, 0xD3, 0xF6, 0xA1, 0x01, 0xD0, 0x01,
      0xA1, 0x01, 0xD0, 0x00, 0xA2, 0x01, 0xD0, 0x01, 0xA1, 0x00,
      0xD3, 0xD2, 0xA0, 0x00, 0xD3, 0xD1, 0xA1, 0x01, 0xD0, 0x03,
      0xA0, 0x00, 0xD0, 0xD1, 0xA1, 0x01, 0xD0, 0x01, 0xA0, 0x00,
      0xD0, 0xD1, 0xA2, 0x00, 0xD1, 0xD3, 0xE0, 0x02, 0x1C, 0xD0,
      0xE0, 0x01, 0xD0, 0x0F, 0xE0, 0x03, 0xD1, 0xA5, 0xE0, 0x03,
      0xD2, 0x35, 0xE0, 0x03, 0xD3, 0xB1, 0xA0, 0x01, 0xD0, 0x03,
      0xA1, 0x01, 0xD0, 0x00, 0xA0, 0x00, 0xD3, 0xD1, 0xA2, 0x00,
      0xD2, 0xD3, 0xA2, 0x01, 0xD0, 0x00, 0xA2, 0x01, 0xD0, 0x02,
      0xA0, 0x01, 0xD0, 0x03, 0xA1, 0x00, 0xD0, 0xD2, 0xA2, 0x00,
      0xD1, 0xD3, 0xA0, 0x00, 0xD3, 0xD1, 0xE0, 0x02, 0x0F, 0xD0,
      0xE0, 0x01, 0xD0, 0x10, 0xE0, 0x03, 0xD1, 0xE3, 0xE0, 0x03,
      0xD2, 0xBE, 0xE0, 0x03, 0xD3, 0x61, 0xA1, 0x01, 0xD0, 0x02,
      0xA2, 0x01, 0xD0, 0x00, 0xA0, 0x00, 0xD0, 0xD1, 0xA1, 0x01,
      0xD0, 0x02, 0xA0, 0x00, 0xD1, 0xD1, 0xA0, 0x01, 0xD0, 0x00,
      0xA2, 0x01, 0xD0, 0x03, 0xA2, 0x00, 0xD2, 0xD3, 0xA0, 0x00,
      0xD1, 0xD1, 0xA1, 0x01, 0xD0, 0x03, 0xE0, 0x02, 0x10, 0xD0,
      0xE0, 0x01, 0xD0, 0x08, 0xE0, 0x03, 0xD1, 0x2B, 0xE0, 0x03,
      0xD2, 0x35, 0xE0, 0x03, 0xD3, 0xD4, 0xA0, 0x00, 0xD0, 0xD1,
      0xA1, 0x01, 0xD0, 0x01, 0xA2, 0x01, 0xD0, 0x00, 0xA1, 0x01,
      0xD0, 0x03, 0xA2, 0x01, 0xD0, 0x03, 0xA0, 0x00, 0xD3, 0xD1,
      0xA1, 0x00, 0xD2, 0xD2, 0xA0, 0x00, 0xD2, 0xD1, 0xA0, 0x00,
      0xD0, 0xD1, 0xA1, 0x00, 0xD0, 0xD2, 0xE0, 0x02, 0x08, 0xD0,
      0xE0, 0x01, 0xD0, 0x01, 0xE0, 0x03, 0xD1, 0xB0, 0xE0, 0x03,
      0xD2, 0xB2, 0xE0, 0x03, 0xD3, 0x5B, 0xA0, 0x00, 0xD1, 0xD1,
      0xA1, 0x00, 0xD0, 0xD2, 0xA2, 0x00, 0xD1, 0xD3, 0xA0, 0x01,
      0xD0, 0x00, 0xA0, 0x01, 0xD0, 0x00, 0xA2, 0x01, 0xD0, 0x00,
      0xA1, 0x00, 0xD2, 0xD2, 0xA2, 0x01, 0xD0, 0x00, 0xA2, 0x00,
      0xD1, 0xD3, 0xA0, 0x01, 0xD0, 0x01, 0xE0, 0x02, 0x01, 0xD0,
      0xE0, 0x01, 0xD0, 0x0D, 0xE0, 0x03, 0xD1, 0xE8, 0xE0, 0x03,
      0xD2, 0x39, 0xE0, 0x03, 0xD3, 0xF4, 0xA1, 0x00, 0xD2, 0xD2,
      0xA0, 0x01, 0xD0, 0x00, 0xA0, 0x01, 0xD0, 0x02, 0xA1, 0x00,
      0xD3, 0xD2, 0xA1, 0x00, 0xD2, 0xD2, 0xA2, 0x00, 0xD2, 0xD3,
      0xA0, 0x01, 0xD0, 0x00, 0xA0, 0x00, 0xD2, 0xD1, 0xA0, 0x01,
      0xD0, 0x03, 0xA0, 0x01, 0xD0, 0x01, 0xE0, 0x02, 0x0D, 0xD0,
      0xE0, 0x01, 0xD0, 0x18, 0xE0, 0x03, 0xD1, 0x72, 0xE0, 0x03,
      0xD2, 0xA1, 0xE0, 0x03, 0xD3, 0x7C, 0xA0, 0x01, 0xD0, 0x01,
      0xA1, 0x00, 0xD2, 0xD2, 0xA1, 0x01, 0xD0, 0x00, 0xA0, 0x01,
      0xD0, 0x00, 0xA1, 0x01, 0xD0, 0x00, 0xA2, 0x01, 0xD0, 0x00,
      0xA0, 0x01, 0xD0, 0x03, 0xA1, 0x00, 0xD3, 0xD2, 0xA2, 0x01,
      0xD0, 0x01, 0xA2, 0x00, 0xD3, 0xD3, 0xE0, 0x02, 0x18, 0xD0,
      0xE0, 0x01, 0xD0, 0x0C, 0xE0, 0x03, 0xD1, 0x98, 0xE0, 0x03,
      0xD2, 0xB5, 0xE0, 0x03, 0xD3, 0x2B, 0xA0, 0x01, 0xD0, 0x03,
      0xA2, 0x01, 0xD0, 0x02, 0xA2, 0x01, 0xD0, 0x00, 0xA1, 0x01,
      0xD0, 0x03, 0xA0, 0x00, 0xD3, 0xD1, 0xA2, 0x01, 0xD0, 0x02,
      0xA1, 0x01, 0xD0, 0x01, 0xA1, 0x00, 0xD2, 0xD2, 0xA1, 0x01,
      0xD0, 0x00, 0xA0, 0x01, 0xD0, 0x00, 0xE0, 0x02, 0x0C, 0xD0,
      0xE0, 0x01, 0xD0, 0x1B, 0xE0, 0x03, 0xD1, 0x8D, 0xE0, 0x03,
      0xD2, 0x39, 0xE0, 0x03, 0xD3, 0x4E, 0xA2, 0x01, 0xD0, 0x03,
      0xA1, 0x01, 0xD0, 0x01, 0xA1, 0x01, 0xD0, 0x03, 0xA0, 0x01,
      0xD0, 0x01, 0xA1, 0x01, 0xD0, 0x02, 0xA2, 0x00, 0xD1, 0xD3,
      0xA1, 0x00, 0xD3, 0xD2, 0xA2, 0x01, 0xD0, 0x00, 0xA1, 0x01,
      0xD0, 0x01, 0xA1, 0x00, 0xD0, 0xD2, 0xE0, 0x02, 0x1B, 0xD0,
      0x00, 0x00, 0x00, 0xFF
    };
    __int64 enc[4];
    enc[0] = 0x636C2AB97B3C1F84LL;
    enc[1] = 0x88965F76081B72A4LL;
    enc[2] = 0x669786CD677B5F86LL;
    LODWORD(enc[3]) = 0x7DFC9964;
    WORD2(enc[3]) = 0x81;

