2022ciscn华中赛区复赛总结与反思

总结

先把总结放前面。从这次比赛到现在自我反思的几个问题：

  1. 向全栈安全方向学习。跟大佬聊，做二进制还是要懂web。比如桌面平台的二进制，移动安全，iot安全，都是会涉及到web安全。如今混合开发也非常流行，唯有全栈才是出路。
  2. 慢即是快。比赛中有几个低级失误导致白给多题。其实如果细心应该能发现问题。python3默认输出大数会使用科学计数法，此时直接用int只会让低位信息直接丢失，不会产生正确的结果。
  3. 别用volatility3。版本太新，和2的版本有很多改变的地方，导致使用方法和2有区别。血的教训。

PNGCracker

首先看到图片的高度不对，怀疑是高度隐写，用010edit打开修改图片的高度。后面发现得到了一个密码。猜测是压缩包密码

714bb8ea-4a7d-4b93-b464-66ad22ac1f1a

尝试用binwalk分离，得到一个压缩包，用之前得到的密码可以解开

cacc08b2-e966-4609-a777-55e7f7091fcc

将图片用set 打开， 发现在red、green和bule的图片下面存在一行模糊的内容，lsb隐写，（red、green、Bule为1）

932653c7-cd10-47aa-9bf7-d95d1eca93b5

ZIPCracker2

下载下来是个伪加密，直接用7zip解压了，有一张著名音乐家piazzolla的照片，然后还有一个加密压缩包，里面有一张照片和flag.txt

然后发现加密的照片与已有的照片源文件大小一样，猜测已知明文攻击，用ARCHPR破解：

755daf4b-0fa7-4f05-b6df-3938598ba4df

获得解压密码：

d512e389-1f1f-46d1-b911-83a301ec7eba

解压后里面的flag.txt就是flag：

ffc7a1a8-c736-47ad-8004-a0a72c162e2e

crackme2

是一个apk，用jadx打开，查看入口函数：

763cc585-ca2e-4285-9aba-3d69c8a687f5

反编译java代码如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
package com.example.CrackMe2;

import android.os.Bundle;
import android.view.View;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import androidx.appcompat.app.AppCompatActivity;

/* loaded from: classes3.dex */
public class MainActivity extends AppCompatActivity {
    static String encode(String encrypt, String keys) {
        char[] keyBytes = new char[256];
        char[] cypherBytes = new char[256];
        for (int i = 0; i < 256; i++) {
            keyBytes[i] = keys.charAt(i % keys.length());
            cypherBytes[i] = (char) i;
        }
        int jump = 0;
        for (int i2 = 0; i2 < 256; i2++) {
            jump = (cypherBytes[i2] + jump + keyBytes[i2]) & 255;
            char tmp = cypherBytes[i2];
            cypherBytes[i2] = cypherBytes[jump];
            cypherBytes[jump] = tmp;
        }
        int i3 = 0;
        int jump2 = 0;
        StringBuilder Result = new StringBuilder();
        for (int x = 0; x < encrypt.length(); x++) {
            i3 = (i3 + 1) & 255;
            char tmp2 = cypherBytes[i3];
            jump2 = (jump2 + tmp2 + 136) & 255;
            char t = (char) ((cypherBytes[jump2] + tmp2) & 255);
            cypherBytes[i3] = cypherBytes[jump2];
            cypherBytes[jump2] = tmp2;
            try {
                Result.append(new String(new char[]{(char) (encrypt.charAt(x) ^ cypherBytes[t])}));
            } catch (Exception e) {
                e.printStackTrace();
                return "";
            }
        }
        return Result.toString();
    }

    public boolean check(CharSequence flag) {
        if (!(flag.length() == 38 && flag.subSequence(0, 5).toString().equals("flag{") && flag.charAt(flag.length() - 1) == '}')) {
            return false;
        }
        CharSequence data = flag.subSequence(5, flag.length() - 1);
        String result = encode(data.toString(), "happygame");
        char[] target = {205, 'R', 't', 'z', 30, '\b', '\b', 224, 'W', ';', 24, 153, 175, '=', 29, 148, 21, '%', 'g', '[', 'd', 'S', 31, ';', 220, 162, 'F', '6', 211, 253, 190, '3'};
        if (result.length() != target.length) {
            return false;
        }
        for (int i = 0; i < result.length(); i++) {
            if (result.charAt(i) != target[i]) {
                return false;
            }
        }
        return true;
    }

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        Button button = (Button) findViewById(R.id.button);
        final EditText flagInput = (EditText) findViewById(R.id.flagInput);
        button.setOnClickListener(new View.OnClickListener() { // from class: com.example.CrackMe2.MainActivity.1
            @Override // android.view.View.OnClickListener
            public void onClick(View view) {
                CharSequence flag = flagInput.getText();
                if (MainActivity.this.check(flag)) {
                    Toast.makeText(MainActivity.this, "Right!", 0).show();
                } else {
                    Toast.makeText(MainActivity.this, "Wrong!", 0).show();
                }
            }
        });
    }
}

