SEKAICTF2023 Crypto

SEKAICTF2023 Crypto

我刚学密码时，做个SEKAI2022，一个都不会，今年刚好这个比赛又开了，想看看能做几个。题目质量都是没得说的

也是做了下前四题，在noisier CRC卡住了就没往下做了。

cryptoGRAPHy

代码有点长，是实现了对图的最短路径的加密程序。

'''
G has nodes (1,5),and the shortert path is [1,3,4,5]:
save as [(1,5),(3,5),(4,5),(5,5)]
then encryto this like
SPDX[Token(1,5)]=Token(3,5)+Token(4,5)+Token(5,5)+E(3,5)+E(4,5)+E(5,5)
all nodes do this to construct enc_db
'''
'''
when you want know the SP(shortest path) of (u,v) in the Graph after get enc_db
by search(Token(u,v),enc_db) return the SP
'''

E:通过key的加密操作，对应有已知key的解密操作

Token：与key和（u，v）有关的hash函数，不可解密

task1(*)

问题：对任意的两个节点（u，v），已知SPDX,求解SP

solve:这里由于把key告诉了,可以直接把密文的后半段的路径加密结果解密出来就ok了

task2(**)

问题：给定目的节点（dest），可以获取nodes次路径加密结果，dest为根节点的树，其他节点均在树上，树的边为最短路径。求出这颗最短路径树的每个节点的度。无需精确到每个节点，只需要一个结果

分析：很显然这里nodes次路径加密要获取每个节点到目的节点的路径加密结果。

这里考虑路径的复用次数和度的关系

SPDX[Token(1,5)]=Token(3,5)+Token(4,5)+Token(5,5)+E(3,5)+E(4,5)+E(5,5)

看本题开始的分析，不难发现，保留了路径长度信息以及除去首节点的最短路径

SPDX[(8,0)]=SPDX[(7,0)]，SPDX[(4,0)]=SPDX[(3,0)]

SPDX[(2,0)]=SPDX[(1,0)]

对于根节点的度，很显然，对路径长度为1的所有加密结果求和。

对于其他任意节点的度，对加密结果一样的进行字数统计，如果有两个一样的加密结果。

类似与上面的SPDX[(8,0)],SPDX[(7,0)]，说明存在一个节点的度为2+1.（注意除根节点外，其他节点还要加上对父节点的连接度数1）

对所有除dest节点外的节点进行加密结果统计，就得到所有节点的度了。

task3(****)

问题：生成一个随机树，并给出，给出所有树上任意两个节点的加密结果。给出任意两个不相同节点的Token值和SPDX[token]，求最短路径。时间限制30s

吐槽一下，这里路径长度为1的加密结果就达到128位16进制，所有加密结果的庞大数据量，用的公共靶机，还把接受数据这段时间算上，导致偶尔数据获取的快才能拿flag

分析求解：拿到树后，可以计算出任意两个节点的最短路径。在只给出token下，很显然要通过加密结果对原最短路径列表进行一个路径匹配。

我的思路是

先对树的每个节点为dest的最短路径结果进行一个数据统计，计算出以该节点为目的节点的路径复用次数

对加密结果进行分段匹配，得到目标最短路径倒数第n步的复用次数

还是以此图进行简单的思路证明

假设选取（5，4），已知为Token(5,4),Token(2,4)+Token(0,4)+Token(1,4)+Token(4,4)

通过已知的树可以算出其他所有节点到4的最短路径，并表达成(start, root), (next_vertex, root)的题目形式

对这些路径进行加密结果中Token(4,4)出现nodes-1=8次，Token(1,4)，Token(0,4)等出现的次数都可计算。以此来做个匹配

#'(0, 0),0': 59,以（0，0）为最短路径的最后一段的次数为59

我们获取到加密结果数量统计后

ans=[59, 35, 27, 7, 6, 5, 4, 1]
#ans 第i个代表倒数第i段的路径复用次数。与上面的树的最短路径进行依次匹配即可得到唯一目的节点

得到目的节点，再用复用次数和连接性得到唯一路径

总体来说，还是很有意思的图问题。

贴一下第三段讲的不太好，贴一下的exp，感兴趣可以对照学习一下

# -*- coding utf-8 -*-
# @Time : 2023/8/27 7:40
import networkx as nx
from pwn import *
# context.log_level='debug'

def computeSDSP(G: nx.Graph, root):
    '''
    Input: Graph G and a root
    Output: Tuples of the form ((start, root), (next_vertex, root))
    '''
    paths = nx.single_source_shortest_path(G, root)
    # print(paths)
    S = []
    # print(paths)
    for _, path in paths.items():
        # path.reverse()
        if len(path) > 1:
            for i in range(len(path)):
                label = (path[i], root)
                S.append(str(label)+','+str(i))

