{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-gpn-ctf-2024-en","result":{"data":{"markdownRemark":{"id":"9478c5a6-5387-5af1-833d-4dfc9a00e97c","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I joined GPN CTF 2024 for a bit.

\n

The dashboard looked like a music app and was pretty stylish.

\n

\n \n \n \n \n \n \n \n \n

\n\n

Table of Contents

\n\n

Never gonna run around and reverse you(Rev)

\n
\n

I thought of this really cool collision free hash function and hashed the flag with it. Theoretically you shouldn’t be able to reverse it…

\n
\n

When I looked at the challenge binary, the implementation was as follows.

\n

\n \n \n \n \n \n \n \n \n

\n

You can see that the correct Flag can be obtained by XORing each character from the second onward with the previous character.

\n

So I used the following solver to recover the Flag.

\n
flag = b\"\\x47\\x17\\x59\\x1a\\x4e\\x08\\x73\\x24\\x10\\x21\\x55\\x79\\x26\\x4e\\x7e\\x09\\x56\\x32\\x03\\x67\\x38\\x41\\x71\\x04\\x5b\\x28\\x18\\x74\\x02\\x31\\x6e\\x1a\\x72\\x43\\x30\\x0f\\x50\\x19\\x46\\x32\\x5a\\x6a\\x1f\\x78\\x10\\x64\\x3b\\x0a\\x7e\\x21\\x56\\x62\\x57\\x08\\x3c\\x63\\x04\\x34\\x04\\x60\\x3f\\x57\\x63\\x56\\x3e\\x43\"\n\nprint(flag[0].decode(), end=\"\")\nfor i in range(1, len(flag)):\n    print(chr(flag[i]^flag[i-1]), end=\"\")\n\n# print(\"\")GPNCTF{W41t,_h0w_d1d_y0u_s0lv3_th1s?_I_th0ught_1t_w45_4_g00d_h45h}
\n

Archventure time(Rev)

\n
\n

I found this funny multi-arch music software but I can’t remember my license key.

\n

Can you recover it for me?

\n
\n

This challenge was rated Easy, but honestly it felt a bit like a fake Easy.

\n

Analyzing the binary showed that if you enter the correct license key, the flag is decrypted with AES.

\n

The license format is hyphen-separated every five characters, like 06788-9BBCK-KMOPP-UVWYY.

\n

The license entered into the program is validated separately by four forked child processes.

\n

An input that passes all four of these checks is the correct input.

\n

Also, the programs used for these four checks are all binaries for architectures other than Intel CPUs, and they are executed via qemu.

\n

Stage1: RISV-V Binary

\n

The binary used for the first check was an ELF binary for the RISV-V architecture.

\n

This binary is called as a child process from the original program using qemu-riscv64 -L /usr/riscv64-linux-gnu.

\n

The command-line argument is the license key string with the hyphens removed.

\n

When I decompiled this RISC-V binary in Ghidra, it compared whether the result of applying some processing to the string received as a command-line argument matched 067889BBCKKMOPPUVWYY.

\n

\n \n \n \n \n \n \n \n \n

\n

Inside this binary, the following kind of processing was recursively applied to the input value.

\n

\n \n ) <= flag[idx], flag[idx] <= ord('9')), flag[idx] - z3.BitVecVal(ord('0'), 8), z3.BitVecVal(0, 8))\n u += z3.If(z3.And(ord('A') <= flag[idx], flag[idx] <= ord('Z')), flag[idx] - z3.BitVecVal(ord('A'), 8), z3.BitVecVal(0, 8))\n\n solver.add(n == nums[i])\n solver.add(u == uppers[i])\n

Indeed, by separately preparing bit-vectors that count the totals for each 5-character block and using If to distinguish letters from digits, we can incorporate this condition as a constraint.

\n

Stage3: PowerPC Binary

\n

I had quite a hard time analyzing the PowerPC binary for this stage, partly because I was unfamiliar with the format.

\n

At first, when I analyzed the challenge binary in Ghidra, I could not properly analyze the entry-point processing as shown below, so I gave up, thinking Ghidra might not support the format.

\n

\n \n \n \n \n \n \n \n \n

\n

The reason for this odd output was apparently that the main function was not linked to the entry point, while Ghidra could still analyze the implementations of the individual functions in the binary.

\n

Since there were not many functions, I identified the code that seemed to be main from the decompilation results.

\n

After investigating a bit, the following function looked very likely to correspond to main, since it checked the number of command-line arguments at runtime and then performed some processing.

\n

\n \n \n \n \n \n \n \n \n

\n

Stage 4 was an aarch64 binary.

\n

Looking at the decompilation result of this binary in Ghidra, we can see that it runs two for loops over the key received from the command-line argument, and the validation succeeds only if all checks in both loops are passed.

\n

\n \n \n \n \n \n \n \n \n

\n

From there, rewriting this decompilation result in Python lets us inspect the contents of each check performed inside the loops.

\n
TB_100938 = [0x4900000000, ...]\nTB_100940 = [0x3500000012, ...]\n\nfor k in range(20):\n    for l in range(10):\n        _10kl = k*10 + l\n        tmp = TB_100938[_10kl*2] >> 0x20\n        A = TB_100940[_10kl*2] & 0xFF\n        B = TB_100940[_10kl*2] >> 0x20\n        print(f\"solver.add(z3.Implies(flag[{k}] == {tmp}, flag[{A}] == {B}))\")
\n

When we actually run this code, we can generate the following solver.

\n

As in the previous section, Implies is a method that can express that if condition A holds, then condition B must also hold.

\n
solver.add(z3.Implies(flag[0] == 73, flag[18] == 53))\nsolver.add(z3.Implies(flag[0] == 89, flag[11] == 79))\nsolver.add(z3.Implies(flag[0] == 86, flag[14] == 85))\nsolver.add(z3.Implies(flag[0] == 76, flag[6] == 73))\n{{ omitted }}
\n

This gave me a solver that can pass all the checks.

\n

Retrieving the Flag

\n

The script I built up to this point is shown below.