可以分析输入flag，check()函数检查输入，首先必须被 flag{}包起来，然后经过一个encode要和target相同。

查看encode，发现是典型的rc4，但是不同的是在第三次循环中j的值多加了136。所以解密时也要加上这个136。

解密脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

/* loaded from: classes3.dex */
public class exp {
    static String encode(char[] encrypt, String keys) {
        char[] k = new char[256];
        char[] s = new char[256];
        for (int i = 0; i < 256; i++) {
            k[i] = keys.charAt(i % keys.length());
            s[i] = (char) i;
        }
        int j = 0;
        for (int i2 = 0; i2 < 256; i2++) {
            j = (s[i2] + j + k[i2]) & 255;
            char tmp = s[i2];
            s[i2] = s[j];
            s[j] = tmp;
        }
        int ii = 0;
        int jj = 0;
        StringBuilder Result = new StringBuilder();
        for (int x = 0; x < encrypt.length; x++) {
            ii = (ii + 1) & 255;
            char tt = s[ii];
            jj = (jj + tt + 136) & 255;
            char t = (char) ((s[jj] + tt) & 255);
            s[ii] = s[jj];
            s[jj] = tt;
            try {
                Result.append(new String(new char[]{(char) (encrypt[x] ^ s[t])}));
            } catch (Exception e) {
                e.printStackTrace();
                return "";
            }
        }
        return Result.toString();
    }

  
    public static void main(String args[]) {
        char[] target = {205, 'R', 't', 'z', 30, '\b', '\b', 224, 'W', ';', 24, 153, 175, '=', 29, 148, 21, '%', 'g', '[', 'd', 'S', 31, ';', 220, 162, 'F', '6', 211, 253, 190, '3'};
        String re = encode(target, "happygame");
        System.out.println(re);
    }
}

flag{2fd3d38b20b7bae1f6ed0d70a7df345e}

meikyu（二血）

解压有个py文件、pyd文件、dll文件。pyd是二进制库，因此无法直接反编译，但是我们可以导入之后用help查看：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
Help on module mylib:

NAME
    mylib

CLASSES
    enum.Enum(builtins.object)
        CheckStatus

    class CheckStatus(enum.Enum)
     |  CheckStatus(value, names=None, *, module=None, qualname=None, type=None, start=1)
     |
     |  An enumeration.
     |
     |  Method resolution order:
     |      CheckStatus
     |      enum.Enum
     |      builtins.object
     |
     |  Data and other attributes defined here:
     |
     |  ERROR_CIPHER_LEN = <CheckStatus.ERROR_CIPHER_LEN: 4>
     |
     |  ERROR_DATA_LEN = <CheckStatus.ERROR_DATA_LEN: 3>
     |
     |  ERROR_FMT = <CheckStatus.ERROR_FMT: 2>
     |
     |  FAIL = <CheckStatus.FAIL: 0>
     |
     |  FATAL_ERROR = <CheckStatus.FATAL_ERROR: 5>
     |
     |  SUCCESS = <CheckStatus.SUCCESS: 1>
     |
     |  Data descriptors inherited from enum.Enum:
     |
     |  name
     |      The name of the Enum member.
     |
     |  value
     |      The value of the Enum member.
     |
     |  Readonly properties inherited from enum.EnumMeta:
     |
     |  __members__
     |      Returns a mapping of member name->value.
     |
     |      is a read-only view of the internal mapping.

FUNCTIONS
    check(map_, key) -> mylib.CheckStatus

DATA
    END = 69
    ROAD = 32
    START = 83
    WALL = 35
    __test__ = {}

FILE
    d:\downloads\re\1656071816meikyu\1656071816meikyu\mylib.pyd

然后结合题目的脚本，很明显是个迷宫，对应的墙、路、终点、起点的值都给出。等他生成map后输出，可以得到如下列表：

1
map = [35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 83, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32,32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 32, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 35, 35, 35, 32, 35, 32, 35, 32, 35, 35, 35, 32, 35, 35, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 35, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 32, 32, 32, 32, 32, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 32, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 32, 32, 35, 32, 35, 32, 35, 32, 35, 32, 69, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35]

长度10201，经过因式分解只有101*101的情况。而具体的走法、按键我们其实不知道，大胆猜测在还没有看的dll里，因此使用ida打开：

a4c6a4c2-66ac-4fe7-b026-224ec59157c7

很明显是wasd控制上左下右。使用dfs深搜路径：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
import copy
map = 上面大列表转成二维列表
usedmap = copy.copy(map)

flag = ''
 
 
def DFS(x, y):
    global flag, usedmap #声明全局变量
    if x == len(map) - 2 and y == len(map) - 2:  # 31x31的迷宫 终点也就是数组的(29,29)
       print("找到了！" + flag)
       return
 
    if map[x + 1][y] == 0 and usedmap[x + 1][y] == 0:  # 如果下⼀步不是墙 且没⾛过
      usedmap[x][y] = 1  # 标记当前坐标⾛过（不是下⼀步）
      flag += 's'
      DFS(x + 1, y)  # 尝试向下⾛
      flag = flag[:-1]  # 回溯到这说明这条路不可⾏ 所以去掉's'
      usedmap[x][y] = 0  # 再设置当前坐标为0 重新找路
    if map[x - 1][y] == 0 and usedmap[x - 1][y] == 0:
        usedmap[x][y] = 1
        flag += 'w'
        DFS(x - 1, y)
        flag = flag[:-1]
        usedmap[x][y] = 0
    if map[x][y + 1] == 0 and usedmap[x][y + 1] == 0:
        usedmap[x][y] = 1
        flag += 'd'
        DFS(x, y + 1)
        flag = flag[:-1]
        usedmap[x][y] = 0
    if map[x][y - 1] == 0 and usedmap[x][y - 1] == 0:
        usedmap[x][y] = 1
        flag += 'a'
        DFS(x, y - 1)
        flag = flag[:-1]
        usedmap[x][y] = 0
 

DFS(1, 0)

然后md5就是flag（这个脚本最后还要加一步d才是正确的）。

2ad9e245-be91-4e59-8893-270d701060d2

其他题解：

2022CISCN 华中分区赛wp

CISCN 2022 S15 华中赛区 WriteUp - Wankko Ree’s Blog

Page View
⬆︎TOP