crypto-DSA attack(buuctf)

DSA攻击题，题目给了一个公钥文件和四组消息+签名，需要还原私钥，本质上解题思路和jarvisoj的DSA题目一样，详解参考这里

但是buuctf的题目多了个readme：

签名与验证：
openssl dgst -sha1 -sign dsa_private.pem -out sign.bin message.txt
openssl sha1 -verify dsa_public.pem -signature sign.bin message.txt

flag是私钥中不公开那一部分的MD5值(hex编码,不包括0x)。如：结果为"1024"，那么请提交 xnuca{MD5("\x0400")}
flag is the the MD5 hash value (hex encoded,excluding "0x") of secrect number in Private Key. For instance: if result is "1024",then submit xnuca{MD5("\x400")}

本来以为套一下脚本就能成：

from Crypto.PublicKey import DSA
from Crypto.Util.asn1 import DerSequence
from Crypto.Hash import SHA1
import gmpy2

pubkey_file = 'dsa_public.pem'
file_1 = ['./packet3/message3', './packet3/sign3']
file_2 = ['./packet4/message4', './packet4/sign4']

pubkey = DSA.import_key(open(pubkey_file, 'r').read())

y = pubkey.y
g = pubkey.g
p = pubkey.p
q = pubkey.q

print('y =', y)
print('g =', g)
print('p =', p)
print('q =', q)

def get_rs(signature):
    der_seq = DerSequence().decode(signature, strict=True)
    return int(der_seq[0]), int(der_seq[1])

hm1 = int(SHA1.new(open(file_1[0], 'rb').read()).hexdigest(), 16)
hm2 = int(SHA1.new(open(file_2[0], 'rb').read()).hexdigest(), 16)
r, s1 = get_rs(open(file_1[1], 'rb').read())
_, s2 = get_rs(open(file_2[1], 'rb').read())

print('r =', r)
print('hm1 =', hm1)
print('s1 =', s1)
print('hm2 =', hm2)
print('s2 =', s2)

print('cracking')

ds = s2 - s1
dhm = hm2 - hm1
k = gmpy2.mul(dhm, gmpy2.invert(ds, q))
k = gmpy2.f_mod(k, q)
tmp = gmpy2.mul(k, s1) - hm1
x = tmp * gmpy2.invert(r, q)
x = gmpy2.f_mod(x, q)
print('x =', x)
#343153704992189087627181076420513150138321507998

但是把这个结果各种转换进制，算了一堆md5提交都出错，搞不懂最终flag是什么格式，如果有知道的大佬麻烦指教一下。