    return S
def COU(G):
    C={}
    for i in G:
        if str(i) in C:
            C[i]+=1
        else:
            C[i]=1
    return C

def pas(D,index,a):
    for k,b in D.items():
        # print(k.split(',')[-1],index,b,a)
        if k.split(',')[-1]==str(index) and b==a:
            # print(k)
            return True
    return False

def get_path(ans,D,G):
    Res=[]
    for index,a in enumerate(ans):
        for i,j in D.items():
            if j==a and i.split(',')[-1]==str(index):
                temp=i.split(',')[0].replace('(','')
                if len(Res)==0:
                    Res.append(temp)
                    continue
                if G.has_edge(int(Res[-1]),int(temp)):
                    Res.append(temp)
                else:
                    continue
    return ' '.join(Res[::-1])

io=remote('chals.sekai.team',3023)

io.recvuntil(b'Flag for cryptoGRAPHy 2: ')
io.sendline(b'SEKAI{3ff1c13nt_GES_4_Shortest-Path-Queries-_-}')
io.recvuntil(b'> Option: ')
io.sendline(b'1')
io.recvuntil(b'[*] Edges: ')
edge=eval(io.recvuntil(b'\n',drop=True).decode())
# print(edge)
G=nx.Graph()
G.add_edges_from(edge)
D=[]
for i in G.nodes:
    D.append(COU(computeSDSP(G, i)))
io.recvuntil(b'> Option: ')
io.sendline(b'2')
io.recvuntil(b'[*] Query Responses: \n')
Query=[]
while 1:
    temp=io.recvline().decode().replace('\n','')
    if 'MENU' in temp:
        break
    else:
        Query.append(temp.split(' ')[0])
# print(len(Query))
io.recvuntil(b'> Option: ')
io.sendline(b'3')
io.recvuntil(b"e.g. '1 2 3 4'.\n")
for _ in range(10):
    io.recvuntil(b'[*] Token: ')
    token=io.recvuntil(b'\n',drop=True).decode()
    io.recvuntil(b'[*] Query Response: ')
    tt=io.recvuntil(b'\n',drop=True).decode()
    # print(token)
    # print(tt)
    # tt=token+tt
    ans = []
    for i in range(1,len(tt)//128+1):
        tmp=(tt[:len(tt)//2][-64*i:])
        # print(tmp)
        l = 0
        for q in Query:
            if tmp in q:
                l+=1
        ans.append(l)
    tmp=token+tt[:len(tt)//2]
    l = 0
    for q in Query:
        if tmp in q:
            l+=1
    ans.append(l)
    ans[0]= ans[0] - 1
    print(ans)

    A=[i for i in range(60)]
    B=[i for i in range(60)]
    # ans=[59, 56, 55, 41, 40, 39, 38, 25, 23, 15, 11, 10]

    for index,a in enumerate(ans):
        for i in A:
            if i not in B:
                continue
            if pas(D[i],index,a):
                continue
            else:
                B.remove(i)
    # assert len(B)==1
    print(B)
    io.recvuntil(b'> Original query: ')
    io.sendline(get_path(ans,D[B[0]],G).encode())
print(io.recv())

Noisy CRC(***)

问题：给定512bits随机数key，输入任意deg=16的多项式，进行模2除法获取结果，对结果进行一个三分之一混淆，恢复key。（这里输入数量没限制。）

我的思路

那就考虑模2多项式的计算了，假如没有混淆，那么获取足够多结果直接crt，就可以恢复。一次结果获取16bits信息
$$\begin{gathered} F=prod(poly) \\ {B}_{i,0},B_{i,1},B_{i,2}为第i次结果的三个混淆 \\ key\mathrm{mod}pol{y}_i=B_{i,0}or{B}_{i,1}or{B}_{i,2} \\ {T}_i=(F/pol{y}_i)\ast (F/pol{y}_i{)}_{pol{y}_i}^{-1} \\ {X}_{i,j}=B_{i,j}\ast T_i,j=0,1,2 \\ 则X的维度是多项式乘积deg \\ M=\left(\begin{array}{c}{X}_{0,0},X_{0,1},X_{0,2},X_{1,0}\cdots \end{array}\right) \\ M\ast x=R \end{gathered}$$
假设要获取x组结果，则M为$16x\times 3x$,x矩阵为待求矩阵表示从3*x中结果选x个出来，R为结果矩阵，由于key为512bits，所以有512bits未知其他位置均为0；

所以对M进行一个切片，取MM=M[:16]+M[16+512]