\n
import z3\n\nflag = [z3.BitVec(f\"b{i}\", 8) for i in range(20)]\nsolver = z3.Solver()\n\n# Base\nfor f in flag:\n    solver.add(\n        z3.Or(\n            z3.And(ord('0') <= f, f <= ord('9')),\n            z3.And(ord('A') <= f, f <= ord('Z'))\n        )\n    )\n\n# Stage1\ncnt = [z3.IntVal(0) for _ in range(36)]\nfor f in flag:\n    cnt[0] += z3.If(f == 65, z3.IntVal(1), z3.IntVal(0))\n    cnt[1] += z3.If(f == 66, z3.IntVal(1), z3.IntVal(0))\n    cnt[2] += z3.If(f == 67, z3.IntVal(1), z3.IntVal(0))\n    cnt[3] += z3.If(f == 68, z3.IntVal(1), z3.IntVal(0))\n    cnt[4] += z3.If(f == 69, z3.IntVal(1), z3.IntVal(0))\n    cnt[5] += z3.If(f == 70, z3.IntVal(1), z3.IntVal(0))\n    cnt[6] += z3.If(f == 71, z3.IntVal(1), z3.IntVal(0))\n    cnt[7] += z3.If(f == 72, z3.IntVal(1), z3.IntVal(0))\n    cnt[8] += z3.If(f == 73, z3.IntVal(1), z3.IntVal(0))\n    cnt[9] += z3.If(f == 74, z3.IntVal(1), z3.IntVal(0))\n    cnt[10] += z3.If(f == 75, z3.IntVal(1), z3.IntVal(0))\n    cnt[11] += z3.If(f == 76, z3.IntVal(1), z3.IntVal(0))\n    cnt[12] += z3.If(f == 77, z3.IntVal(1), z3.IntVal(0))\n    cnt[13] += z3.If(f == 78, z3.IntVal(1), z3.IntVal(0))\n    cnt[14] += z3.If(f == 79, z3.IntVal(1), z3.IntVal(0))\n    cnt[15] += z3.If(f == 80, z3.IntVal(1), z3.IntVal(0))\n    cnt[16] += z3.If(f == 81, z3.IntVal(1), z3.IntVal(0))\n    cnt[17] += z3.If(f == 82, z3.IntVal(1), z3.IntVal(0))\n    cnt[18] += z3.If(f == 83, z3.IntVal(1), z3.IntVal(0))\n    cnt[19] += z3.If(f == 84, z3.IntVal(1), z3.IntVal(0))\n    cnt[20] += z3.If(f == 85, z3.IntVal(1), z3.IntVal(0))\n    cnt[21] += z3.If(f == 86, z3.IntVal(1), z3.IntVal(0))\n    cnt[22] += z3.If(f == 87, z3.IntVal(1), z3.IntVal(0))\n    cnt[23] += z3.If(f == 88, z3.IntVal(1), z3.IntVal(0))\n    cnt[24] += z3.If(f == 89, z3.IntVal(1), z3.IntVal(0))\n    cnt[25] += z3.If(f == 90, z3.IntVal(1), z3.IntVal(0))\n    cnt[26] += z3.If(f == 48, z3.IntVal(1), z3.IntVal(0))\n    cnt[27] += z3.If(f == 49, z3.IntVal(1), z3.IntVal(0))\n    cnt[28] += z3.If(f == 50, z3.IntVal(1), z3.IntVal(0))\n    cnt[29] += z3.If(f == 51, z3.IntVal(1), z3.IntVal(0))\n    cnt[30] += z3.If(f == 52, z3.IntVal(1), z3.IntVal(0))\n    cnt[31] += z3.If(f == 53, z3.IntVal(1), z3.IntVal(0))\n    cnt[32] += z3.If(f == 54, z3.IntVal(1), z3.IntVal(0))\n    cnt[33] += z3.If(f == 55, z3.IntVal(1), z3.IntVal(0))\n    cnt[34] += z3.If(f == 56, z3.IntVal(1), z3.IntVal(0))\n    cnt[35] += z3.If(f == 57, z3.IntVal(1), z3.IntVal(0))\n\nexpected = [0, 2, 1, 0, 0, 0, 0, 0, 0, 0, 2, 0, 1, 0, 1, 2, 0, 0, 0, 0, 1, 1, 1, 0, 2, 0, 1, 0, 0, 0, 0, 0, 1, 1, 2, 1]\nfor i, exp in enumerate(expected):\n    solver.add(cnt[i] == exp)\n\n# Stage2\nnums = [0, 7, 0xE, 0x11]\nuppers = [0x3D, 0x24, 0x2C, 0x32]\n\nfor i in range(4):\n    n = z3.BitVecVal(0, 8)\n    u = z3.BitVecVal(0, 8)\n    for j in range(5):\n        idx = i * 5 + j\n        n += z3.If(z3.And(ord('0') <= flag[idx], flag[idx] <= ord('9')), flag[idx] - z3.BitVecVal(ord('0'), 8), z3.BitVecVal(0, 8))\n        u += z3.If(z3.And(ord('A') <= flag[idx], flag[idx] <= ord('Z')), flag[idx] - z3.BitVecVal(ord('A'), 8), z3.BitVecVal(0, 8))\n\n    solver.add(n == nums[i])\n    solver.add(u == uppers[i])\n\n# Stage3\nfor i in range(19):\n    solver.add(z3.Implies(flag[i] == 65, z3.Or(*[flag[i+1] == x for x in [0x48, 0x4F, 0x57, 0x46, 0x4D, 0x32, 0x41, 0x31, 0x54, 0x45, 0x53, 0x58, 0x30, 0x4B, 0x43, 0x51, 0x35, 0x42, 0x59, 0x44, 0x4A, 0x37, 0x50, 0x38]])))\n    solver.add(z3.Implies(flag[i] == 66, z3.Or(*[flag[i+1] == x for x in [0x33, 0x44, 0x5A, 0x4A, 0x48, 0x42, 0x32, 0x55, 0x4F, 0x53, 0x39, 0x4D, 0x54, 0x38, 0x4C, 0x4E, 0x57, 0x4B, 0x45, 0x46, 0x56, 0x36, 0x49, 0x37]])))\n    solver.add(z3.Implies(flag[i] == 67, z3.Or(*[flag[i+1] == x for x in [0x4E, 0x41, 0x4B, 0x31, 0x4C, 0x51, 0x48, 0x58, 0x55, 0x4F, 0x57, 0x5A, 0x36, 0x45, 0x44, 0x39, 0x52, 0x53, 0x30, 0x42, 0x4A, 0x37, 0x54, 0x35]])))\n    solver.add(z3.Implies(flag[i] == 68, z3.Or(*[flag[i+1] == x for x in [0x48, 0x39, 0x4F, 0x4A, 0x56, 0x36, 0x4D, 0x31, 0x53, 0x41, 0x50, 0x43, 0x35, 0x47, 0x57, 0x30, 0x55, 0x45, 0x38, 0x49, 0x5A, 0x59, 0x51, 0x4E]])))\n    solver.add(z3.Implies(flag[i] == 69, z3.Or(*[flag[i+1] == x for x