    unsigned __int8* i;
    // 先取得所有+、-、^的數值，並保存下來
    for (i = (unsigned __int8*)opcode; i < opcode + 1744; i += 4)
    {
        int v3 = *i;
        if (v3 == 0xE0)
        {
            mov(i, enc);                   // 將input[i]放入某個寄存器
        }
        else if (*i <= 0xE0u)
        {
            if (v3 == 0xA2)
            {
                sub(i);
            }
            else if (*i <= 0xA2u)
            {
                if (v3 == 0xA0)
                {
                    xor (i);
                }
                else if (v3 == 0xA1)
                {
                    add(i);
                }
            }
        }

    }

    /****************** 解密 ******************/
    addLen = addNum.size();
    subLen = subNum.size();
    xorLen = xorNum.size();
    cout << endl;
    cout << endl;
    cout << endl;
    enc[0] = 0x636C2AB97B3C1F84LL;
    enc[1] = 0x88965F76081B72A4LL;
    enc[2] = 0x669786CD677B5F86LL;
    LODWORD(enc[3]) = 0x7DFC9964;
    WORD2(enc[3]) = 0x81;
    reg[0] = 0;

    // 由最後一條指令向前執行，逆向解密
    for (i = i - 8; i >= opcode; i -= 4)
    {
        int v3 = *i;
        if (v3 == 0xE0)
        {
            mov2(i, enc);
        }
        else if (*i <= 0xE0u)
        {
            if (v3 == 0xA2)
            {
                sub2(i);
            }
            else if (*i <= 0xA2u)
            {
                if (v3 == 0xA0)
                {
                    xor2(i);
                }
                else if (v3 == 0xA1)
                {
                    add2(i);
                }
            }
        }

    }
    cout << endl;

    for (int i = 0; i < 4; i++) {
        for (int j = 0; j < 8; j++) {
            cout << (char)(enc[i] & 0xff);
            enc[i] >>= 8;
        }
    }
    return 0;
}