解这个矩阵，只需要$16x-512>3x$,所以取40组就能够解这个方程。取一下right_kernel就只有一组解了，然后把这个解乘回M，得到key
exp

from Crypto.Util.number import *
def gen_irreducable_poly(deg):
    while True:
        out = R.random_element(degree=deg)
        if out.is_irreducible():
            return out
def poly_to_int(poly):
    temp=poly.coefficients(sparse=False)
    temp=''.join([str(i) for i in temp[::-1]])
    return int(temp,2)
def poly_to_list(poly,k):
    temp=poly.coefficients(sparse=False)
    temp=temp+[0]*(k-len(temp))
    return temp
def int_to_poly(t):
    ttt=[int(i) for i in bin(t)[2:][::-1]]
    return R(ttt)

R.<y> = PolynomialRing(GF(2))
A=[112375, 94245, 74755, 104873, 93519, 97867, 108403, 93829, 102743, 130789, 87899, 100971, 103029, 85095, 128211, 97701, 125389, 67965, 125291, 78453, 129625, 74389, 120341, 72519, 95691, 122371, 107153, 129701, 116597, 125855, 84613, 97713, 79387, 121447, 124979, 85191, 119893, 83337, 85809, 96633]
A=[int_to_poly(i) for i in A]
B=[[36620, 30605, 55378], [37288, 53086, 23901], [9424, 44637, 14879], [49173, 22515, 3305], [52037, 57602, 41489], [10232, 63040, 3093], [12483, 20880, 9293], [36942, 24897, 33246], [40729, 48862, 44721], [65379, 31902, 40372], [17587, 56920, 6409], [50817, 64423, 34010], [17019, 44566, 35333], [2250, 48732, 14110], [27070, 16509, 35188], [58298, 39301, 23367], [49155, 62724, 59102], [12296, 8809, 29885], [41395, 50704, 49622], [61896, 34738, 1508], [44346, 17919, 27349], [44552, 54889, 36544], [38065, 44766, 46645], [63380, 39471, 26478], [28095, 64723, 8166], [60274, 35097, 61139], [55413, 59425, 54478], [23705, 53228, 58073], [51146, 37374, 42299], [53370, 26090, 7631], [34857, 60273, 50648], [53239, 49325, 34924], [38621, 47722, 43259], [25032, 40709, 55023], [30667, 14312, 39883], [42918, 1479, 64405], [6931, 13765, 46001], [62225, 52853, 10779], [28328, 25327, 41710], [37398, 4945, 48357]]
F=prod(A)
S=[]
M=Matrix(GF(2),16*40,120)

for i in range(40):
    T=(F//A[i])*inverse(F//A[i],A[i])
    s1=int_to_poly(B[i][0])*T %F
    s2=int_to_poly(B[i][1])*T %F
    s3=int_to_poly(B[i][2])*T %F
    S.append(s1)
    for k in range(16*40):
        temp1=poly_to_list(s1,16*40)
        temp2=poly_to_list(s2,16*40)
        temp3=poly_to_list(s3,16*40)
        M[k,3*i]=temp1[k]
        M[k,3*i+1]=temp2[k]
        M[k,3*i+2]=temp3[k]
MM = Matrix(GF(2),120,120)
for i in range(16):
    MM[i]=M[i]
for i in range(1,105):
    MM[i+15]=M[-i]
K = MM.right_kernel()
for i in range(1<<K.dimension()):
    print(K[i])
res=(0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0)
BB=[]
for i,j in zip(res,flatten(B)):
    if i==0:
        continue
    BB.append(j)
key=poly_to_int(crt(BB,A))%(2^16)

Noiser CRC(*****)

混淆增大到13，次数限制133，差2^113bits如果按我上题的解法。

考虑简单的爆破，因为$\vec{x}$每13组才有一个2，其余为0，随机选取一下，进行求解也是可能的。

居然蹲到maple爷更新wp了！！！

看到maple爷解法也是跟我一样的爆破想法。

具体记录一下出题人提到的方法

$\vec{x}$如果13bits为一组，每组只有一个1,这样设置13个未知数是有点浪费的。

通过下面这种方法来减少一个未知数,以一组为例
$$\begin{gathered} \vec{x}=\vec{e}+\sum _{i=1}^{12}{k}_i\overrightarrow{v_i} \\ \vec{e}=[1,0,0,0,0,0,0,0,0,0,0,0,0] \\ \overrightarrow{v_1}=[1,1,0,0,0,0,0,0,0,0,0,0,0] \\ ⋮ \\ \overrightarrow{v_{12}}=[1,0,0,0,0,0,0,0,0,0,0,0,1] \\ M\ast E+M\ast V\ast K=R \end{gathered}$$
接下来与上题一样，取133*16-512组来解这个线性方程组
想法真滴妙！！！