in [0x57, 0x39, 0x56, 0x55, 0x34, 0x36, 0x49, 0x46, 0x59, 0x50, 0x4E, 0x4A, 0x58, 0x4F, 0x32, 0x43, 0x41, 0x31, 0x37, 0x4B, 0x47, 0x30, 0x44, 0x4D]])))\n    solver.add(z3.Implies(flag[i] == 70, z3.Or(*[flag[i+1] == x for x in [0x48, 0x39, 0x4D, 0x51, 0x46, 0x31, 0x57, 0x47, 0x56, 0x30, 0x43, 0x4E, 0x49, 0x38, 0x42, 0x41, 0x4C, 0x55, 0x58, 0x53, 0x44, 0x52, 0x5A, 0x33]])))\n    solver.add(z3.Implies(flag[i] == 71, z3.Or(*[flag[i+1] == x for x in [0x37, 0x31, 0x33, 0x38, 0x55, 0x53, 0x35, 0x44, 0x4A, 0x4D, 0x4E, 0x4C, 0x58, 0x49, 0x47, 0x54, 0x59, 0x36, 0x30, 0x57, 0x5A, 0x50, 0x34, 0x39]])))\n    solver.add(z3.Implies(flag[i] == 72, z3.Or(*[flag[i+1] == x for x in [0x31, 0x34, 0x33, 0x36, 0x38, 0x4D, 0x44, 0x56, 0x4A, 0x4E, 0x52, 0x49, 0x35, 0x4F, 0x32, 0x53, 0x4C, 0x48, 0x55, 0x58, 0x42, 0x5A, 0x30, 0x43]])))\n    solver.add(z3.Implies(flag[i] == 73, z3.Or(*[flag[i+1] == x for x in [0x48, 0x31, 0x49, 0x34, 0x59, 0x4C, 0x5A, 0x41, 0x32, 0x55, 0x35, 0x44, 0x39, 0x43, 0x47, 0x37, 0x4A, 0x46, 0x4D, 0x58, 0x42, 0x51, 0x53, 0x30]])))\n    solver.add(z3.Implies(flag[i] == 74, z3.Or(*[flag[i+1] == x for x in [0x39, 0x48, 0x47, 0x59, 0x4F, 0x36, 0x31, 0x37, 0x5A, 0x30, 0x46, 0x55, 0x4C, 0x56, 0x45, 0x50, 0x53, 0x4A, 0x41, 0x58, 0x52, 0x42, 0x57, 0x51]])))\n    solver.add(z3.Implies(flag[i] == 75, z3.Or(*[flag[i+1] == x for x in [0x35, 0x54, 0x57, 0x31, 0x41, 0x50, 0x38, 0x4D, 0x46, 0x44, 0x36, 0x4F, 0x4B, 0x4A, 0x43, 0x30, 0x51, 0x42, 0x48, 0x49, 0x32, 0x45, 0x39, 0x34]])))\n    solver.add(z3.Implies(flag[i] == 76, z3.Or(*[flag[i+1] == x for x in [0x4A, 0x44, 0x5A, 0x52, 0x36, 0x4F, 0x41, 0x57, 0x33, 0x31, 0x42, 0x39, 0x48, 0x47, 0x32, 0x37, 0x58, 0x59, 0x56, 0x4E, 0x45, 0x55, 0x38, 0x46]])))\n    solver.add(z3.Implies(flag[i] == 77, z3.Or(*[flag[i+1] == x for x in [0x30, 0x45, 0x56, 0x39, 0x59, 0x44, 0x38, 0x51, 0x35, 0x50, 0x5A, 0x4E, 0x42, 0x47, 0x55, 0x31, 0x4D, 0x58, 0x54, 0x33, 0x49, 0x41, 0x43, 0x57]])))\n    solver.add(z3.Implies(flag[i] == 78, z3.Or(*[flag[i+1] == x for x in [0x47, 0x48, 0x56, 0x38, 0x54, 0x59, 0x35, 0x49, 0x41, 0x4A, 0x43, 0x58, 0x4E, 0x55, 0x4F, 0x33, 0x34, 0x31, 0x52, 0x50, 0x4B, 0x32, 0x4C, 0x4D]])))\n    solver.add(z3.Implies(flag[i] == 79, z3.Or(*[flag[i+1] == x for x in [0x42, 0x4F, 0x57, 0x4D, 0x37, 0x38, 0x34, 0x4B, 0x30, 0x55, 0x52, 0x32, 0x4C, 0x4A, 0x31, 0x59, 0x50, 0x45, 0x49, 0x56, 0x41, 0x53, 0x36, 0x39]])))\n    solver.add(z3.Implies(flag[i] == 80, z3.Or(*[flag[i+1] == x for x in [0x46, 0x34, 0x30, 0x37, 0x38, 0x47, 0x4E, 0x42, 0x5A, 0x45, 0x4D, 0x35, 0x43, 0x39, 0x44, 0x48, 0x31, 0x50, 0x55, 0x4C, 0x49, 0x54, 0x41, 0x56]])))\n    solver.add(z3.Implies(flag[i] == 81, z3.Or(*[flag[i+1] == x for x in [0x54, 0x49, 0x58, 0x50, 0x56, 0x38, 0x52, 0x31, 0x35, 0x37, 0x4E, 0x4A, 0x4C, 0x36, 0x45, 0x59, 0x42, 0x44, 0x55, 0x46, 0x4F, 0x57, 0x4D, 0x47]])))\n    solver.add(z3.Implies(flag[i] == 82, z3.Or(*[flag[i+1] == x for x in [0x42, 0x48, 0x53, 0x4F, 0x30, 0x46, 0x56, 0x5A, 0x45, 0x35, 0x34, 0x59, 0x36, 0x39, 0x51, 0x52, 0x31, 0x44, 0x49, 0x33, 0x4D, 0x50, 0x47, 0x55]])))\n    solver.add(z3.Implies(flag[i] == 83, z3.Or(*[flag[i+1] == x for x in [0x51, 0x38, 0x32, 0x4A, 0x58, 0x54, 0x56, 0x30, 0x57, 0x37, 0x34, 0x41, 0x53, 0x59, 0x33, 0x55, 0x52, 0x4F, 0x47, 0x5A, 0x46, 0x42, 0x35, 0x45]])))\n    solver.add(z3.Implies(flag[i] == 84, z3.Or(*[flag[i+1] == x for x in [0x4F, 0x45, 0x37, 0x5A, 0x4B, 0x33, 0x47, 0x55, 0x50, 0x59, 0x54, 0x57, 0x41, 0x46, 0x4A, 0x58, 0x34, 0x49, 0x32, 0x52, 0x51, 0x4C, 0x4E, 0x39]])))\n    solver.add(z3.Implies(flag[i] == 85, z3.Or(*[flag[i+1] == x for x in [0x4E, 0x45, 0x4A, 0x48, 0x43, 0x31, 0x4F, 0x46, 0x53, 0x42, 0x4D, 0x49, 0x44, 0x55, 0x33, 0x50, 0x56, 0x32, 0x37, 0x51, 0x39, 0x36, 0x59, 0x57]])))\n    solver.add(z3.Implies(flag[i] == 86, z3.Or(*[flag[i+1] == x for x in [0x54, 0x4D, 0x42, 0x4A, 0x39, 0x35, 0x5A, 0x49, 0x53, 0x51, 0x30, 0x4C, 0x34, 0x59, 0x57, 0x4B, 0x56, 0x4E, 0x37, 0x55, 0x43, 0x32, 0x46, 0x36]])))\n    solver.add(z3.Implies(flag[i] == 87, z3.Or(*[flag[i+1] == x for x in [0x53, 0x36, 0x5A, 0x48, 0x51, 0x34, 0x43, 0x59, 0x4D, 0x44, 0x33, 0x39, 0x30, 0x45, 0x38, 0x42, 0x41, 0x4F, 0x4B, 0x4E, 0x56, 0x46, 0x37, 0x4A]])))\n    solver.add(z3.Implies(flag[i] == 88, z3.Or(*[flag[i+1] == x for x in [0x58, 0x36, 0x35, 0x39, 0x5A, 0x37, 0x33, 0x4D, 0x43, 0x44, 0x49, 0x4E, 0x4F, 0x4B, 0x34, 0x54, 0x4A, 0x46, 0x31, 0x47, 0x53, 0x57, 0x48, 0x45]])))\n    solver.add(z3.Implies(flag[i] == 89, z3.Or(*[flag[i+1] == x for x in [0x4C, 0x47, 0x34, 0x45, 0x32, 0x36, 0x35, 0x46, 0x58, 0x38, 0x4E, 0x56, 0x5A, 0x49, 0x39, 0x54, 0x53, 0x43, 0x33, 0x4B, 0x50, 0x37, 0x48, 0x44]])))\n    solver.add(z3.Implies(flag[i] == 90, z3.Or(*[flag[i+1] == x for x in [0x34, 0x52, 0x44, 0x32, 0x53, 0x4E, 0x4A, 0x41, 0x38, 0x35, 0x4F, 0x49, 0x36, 0x39, 0x4C, 0x58, 0x43, 0x54, 0x45, 0x50, 0x37, 0x57, 0x4D, 0x31]])))\n    solver.add(z3.Implies(flag[i] == 48, z3.Or(*[flag[i+1] == x for x in [0x4D, 0x54, 0x47, 0x4B, 0x30, 0x51, 0x33, 0x35, 0x5A, 0x57, 0x52, 0x41, 0x45, 0x50, 0x56, 0x46, 0x4A, 0x48, 0x59, 0x32, 0x53, 0x58, 0x4C, 0x44]])))\n    solver.add(z3.Implies(flag[i] == 49, z3.Or(*[flag[i+1] == x for x in [0x44, 0x5A, 0x43, 0x49, 0x54, 0x37, 0x57, 0x4D, 0x4B, 0x4E, 0x32, 0x46, 0x30, 0x52, 0x33, 0x50, 0x59, 0x51, 0x4F, 0x53, 0x45, 0x31, 0x36, 0x39]])))\n    solver.add(z3.Implies(flag[i] == 50, z3.Or(*[flag[i+1] == x for x in [0x55, 0x54, 0x43, 0x4F, 0x36, 0x56, 0x57, 0x58, 0x47, 0x59, 0x30, 0x38, 0x32, 0x4A, 0x41, 0x4D, 0x5A, 0x4B, 0x35, 0x31, 0x33, 0x46, 0x42, 0x45]])))\n    solver.add(z3.Implies(flag[i] == 51, z3.Or(*[flag[i+1] == x for x in [0x30, 0x41, 0x47, 0x45, 0x44, 0x36, 0x49, 0x52, 0x5A, 0x48, 0x4F, 0x56, 0x54, 0x57, 0x31, 0x4E, 0x51, 0x4A, 0x53, 0x4D, 0x50, 0x58, 0x32, 0x46]])))\n    solver.add(z3.Implies(flag[i] == 52, z3.Or(*[flag[i+1] == x for x in [0x4E, 0x48, 0x4A, 0x39, 0x47, 0x32, 0x56, 0x37, 0x4C, 0x4B, 0x59, 0x49, 0x33, 0x44, 0x4D, 0x52, 0x50, 0x43, 0x54, 0x34, 0x58, 0x38, 0x41, 0x35]])))\n    solver.add(z3.Implies(flag[i] == 53, z3.Or(*[flag[i+1] == x for x in [0x35, 0x32, 0x51, 0x33, 0x59, 0x37, 0x4A, 0x5A, 0x50, 0x58, 0x44, 0x4C, 0x46, 0x42, 0x38, 0x39, 0x55, 0x4B, 0x47, 0x45, 0x4F, 0x56, 0x48, 0x30]])))\n    solver.add(z3.Implies(flag[i] == 54, z3.Or(*[flag[i+1] == x for x in [0x37, 0x53, 0x30, 0x42, 0x41, 0x44, 0x50, 0x4A, 0x33, 0x55, 0x46, 0x49, 0x58, 0x34, 0x48, 0x39, 0x54, 0x35, 0x4F, 0x59, 0x45, 0x47, 0x4B, 0x52]])))\n    solver.add(z3.Implies(flag[i] == 55, z3.Or(*[flag[i+1] == x for x in [0x56, 0x52, 0x4C, 0x46, 0x55, 0x48, 0x35, 0x4A, 0x4B, 0x53, 0x4E, 0x42, 0x45, 0x57, 0x36, 0x49, 0x58, 0x43, 0x41, 0x37, 0x54, 0x34, 0x5A, 0x50]])))\n    solver.add(z3.Implies(flag[i] == 56, z3.Or(*[flag[i+1] == x for x in [0x59, 0x5A, 0x53, 0x34, 0x36, 0x57, 0x4B, 0x56, 0x33, 0x4F, 0x55, 0x35, 0x52, 0x38, 0x54, 0x49, 0x48, 0x43, 0x31, 0x44, 0x41, 0x32, 0x4C, 0x30]])))\n    solver.add(z3.Implies(flag[i] == 57, z3.Or(*[flag[i+1] == x for x in [0x47, 0x39, 0x58, 0x5A, 0x49, 0x35, 0x54, 0x45, 0x44, 0x33, 0x4A, 0x43, 0x55, 0x53, 0x31, 0x46, 0x41, 0x4D, 0x37, 0x52, 0x56, 0x42, 0x36, 0x50]])))\n\n\n# Stage4\nsolver.add(flag[15] == 89)\nsolver.add(flag[17] == 77)\nsolver.add(flag[18] == 56)\n\n# TB_100938 = [0x4900000000,0x3500000012,0x5900000000,0x4F0000000B,0x5600000000,0x550000000E,0x4C00000000,0x4900000006,0x3600000000,0x5A00000004,0x3700000000,0x5700000003,0x3100000000,0x4900000011,0x5800000000,0x3300000008,0x3700000000,0x4D0000000C,0x4300000000,0x430000000D,0x4A00000001,0x5400000003,0x5500000001,0x3400000000,0x5000000001,0x420000000B,0x4C00000001,0x4700000002,0x5600000001,0x3600000012,0x4400000001,0x350000000F,0x4D00000001,0x4F00000005,0x4D00000001,0x540000000D,0x3800000001,0x5500000007,0x5800000001,0x5000000011,0x5800000002,0x4400000005,0x5900000002,0x4B00000000,0x4D00000002,0x5600000003,0x5900000002,0x5A0000000D,0x4700000002,0x4F0000000C,0x4500000002,0x5700000013,0x3100000002,0x5800000007,0x4600000002,0x4600000008,0x4500000002,0x5500000001,0x5200000002,0x510000000B,0x4400000003,0x5000000013,0x3900000003,0x5800000001,0x4E00000003,0x510000000B,0x4C00000003,0x5200000009,0x4500000003,0x480000000C,0x5900000003,0x300000000E,0x4A00000003,0x4100000006,0x4700000003,0x3000000000,0x5200000003,0x3800000008,0x5600000003,0x3600000007,0x3900000004,0x4200000000,0x4A00000004,0x4500000010,0x3700000004,0x3200000006,0x4B00000004,0x4D00000011,0x4A00