这样从13n降到12n，完全是可解的

交互代码

from pwn import *
# context.log_level='debug'
io=remote('chals.sekai.team',3006)
# A=[112375, 94245, 74755, 104873, 93519, 97867, 108403, 93829, 102743, 130789, 87899, 100971, 103029, 85095, 128211, 97701, 125389, 67965, 125291, 78453, 129625, 74389, 120341, 72519, 95691, 122371, 107153, 129701, 116597, 125855, 84613, 97713, 79387, 121447, 124979, 85191, 119893, 83337, 85809, 96633]
#不可约多项式a很好生成
A = [105337, 79627, 119763, 72595, 74089, 121399, 110141, 67811, 116873, 89813, 73411, 83549, 79413, 77011, 76697, 123685, 112685, 70123, 103819, 102715, 84501, 96139, 110961, 76973, 73385, 88891, 114605, 66155, 78173, 117331, 74415, 106607, 81331, 102961, 127165, 98471, 83067, 79003, 113027, 129661, 97015, 90423, 100859, 114553, 95757, 123947, 71827, 97327, 99741, 70273, 67605, 93349, 119613, 104363, 109529, 120303, 105109, 87059, 102817, 129963, 117755, 111931, 100735, 85343, 116373, 80077, 78539, 116623, 112549, 120699, 120245, 76043, 89393, 66867, 121763, 72711, 99263, 67595, 65725, 66541, 85869, 91171, 76105, 122029, 101959, 71163, 75899, 65607, 79767, 126247, 81261, 74011, 107723, 90471, 111181, 120311, 122767, 78835, 127501, 91579, 76445, 73095, 127125, 72549, 95831, 66165, 79175, 107297, 81073, 123131, 118511, 124737, 65871, 110401, 112399, 105455, 74533, 121041, 118381, 126427, 112621, 123103, 127893, 74389, 100033, 68191, 101921, 80633, 120889, 108975, 128671, 68721, 85847]
#
io.recvuntil(b'Encrypted flag: ')
flag=io.recvuntil(b'\n',drop=True).decode()
print(flag)
B=[]
for i in A:
    io.recvuntil(b'polynomial: ')
    io.sendline(str(i).encode())
    B.append(eval(io.recvuntil(b'\n',drop=True)))
print(B)