000004,0x590000000F,0x3300000004,0x5400000008,0x3300000004,0x5400000001,0x4C00000004,0x4200000003,0x5200000004,0x480000000D,0x3200000004,0x570000000B,0x4200000005,0x560000000B,0x4A00000005,0x3000000013,0x3100000005,0x5200000012,0x3600000005,0x4D00000006,0x5400000005,0x4400000000,0x4B00000005,0x570000000E,0x4200000005,0x4A0000000F,0x4500000005,0x4400000010,0x5500000005,0x4C00000011,0x4B00000005,0x4B00000004,0x5200000006,0x3200000005,0x4600000006,0x4200000013,0x4F00000006,0x4D0000000D,0x5300000006,0x560000000B,0x3000000006,0x590000000F,0x3200000006,0x4D00000009,0x3300000006,0x360000000A,0x5600000006,0x4200000000,0x5A00000006,0x300000000E,0x4200000006,0x4400000001,0x5800000007,0x3800000012,0x3100000007,0x570000000F,0x3300000007,0x5000000002,0x4F00000007,0x410000000A,0x3400000007,0x4A00000008,0x4600000007,0x5500000011,0x3900000007,0x3400000005,0x5200000007,0x5100000006,0x5500000007,0x4E0000000E,0x4F00000007,0x4800000010,0x4E00000008,0x4B0000000F,0x3300000008,0x5400000012,0x3400000008,0x4F0000000A,0x3800000008,0x3900000011,0x5600000008,0x540000000B,0x4D00000008,0x4700000013,0x4300000008,0x5800000010,0x3400000008,0x370000000C,0x5200000008,0x4600000006,0x4E00000008,0x500000000D,0x5200000009,0x5200000005,0x3300000009,0x4100000007,0x4900000009,0x4700000003,0x5900000009,0x5800000011,0x5400000009,0x410000000B,0x3200000009,0x3300000010,0x4700000009,0x5200000000,0x4200000009,0x3300000006,0x5100000009,0x4C0000000F,0x3400000009,0x560000000D,0x570000000A,0x5100000002,0x300000000A,0x4E00000009,0x4D0000000A,0x3600000006,0x330000000A,0x580000000B,0x490000000A,0x380000000C,0x520000000A,0x460000000F,0x570000000A,0x410000000E,0x450000000A,0x3400000005,0x550000000A,0x4B00000011,0x330000000A,0x4100000003,0x4F0000000B,0x3400000000,0x4D0000000B,0x5300000008,0x4A0000000B,0x5200000011,0x5A0000000B,0x4700000005,0x520000000B,0x410000000C,0x390000000B,0x310000000D,0x320000000B,0x5000000002,0x320000000B,0x480000000E,0x340000000B,0x5400000010,0x420000000B,0x5000000001,0x380000000C,0x5000000001,0x4F0000000C,0x4300000001,0x540000000C,0x310000000B,0x340000000C,0x360000000D,0x370000000C,0x5400000006,0x350000000C,0x4500000007,0x500000000C,0x5300000013,0x4D0000000C,0x4A0000000E,0x500000000C,0x4900000009,0x570000000C,0x4100000010,0x5A0000000D,0x3700000002,0x4E0000000D,0x3800000000,0x560000000D,0x3700000008,0x450000000D,0x3600000007,0x550000000D,0x4300000012,0x560000000D,0x3900000010,0x570000000D,0x4400000005,0x560000000D,0x5000000001,0x370000000D,0x360000000F,0x320000000D,0x510000000A,0x340000000E,0x4E0000000D,0x460000000E,0x3600000009,0x370000000E,0x3200000012,0x4B0000000E,0x480000000B,0x460000000E,0x3600000001,0x570000000E,0x4B00000004,0x410000000E,0x4600000002,0x300000000E,0x5900000006,0x480000000E,0x4200000010,0x4E0000000E,0x540000000F,0x420000000F,0x3500000009,0x590000000F,0x360000000A,0x480000000F,0x300000000D,0x420000000F,0x530000000B,0x4C0000000F,0x5400000011,0x500000000F,0x5700000003,0x4C0000000F,0x3200000001,0x480000000F,0x4F00000008,0x510000000F,0x4300000002,0x4E0000000F,0x3400000010,0x3900000010,0x360000000A,0x4F00000010,0x510000000B,0x4200000010,0x4B00000006,0x3200000010,0x3800000005,0x4900000010,0x4900000013,0x3900000010,0x4D00000011,0x4800000010,0x5400000000,0x4A00000010,0x3200000001,0x5700000010,0x430000000F,0x5100000010,0x4500000004,0x4C00000011,0x440000000F,0x5200000011,0x4F00000004,0x4800000011,0x4300000006,0x3800000011,0x3200000008,0x4D00000011,0x5000000002,0x3800000011,0x3100000000,0x5A00000011,0x5A0000000A,0x4300000011,0x310000000D,0x3300000011,0x3300000012,0x4B00000011,0x3900000005,0x3800000012,0x4B00000005,0x4600000012,0x4F0000000B,0x4D00000012,0x5500000011,0x5300000012,0x4B00000000,0x4600000012,0x3100000003,0x3100000012,0x470000000D,0x3600000012,0x3600000004,0x3100000012,0x5400000006,0x4500000012,0x3700000013,0x4200000012,0x5200000008,0x3200000013,0x5600000008,0x4700000013,0x460000000E,0x5700000013,0x4D00000009,0x4300000013,0x570000000D,0x5600000013,0x4700000004,0x4200000013,0x3700000002,0x4900000013,0x3800000001,0x4700000013,0x3200000005,0x5400000013,0x440000000C,0x4500000013,0x420000000B]\n# TB_100940 = [0x3500000012,0x5900000000,0x4F0000000B,0x5600000000,0x550000000E,0x4C00000000,0x4900000006,0x3600000000,0x5A00000004,0x3700000000,0x5700000003,0x3100000000,0x4900000011,0x5800000000,0x3300000008,0x3700000000,0x4D0000000C,0x4300000000,0x430000000D,0x4A00000001,0x5400000003,0x5500000001,0x3400000000,0x5000000001,0x420000000B,0x4C00000001,0x4700000002,0x5600000001,0x3600000012,0x4400000001,0x350000000F,0x4D00000001,0x4F00000005,0x4D00000001,0x540000000D,0x3800000001,0x5500000007,0x5800000001,0x5000000011,0x5800000002,0x4400000005,0x5900000002,0x4B00000000,0x4D00000002,0x5600000003,0x5900000002,0x5A0000000D,0x4700000002,0x4F0000000C,0x4500000002,0x5700000013,0x3100000002,0x5800000007,0x4600000002,0x4600000008,0x4500000002,0x5500000001,0x5200000002,0x510000000B,0x4400000003,0x5000000013,0x3900000003,0x5800000001,0x4E00000003,0x510000000B,0x4C00000003,0x5200000009,0x4500000003,0x480000000C,0x5900000003,0x300000000E,0x4A00000003,0x4100000006,0x4700000003,0x3000000000,0x5200000003,0x3800000008,0x5600000003,0x3600000007,0x3900000004,0x4200000000,0x4A00000004,0x4500000010,0x3700000004,0x3200000006,0x4B00000004,0x4D00000011,0x4A00000004,0x590000000F,0x3300000004,0x5400000008,0x3300000004,0x5400000001,0x4C00000004,0x4200000003,0x5200000004,0x480000000D,0x3200000004,0x570000000B,0x4200000005,0x560000000B,0x4A00000005,0x3000000013,0x3100000005,0x5200000012,0x3600000005,0x4D00000006,0x5400000005,0x4400000000,0x4B00000005,0x570000000E,0x4200000005,0x4A0000000F,0x4500000005,0x4400000010,0x5500000005,0x4C00000011,0x4B00000005,0x4B00000004,0x5200000006,0x3200000005,0x4600000006,0x4200000013,0x4F00000006,0x4D0000000D,0x5300000006,0x560000000B,0x3000000006,0x590000000F,0x3200000006,0x4D00000009,0x3300000006,0x360000000A,0x5600000006,0x4200000000,0x5A00000006,0x300000000E,0x4200000006,0x4400000001,0x5800000007,0x3800000012,0x3100000007,0x570000000F,0x3300000007,0x5000000002,0x4F00000007,0x410000000A,0x3400000007,0x4A00000008,0x4600000007,0x5500000011,0x3900000007,0x3400000005,0x5200000007,0x5100000006,0x5500000007,0x4E0000000E,0x4F00000007,0x4800000010,0x4E00000008,0x4B0000000F,0x3300000008,0x5400000012,0x3400000008,0x4F0000000A,0x3800000008,0x3900000011,0x5600000008,0x540000000B,0x4D00000008,0x4700000013,0x4300000008,0x5800000010,0x3400000008,0x370000000C,0x5200000008,0x4600000006,0x4E00000008,0x500000000D,0x5200000009,0x5200000005,0x3300000009,0x4100000007,0x4900000009,0x4700000003,0x5900000009,0x5800000011,0x5400000009,0x410000000B,0x3200000009,0x3300000010,0x4700000009,0x5200000000,0x4200000009,0x3300000006,0x5100000009,0x4C0000000F,0x3400000009,0x560000000D,0x570000000A,0x5100000002,0x300000000A,0x4E00000009,0x4D0000000A,0x3600000006,0x330000000A,0x580000000B,0x490000000A,0x380000000C,0x520000000A,0x460000000F,0x570000000A,0x410000000E,0x450000000A,0x3400000005,0x550000000A,0x4B00000011,0x330000000A,0x4100000003,0x4F0000000B,0x3400000000,0x4D0000000B,0x5300000008,0x4A0000000B,0x5200000011,0x5A0000000B,0x4700000005,0x520000000B,0x410000000C,0x390000000B,0x310000000D,0x320000000B,0x5000000002,0x320000000B,0x480000000E,0x340000000B,0x5400000010,0x420000000B,0x5000000001,0x380000000C,0x5000000001,0x4F0000000C,0x4300000001,0x540000000C,0x310000000B,0x340000000C,0x360000000D,0x370000000C,0x5400000006,0x350000000C,0x4500000007,0x500000000C,0x5300000013,0x4D0000000C,0x4A0000000E,0x500000000C,0x4900000009,0x570000000C,0x4100000010,0x5A0000000D,0x3700000002,0x4E0000000D,0x3800000000,0x560000000D,0x3700000008,0x450000000D,0x3600000007,0x550000000D,0x4300000012,0x560000000D,0x3900000010,0x570000000D,0x4400000005,0x560000000D,0x5000000001,0x370000000D,0x360000000F,0x320000000D,0x510000000A,0x340000000E,0x4E0000000D,0x460000000E,0x3600000009,0x370000000E,0x3200000012,0x4B0000000E,0x480000000B,0x460000000E,0x3600000001,0x570000000E,0x4B00000004,0x410000000E,0x4600000002,0x300000000E,0x5900000006,0x480000000E,0x4200000010,0x4E0000000E,0x540000000F,0x420000000F,0x3500000009,0x590000000F,0x360000000A,0x480000000F,0x300000000D,0x420000000F,0x530000000B,0x4C0000000F,0x5400000011,0x500000000F,0x5700000003,0x4C0000000F,0x3200000001,0x480000000F,0x4F00000008,0x510000000F,0x4300000002,0x4E0000000F,0x3400000010,0x3900000010,0x360000000A,0x4F00000010,0x510000000B,0x4200000010,0x4B00000006,0x3200000010,0x3800000005,0x4900000010,0x