exp

from Crypto.Util.number import *
from hashlib import sha256
from Crypto.Cipher import AES
def gen_irreducable_poly(deg):
    while True:
        out = R.random_element(degree=deg)
        if out.is_irreducible():
            return out
def poly_to_int(poly):
    temp=poly.coefficients(sparse=False)
    temp=''.join([str(i) for i in temp[::-1]])
    return int(temp,2)
def poly_to_list(poly,k):
    temp=poly.coefficients(sparse=False)
    temp=temp+[0]*(k-len(temp))
    return temp
def int_to_poly(t):
    ttt=[int(i) for i in bin(t)[2:][::-1]]
    return R(ttt)
B=[[32297, 16168, 5166, 29867, 1579, 35488, 29078, 1895, 57538, 36934, 15758, 25581, 62917], [7746, 25263, 63161, 38780, 11725, 56151, 18218, 5569, 12333, 851, 3688, 62177, 16990], [59956, 25436, 7508, 48471, 23579, 48033, 52487, 54043, 29939, 51352, 17682, 25572, 45792], [15741, 4012, 36504, 37797, 15952, 17950, 58943, 26428, 60406, 20143, 49315, 17030, 45956], [2969, 34280, 64293, 47427, 45139, 62210, 9035, 40469, 40956, 51856, 58195, 11538, 22855], [43069, 52088, 813, 23419, 57404, 63665, 13091, 35359, 27758, 64447, 16201, 37637, 24453], [5103, 52893, 53979, 36626, 8833, 10578, 10067, 60122, 8138, 7574, 63795, 27944, 7653], [58444, 61341, 10795, 34896, 59241, 18612, 18814, 28751, 26560, 24557, 21243, 8054, 13193], [52533, 35046, 40586, 64376, 54254, 39164, 36240, 45673, 29320, 6896, 50726, 63944, 8317], [62033, 1506, 38162, 50533, 51859, 32713, 35493, 52245, 34282, 10487, 18469, 34914, 60573], [26203, 24224, 31603, 8742, 48628, 52825, 52023, 22940, 31314, 22362, 35922, 9705, 17879], [33279, 52870, 44278, 54978, 27743, 33322, 59973, 18953, 42095, 17853, 56753, 62609, 5006], [42456, 17230, 5778, 12580, 39475, 53076, 29307, 40188, 41830, 39703, 27669, 44913, 44079], [62985, 42088, 4161, 58118, 7522, 63731, 35760, 51635, 11056, 62240, 29977, 38148, 724], [44828, 53591, 45872, 54673, 46003, 61685, 46413, 47498, 14161, 53458, 55383, 6256, 20672], [50865, 3029, 25953, 7876, 51539, 25509, 5294, 24127, 20490, 51647, 8689, 20234, 38421], [6491, 36818, 60850, 57713, 62703, 62014, 1489, 55326, 51276, 41290, 6301, 54668, 36985], [50659, 54554, 54621, 23866, 45907, 63575, 46704, 5183, 27616, 37991, 48473, 10095, 21300], [58912, 26227, 39032, 26512, 21716, 28571, 39343, 14909, 54619, 37237, 11230, 52666, 11355], [5067, 23683, 43864, 22667, 29644, 50758, 64745, 38276, 32588, 19001, 38541, 33820, 45606], [53129, 27007, 29125, 39727, 53388, 49649, 19857, 39037, 2983, 27956, 46213, 2580, 24322], [37199, 38902, 50553, 46381, 40089, 17844, 59790, 114, 56866, 6318, 6948, 11486, 51990], [53375, 62175, 61592, 16579, 32742, 14264, 49651, 64754, 26225, 51798, 48728, 27474, 37487], [52189, 49698, 2368, 52006, 47226, 14351, 36804, 45973, 46352, 20849, 44664, 19406, 40445], [27529, 19316, 2150, 26865, 14924, 62109, 45658, 15492, 48861, 63922, 58230, 58918, 49683], [33121, 17986, 41324, 1635, 14565, 20286, 10354, 47460, 51385, 13893, 9539, 10597, 13535], [49771, 61561, 50391, 6580, 55503, 64437, 12289, 62019, 1841, 7310, 4834, 21926, 4672], [40458, 32862, 23497, 51547, 61884, 9288, 25652, 18152, 32326, 45173, 10339, 38783, 36875], [16199, 34749, 36020, 59013, 12767, 9588, 15666, 64034, 59696, 56401, 63366, 3227, 5334], [10854, 27611, 166, 34251, 27832, 22446, 5941, 48685, 45614, 11876, 11204, 42181, 46459], [21001, 55357, 30235, 50208, 15681, 36143, 58090, 28459, 51986, 64375, 56533, 12072, 43976], [36720, 8515, 22840, 57383, 45738, 31862, 30062, 28812, 45959, 40177, 58784, 44968, 44582], [30917, 64928, 11534, 60927, 7755, 59869, 11421, 10295, 53230, 57884, 22516, 11996, 30142], [40978, 59313, 52289, 64189, 60516, 225, 13703, 35030, 3976, 21700, 47582, 47477, 50446], [33131, 1483, 6337, 55094, 58278, 32167, 11330, 63402, 14837, 49420, 12917, 29193, 60176], [49273, 296, 36847, 17560, 62113, 25686, 59944, 41032, 12616, 13960, 10584, 52863, 23474], [28984, 31277, 33724, 64441, 1228, 9220, 46673, 5533, 11503, 37669, 12306, 10780, 58482], [49087, 3598, 53210, 2419, 12074, 37303, 36323, 49382, 22640, 14355, 31375, 51399, 53420], [57138, 30231, 1192, 20215, 51067, 53239, 634, 63631, 40525, 35350, 10787, 39913, 38594], [30419, 60910, 32205, 26245, 49481, 15594, 36791, 9215, 17021, 26505, 1427, 40297, 1632], [53872, 8347, 26276, 25756, 33674, 46452, 52133, 5910, 40985, 47475, 51711, 28178, 4473], [38612, 29247, 33930, 21366, 19405, 22312, 6547, 56779, 44492, 1871, 54825, 48792, 17860], [52173, 54933, 37753, 31840, 43977, 62848, 32568, 51297, 20259, 44999, 49198, 15035, 12118], [49433, 33916, 21686, 9555, 36382, 34613, 16516, 658, 25799, 48081, 46598, 24224, 37138], [39297, 56090, 11266, 65508, 32183, 21996, 27091, 40727, 40656, 16864, 6985, 45522, 53617], [59145, 5267, 36219, 6524, 41561, 61790, 28495, 32362, 38997, 44240, 59598, 18264, 50059], [47934, 25741, 56768, 55252, 38281, 33762, 53411, 26486, 33312, 56405, 13103, 25361, 38707], [57552, 12570, 2589, 16063, 14171, 60824, 61326, 44348, 26983, 52018, 5394, 29372, 46352], [53591, 16412, 58502, 7821, 62598, 63134, 14342, 2882, 2601, 40419, 11040, 44497, 11257], [34152, 58577, 29292, 52487, 58610, 52362, 5312, 39391, 5527, 22463, 47221, 30178, 19941], [25590, 18593, 5966, 161, 30794, 5072, 11225, 36807, 62605, 64658, 35674, 61875, 18618], [38181, 35516, 40790, 2410, 15331, 19399, 27044, 33855, 21269, 16694, 52155, 9170, 4996], [47118, 56141, 5454, 13463, 63161, 45195, 54473, 47745, 25017, 18431, 26356, 2972, 39456], [50493, 13066, 19327, 58146, 24791, 59593, 39599, 11997, 50273, 38280, 5848, 28371, 18875], [27613, 31012, 9647, 59485, 29973, 15797, 64636, 47674, 2210, 59523, 49593, 34386, 50714], [21011, 14429, 11303, 21696, 4078, 57839, 48766, 11771, 62965, 22602, 41685, 9958, 18708], [60142, 49060, 132, 36515, 9938, 61356, 11581, 5961, 1159, 12442, 48843, 25130, 26313], [43030, 51361, 34537, 32256, 46515, 25373, 8916, 27089, 3181, 8362, 64469, 56035, 47138], [22587, 14715, 58778, 64630, 5982, 63773, 3269, 21707, 61414, 5979, 19663, 36110, 4495], [55207, 51079, 42543, 49325, 33929, 65294, 32620, 13898, 21029, 58895, 13098, 59046, 29317], [37852, 30236, 54471, 58376, 53397, 17180, 61566, 12684, 32190, 65209, 36368, 1934, 64576], [58117, 3572, 30720, 63936, 23553, 8467, 65111, 47214, 9201, 29844, 110, 41205, 32368], [49402, 51080, 34254, 6308, 45999, 21297, 54740, 34356, 31996, 37171, 7804, 40022, 59901], [36286, 12176, 43016, 13982, 5250, 44691, 14429, 29626, 58640, 5654, 61878, 33549, 605], [15374, 19872, 9625, 22665, 58044, 19726, 10345, 33559, 43612, 11738, 48066, 49659, 13873], [29484, 55107, 63926, 39978, 59665, 19087, 44474, 32330, 31064, 3253, 39869, 10857, 33413], [29939, 57133, 56005, 10154, 48241, 29987, 31033, 20123, 18635, 3013, 1939, 32723, 3518], [27527, 44825, 38019, 58710, 50159, 22977, 22266, 24771, 35413, 56861, 3898, 40063, 60164], [27731, 23412, 9462, 57735, 507, 24352, 65364, 43251, 7754, 61004, 29503, 26400, 23404], [36245, 622, 44551, 30744, 8155, 17666, 40068, 59881, 64939, 28842, 40641, 31626, 42514], [48684, 62988, 22006, 65041, 40916, 53175, 34559, 16241, 30550, 14215, 10567, 38539, 34708], [15727, 62575, 18724, 40856, 55432, 14563, 33345, 45525, 12830, 8352, 47307, 18753, 50858], [17913, 22122, 21893, 38334, 15463, 25283, 4450, 25762, 49034, 48281, 11394, 3031, 64294], [65127, 50385, 36456, 686, 43381, 11097, 44707, 38292, 21352, 39794, 8362, 39765, 58936], [48804, 13277, 8086, 44857, 12607, 24291, 957, 7277, 14258, 26079, 32419, 8427, 56132], [57133, 33549, 57985, 29166, 56976, 51783, 8431, 44341, 8121, 7100, 51429, 34954, 26349], [11737, 55803, 9668, 62987, 43985, 12582, 6047, 51568, 61369, 2291, 55666, 55937, 47204], [18625, 29061, 14480, 14662, 55848, 10615, 57977, 9500, 35953, 46253, 50819, 2142, 33573], [7532, 22774, 47704, 15065, 40352, 52212, 36444, 33713, 27468, 12352, 32067, 57380, 64862], [8976, 27354, 5470, 50489, 28499, 31093, 55023, 5865, 40231, 43395, 21313, 60036, 56689], [18691, 45887, 10571, 47544, 6883, 17061, 694, 8815, 49539, 1843, 15353, 47892, 15480], [31461, 19699, 42765, 7154, 5762, 10639, 36196, 64038, 58537, 51405, 48786, 8342, 47548], [19418, 1692, 63966, 39191, 48554, 40672, 60127, 39344, 42609, 36860, 2555, 37434, 22120], [39544, 56961, 55947, 34337, 56795, 17383, 6236, 7275, 63592, 61370, 60605, 46041, 9409], [57831, 47311, 35285, 1728, 15311, 64468, 41528, 42555, 56332, 46167, 30695, 27055, 53497], [52283, 15492, 9749, 39798, 7897, 39362, 33493, 63132, 31038, 8148, 25325, 39095, 61793], [35588, 12134, 11584, 19381, 42913, 27933, 40248, 13248, 27894, 12766, 12724, 28181, 58274], [58172, 9778, 19391, 52611, 54560, 30905, 53134, 36522, 46696, 51954, 24445, 14443, 33275], [42088, 2556, 1413, 6856, 52362, 25376, 61868, 22781, 8257, 15579, 2703, 4949, 37351], [13806, 39371, 46222, 59983, 29696, 57989, 64093, 64776, 45560, 12508, 14463, 17126, 12202], [46123, 62625, 45067, 47743, 15402, 43188, 33888, 9623, 52415, 4939, 13262, 45954, 47667], [7869, 34972, 26865, 8665, 39230, 28157, 59108, 65130, 22047, 39997, 55491, 104, 18990], [15370, 26525, 59061, 24343, 52277, 34807, 46740, 11834, 50350, 26503, 48282, 65204, 12228], [56072, 4664, 46761, 59953, 29949, 16526, 48660, 24409, 8588, 11383, 31506, 51825, 27939], [27406, 22362, 52952, 42687, 47725, 37006, 31100, 31510, 50527, 37557, 23905, 51665, 50492], [17710, 5534, 13449, 49339, 16714, 15418, 10150, 13239, 29845, 12059, 54882, 20050, 53447], [24513, 