4900000013,0x3900000010,0x4D00000011,0x4800000010,0x5400000000,0x4A00000010,0x3200000001,0x5700000010,0x430000000F,0x5100000010,0x4500000004,0x4C00000011,0x440000000F,0x5200000011,0x4F00000004,0x4800000011,0x4300000006,0x3800000011,0x3200000008,0x4D00000011,0x5000000002,0x3800000011,0x3100000000,0x5A00000011,0x5A0000000A,0x4300000011,0x310000000D,0x3300000011,0x3300000012,0x4B00000011,0x3900000005,0x3800000012,0x4B00000005,0x4600000012,0x4F0000000B,0x4D00000012,0x5500000011,0x5300000012,0x4B00000000,0x4600000012,0x3100000003,0x3100000012,0x470000000D,0x3600000012,0x3600000004,0x3100000012,0x5400000006,0x4500000012,0x3700000013,0x4200000012,0x5200000008,0x3200000013,0x5600000008,0x4700000013,0x460000000E,0x5700000013,0x4D00000009,0x4300000013,0x570000000D,0x5600000013,0x4700000004,0x4200000013,0x3700000002,0x4900000013,0x3800000001,0x4700000013,0x3200000005,0x5400000013,0x440000000C,0x4500000013,0x420000000B]\n\n# for k in range(20):\n#     for l in range(10):\n#         _10kl = k*10 + l\n#         tmp = TB_100938[_10kl*2] >> 0x20\n#         A = TB_100940[_10kl*2] & 0xFF\n#         B = TB_100940[_10kl*2] >> 0x20\n#         print(f\"solver.add(z3.Implies(flag[{k}] == {tmp}, flag[{A}] == {B}))\")\n\nsolver.add(z3.Implies(flag[0] == 73, flag[18] == 53))\nsolver.add(z3.Implies(flag[0] == 89, flag[11] == 79))\nsolver.add(z3.Implies(flag[0] == 86, flag[14] == 85))\nsolver.add(z3.Implies(flag[0] == 76, flag[6] == 73))\nsolver.add(z3.Implies(flag[0] == 54, flag[4] == 90))\nsolver.add(z3.Implies(flag[0] == 55, flag[3] == 87))\nsolver.add(z3.Implies(flag[0] == 49, flag[17] == 73))\nsolver.add(z3.Implies(flag[0] == 88, flag[8] == 51))\nsolver.add(z3.Implies(flag[0] == 55, flag[12] == 77))\nsolver.add(z3.Implies(flag[0] == 67, flag[13] == 67))\nsolver.add(z3.Implies(flag[1] == 74, flag[3] == 84))\nsolver.add(z3.Implies(flag[1] == 85, flag[0] == 52))\nsolver.add(z3.Implies(flag[1] == 80, flag[11] == 66))\nsolver.add(z3.Implies(flag[1] == 76, flag[2] == 71))\nsolver.add(z3.Implies(flag[1] == 86, flag[18] == 54))\nsolver.add(z3.Implies(flag[1] == 68, flag[15] == 53))\nsolver.add(z3.Implies(flag[1] == 77, flag[5] == 79))\nsolver.add(z3.Implies(flag[1] == 77, flag[13] == 84))\nsolver.add(z3.Implies(flag[1] == 56, flag[7] == 85))\nsolver.add(z3.Implies(flag[1] == 88, flag[17] == 80))\nsolver.add(z3.Implies(flag[2] == 88, flag[5] == 68))\nsolver.add(z3.Implies(flag[2] == 89, flag[0] == 75))\nsolver.add(z3.Implies(flag[2] == 77, flag[3] == 86))\nsolver.add(z3.Implies(flag[2] == 89, flag[13] == 90))\nsolver.add(z3.Implies(flag[2] == 71, flag[12] == 79))\nsolver.add(z3.Implies(flag[2] == 69, flag[19] == 87))\nsolver.add(z3.Implies(flag[2] == 49, flag[7] == 88))\nsolver.add(z3.Implies(flag[2] == 70, flag[8] == 70))\nsolver.add(z3.Implies(flag[2] == 69, flag[1] == 85))\nsolver.add(z3.Implies(flag[2] == 82, flag[11] == 81))\nsolver.add(z3.Implies(flag[3] == 68, flag[19] == 80))\nsolver.add(z3.Implies(flag[3] == 57, flag[1] == 88))\nsolver.add(z3.Implies(flag[3] == 78, flag[11] == 81))\nsolver.add(z3.Implies(flag[3] == 76, flag[9] == 82))\nsolver.add(z3.Implies(flag[3] == 69, flag[12] == 72))\nsolver.add(z3.Implies(flag[3] == 89, flag[14] == 48))\nsolver.add(z3.Implies(flag[3] == 74, flag[6] == 65))\nsolver.add(z3.Implies(flag[3] == 71, flag[0] == 48))\nsolver.add(z3.Implies(flag[3] == 82, flag[8] == 56))\nsolver.add(z3.Implies(flag[3] == 86, flag[7] == 54))\nsolver.add(z3.Implies(flag[4] == 57, flag[0] == 66))\nsolver.add(z3.Implies(flag[4] == 74, flag[16] == 69))\nsolver.add(z3.Implies(flag[4] == 55, flag[6] == 50))\nsolver.add(z3.Implies(flag[4] == 75, flag[17] == 77))\nsolver.add(z3.Implies(flag[4] == 74, flag[15] == 89))\nsolver.add(z3.Implies(flag[4] == 51, flag[8] == 84))\nsolver.add(z3.Implies(flag[4] == 51, flag[1] == 84))\nsolver.add(z3.Implies(flag[4] == 76, flag[3] == 66))\nsolver.add(z3.Implies(flag[4] == 82, flag[13] == 72))\nsolver.add(z3.Implies(flag[4] == 50, flag[11] == 87))\nsolver.add(z3.Implies(flag[5] == 66, flag[11] == 86))\nsolver.add(z3.Implies(flag[5] == 74, flag[19] == 48))\nsolver.add(z3.Implies(flag[5] == 49, flag[18] == 82))\nsolver.add(z3.Implies(flag[5] == 54, flag[6] == 