33526, 31399, 14148, 58401, 5793, 26583, 5809, 39651, 54956, 22824, 40416, 6775], [41649, 1877, 42103, 6977, 18136, 25973, 8246, 8665, 56207, 56900, 21406, 3541, 61572], [62219, 38094, 50383, 21823, 47996, 19749, 46962, 7703, 46954, 13698, 58534, 55082, 2713], [22912, 54582, 10385, 51272, 24370, 12885, 23547, 60426, 49015, 19113, 65437, 34809, 29493], [10213, 10488, 52305, 572, 13468, 62660, 44232, 21446, 33791, 42104, 34366, 59525, 14527], [8883, 12286, 44243, 41239, 64847, 44162, 19499, 43341, 42046, 53175, 39164, 44939, 35143], [39715, 35042, 42602, 556, 23896, 37538, 37541, 45653, 4667, 1340, 64104, 14059, 15605], [35885, 20500, 7283, 826, 35021, 5708, 60930, 42303, 53351, 26530, 56093, 41787, 43145], [8616, 40717, 12006, 52603, 53763, 55129, 19103, 27159, 55731, 24660, 49165, 18855, 57474], [17950, 60314, 23770, 11845, 14136, 24665, 12919, 14721, 464, 38952, 48943, 6720, 4930], [10530, 28094, 59637, 54496, 42373, 2111, 32132, 57139, 11584, 42077, 2479, 13569, 17060], [51058, 64464, 18833, 37466, 29817, 57094, 49312, 10003, 23129, 62696, 1065, 43434, 52817], [58609, 11316, 11864, 48596, 29086, 47833, 62179, 62952, 28955, 62866, 60724, 8309, 54931], [63262, 12199, 44009, 24769, 22188, 46361, 10, 13694, 21791, 21205, 29149, 58762, 41876], [29286, 32844, 17801, 21394, 23848, 59001, 20736, 40869, 22487, 52687, 15126, 26927, 40845], [46518, 10431, 14169, 55162, 64868, 24396, 45949, 37302, 41297, 43881, 50699, 15801, 27854], [57507, 24937, 16085, 45605, 10912, 6373, 26883, 7599, 13950, 48818, 26438, 53019, 14728], [35988, 35775, 4666, 49405, 52203, 45233, 50644, 57208, 4178, 4084, 45410, 15431, 42106], [15140, 65471, 64545, 16956, 20397, 31582, 10473, 47793, 45560, 35874, 5118, 52955, 46817], [54210, 43416, 52356, 63654, 2709, 2461, 26424, 20760, 28836, 6504, 28147, 50149, 57336], [37129, 64035, 21707, 5554, 24832, 29442, 47746, 40967, 46372, 36051, 39944, 58047, 41817], [65336, 43500, 13021, 54220, 25154, 28264, 34032, 18941, 36430, 63391, 8933, 239, 45911], [32612, 36529, 45087, 43330, 65060, 28179, 28773, 39002, 32330, 38616, 26842, 15003, 6196], [49666, 37075, 5344, 22633, 52413, 2715, 60522, 58937, 17087, 62201, 2226, 1518, 64915], [33710, 12541, 59310, 50112, 43068, 48514, 47792, 10420, 12271, 5013, 6386, 33783, 9546], [15779, 50058, 11831, 27915, 9250, 30199, 55180, 33354, 23568, 37873, 12138, 57556, 61882], [45848, 58187, 44546, 56936, 3248, 42420, 5891, 38271, 61099, 2582, 46501, 10273, 33605], [28672, 63683, 33772, 58628, 18179, 39623, 21584, 53532, 13051, 32214, 3907, 13923, 9562], [42992, 42561, 4580, 17710, 59880, 22675, 37098, 64656, 41280, 20935, 57421, 41153, 23285], [42174, 48160, 56468, 10081, 22857, 9203, 41269, 9147, 6842, 45774, 27550, 22812, 32921], [58822, 33708, 45179, 2462, 36688, 623, 52118, 32909, 44944, 29051, 35051, 65334, 43807], [38502, 22399, 44494, 54197, 40986, 8792, 6286, 4324, 10273, 13376, 14105, 44783, 10023], [64309, 13671, 25013, 23147, 487, 26280, 9464, 6841, 13126, 6706, 18375, 19177, 64540], [16850, 62178, 47577, 11047, 63055, 32923, 10621, 55986, 63142, 62433, 37102, 7919, 7643], [7912, 5316, 16861, 44315, 20019, 24119, 31025, 63819, 46132, 33966, 42030, 38663, 9665], [30832, 39068, 63235, 41165, 16478, 64221, 21960, 4249, 7475, 9876, 53447, 50474, 45314], [38501, 30985, 64860, 64453, 6138, 51091, 45636, 53259, 15885, 36559, 9156, 35176, 20828]]
R.<y> = PolynomialRing(GF(2))
# test=int_to_poly(getrandbits(512))
A=[105337, 79627, 119763, 72595, 74089, 121399, 110141, 67811, 116873, 89813, 73411, 83549, 79413, 77011, 76697, 123685, 112685, 70123, 103819, 102715, 84501, 96139, 110961, 76973, 73385, 88891, 114605, 66155, 78173, 117331, 74415, 106607, 81331, 102961, 127165, 98471, 83067, 79003, 113027, 129661, 97015, 90423, 100859, 114553, 95757, 123947, 71827, 97327, 99741, 70273, 67605, 93349, 119613, 104363, 109529, 120303, 105109, 87059, 102817, 129963, 117755, 111931, 100735, 85343, 116373, 80077, 78539, 116623, 112549, 120699, 120245, 76043, 89393, 66867, 121763, 72711, 99263, 67595, 65725, 66541, 85869, 91171, 76105, 122029, 101959, 71163, 75899, 65607, 79767, 126247, 81261, 74011, 107723, 90471, 111181, 120311, 122767, 78835, 127501, 91579, 76445, 73095, 127125, 72549, 95831, 66165, 79175, 107297, 81073, 123131, 118511, 124737, 65871, 110401, 112399, 105455, 74533, 121041, 118381, 126427, 112621, 123103, 127893, 74389, 100033, 68191, 101921, 80633, 120889, 108975, 128671, 68721, 85847]
A=[int_to_poly(a) for a in A]
# B=[]
# for a in A:
#     temp=[]
#     temp.append(poly_to_int(y^16*test %a))
#     for _ in range(12):
#         temp.append(getrandbits(16))
#     B.append(temp)
F=prod(A)
M=Matrix(GF(2),16*133,133*13)

for i in range(133):
    T=(F//A[i])*inverse(F//A[i],A[i])
    S=[]
    for j in range(13):
        s=(int_to_poly(B[i][j])*T %F)
        S.append(poly_to_list(s,16*133))
    for k in range(16*133):
        for s in range(13):
            M[k,13*i+s]=S[s][k]
E = vector(GF(2),[1,0,0,0,0,0,0,0,0,0,0,0,0]*133)
V = Matrix(GF(2),12*133,13*133)
for i in range(133):
    for j in range(12):
        temp=[0]*133*13
        temp[i*13]=1
        temp[i*13+1+j]=1
        V[i*12+j]=vector(GF(2),temp)
# print(V[0])
V=V.T
Tar = -M*E
MM = M*V
MM = block_matrix([[MM[:16]],[MM[528:]]])
Tar = vector(GF(2),Tar[:16].list()+Tar[528:].list())
res=MM.solve_right(Tar)
K=MM.right_kernel()
def get_right(temp):
    for j in range(0,133*13,13):
#         print(sum(temp[j:j+13].change_ring(ZZ)))
        if (sum(temp[j:j+13].change_ring(ZZ)))!=1:
            return False
    return True
for i in range(1<<K.dimension()):
    temp=K[i]+res
    temp=E+V*temp
    if get_right(temp):
        print(temp)

Flag=(0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0)
Flag=vector(GF(2),Flag)
Flag=M*Flag
Flag=[str(i) for i in Flag]
key=int(''.join(Flag)[::-1],2)>>16
ct=bytes.fromhex('34a431ff1ffd88f389997996d9d4c8883874e67e5290af766b22')
cipher = AES.new(sha256(long_to_bytes(key)).digest()[:16], AES.MODE_CTR, nonce=b"12345678")
flag = cipher.decrypt(ct)
print(flag)
#b'SEKAI{4R3_Y0U_cRc_M4s73R?}'

这个题收获很大，希望有机会用到。

Diffecientwo

没做，插眼复现

RandSubWare

没做，插眼复现