77))\nsolver.add(z3.Implies(flag[5] == 84, flag[0] == 68))\nsolver.add(z3.Implies(flag[5] == 75, flag[14] == 87))\nsolver.add(z3.Implies(flag[5] == 66, flag[15] == 74))\nsolver.add(z3.Implies(flag[5] == 69, flag[16] == 68))\nsolver.add(z3.Implies(flag[5] == 85, flag[17] == 76))\nsolver.add(z3.Implies(flag[5] == 75, flag[4] == 75))\nsolver.add(z3.Implies(flag[6] == 82, flag[5] == 50))\nsolver.add(z3.Implies(flag[6] == 70, flag[19] == 66))\nsolver.add(z3.Implies(flag[6] == 79, flag[13] == 77))\nsolver.add(z3.Implies(flag[6] == 83, flag[11] == 86))\nsolver.add(z3.Implies(flag[6] == 48, flag[15] == 89))\nsolver.add(z3.Implies(flag[6] == 50, flag[9] == 77))\nsolver.add(z3.Implies(flag[6] == 51, flag[10] == 54))\nsolver.add(z3.Implies(flag[6] == 86, flag[0] == 66))\nsolver.add(z3.Implies(flag[6] == 90, flag[14] == 48))\nsolver.add(z3.Implies(flag[6] == 66, flag[1] == 68))\nsolver.add(z3.Implies(flag[7] == 88, flag[18] == 56))\nsolver.add(z3.Implies(flag[7] == 49, flag[15] == 87))\nsolver.add(z3.Implies(flag[7] == 51, flag[2] == 80))\nsolver.add(z3.Implies(flag[7] == 79, flag[10] == 65))\nsolver.add(z3.Implies(flag[7] == 52, flag[8] == 74))\nsolver.add(z3.Implies(flag[7] == 70, flag[17] == 85))\nsolver.add(z3.Implies(flag[7] == 57, flag[5] == 52))\nsolver.add(z3.Implies(flag[7] == 82, flag[6] == 81))\nsolver.add(z3.Implies(flag[7] == 85, flag[14] == 78))\nsolver.add(z3.Implies(flag[7] == 79, flag[16] == 72))\nsolver.add(z3.Implies(flag[8] == 78, flag[15] == 75))\nsolver.add(z3.Implies(flag[8] == 51, flag[18] == 84))\nsolver.add(z3.Implies(flag[8] == 52, flag[10] == 79))\nsolver.add(z3.Implies(flag[8] == 56, flag[17] == 57))\nsolver.add(z3.Implies(flag[8] == 86, flag[11] == 84))\nsolver.add(z3.Implies(flag[8] == 77, flag[19] == 71))\nsolver.add(z3.Implies(flag[8] == 67, flag[16] == 88))\nsolver.add(z3.Implies(flag[8] == 52, flag[12] == 55))\nsolver.add(z3.Implies(flag[8] == 82, flag[6] == 70))\nsolver.add(z3.Implies(flag[8] == 78, flag[13] == 80))\nsolver.add(z3.Implies(flag[9] == 82, flag[5] == 82))\nsolver.add(z3.Implies(flag[9] == 51, flag[7] == 65))\nsolver.add(z3.Implies(flag[9] == 73, flag[3] == 71))\nsolver.add(z3.Implies(flag[9] == 89, flag[17] == 88))\nsolver.add(z3.Implies(flag[9] == 84, flag[11] == 65))\nsolver.add(z3.Implies(flag[9] == 50, flag[16] == 51))\nsolver.add(z3.Implies(flag[9] == 71, flag[0] == 82))\nsolver.add(z3.Implies(flag[9] == 66, flag[6] == 51))\nsolver.add(z3.Implies(flag[9] == 81, flag[15] == 76))\nsolver.add(z3.Implies(flag[9] == 52, flag[13] == 86))\nsolver.add(z3.Implies(flag[10] == 87, flag[2] == 81))\nsolver.add(z3.Implies(flag[10] == 48, flag[9] == 78))\nsolver.add(z3.Implies(flag[10] == 77, flag[6] == 54))\nsolver.add(z3.Implies(flag[10] == 51, flag[11] == 88))\nsolver.add(z3.Implies(flag[10] == 73, flag[12] == 56))\nsolver.add(z3.Implies(flag[10] == 82, flag[15] == 70))\nsolver.add(z3.Implies(flag[10] == 87, flag[14] == 65))\nsolver.add(z3.Implies(flag[10] == 69, flag[5] == 52))\nsolver.add(z3.Implies(flag[10] == 85, flag[17] == 75))\nsolver.add(z3.Implies(flag[10] == 51, flag[3] == 65))\nsolver.add(z3.Implies(flag[11] == 79, flag[0] == 52))\nsolver.add(z3.Implies(flag[11] == 77, flag[8] == 83))\nsolver.add(z3.Implies(flag[11] == 74, flag[17] == 82))\nsolver.add(z3.Implies(flag[11] == 90, flag[5] == 71))\nsolver.add(z3.Implies(flag[11] == 82, flag[12] == 65))\nsolver.add(z3.Implies(flag[11] == 57, flag[13] == 49))\nsolver.add(z3.Implies(flag[11] == 50, flag[2] == 80))\nsolver.add(z3.Implies(flag[11] == 50, flag[14] == 72))\nsolver.add(z3.Implies(flag[11] == 52, flag[16] == 84))\nsolver.add(z3.Implies(flag[11] == 66, flag[1] == 80))\nsolver.add(z3.Implies(flag[12] == 56, flag[1] == 80))\nsolver.add(z3.Implies(flag[12] == 79, flag[1] == 67))\nsolver.add(z3.Implies(flag[12] == 84, flag[11] == 49))\nsolver.add(z3.Implies(flag[12] == 52, flag[13] == 54))\nsolver.add(z3.Implies(flag[12] == 55, flag[6] == 84))\nsolver.add(z3.Implies(flag[12] == 53, flag[7] == 69))\nsolver.add(z3.Implies(flag[12] == 80, flag[19] == 83))\nsolver.add(z3.Implies(flag[12] == 77, flag[14] == 74))\nsolver.add(z3.Implies(flag[12] == 80, flag[9] == 73))\nsolver.add(z3.Implies(flag[12] == 87, flag[16] == 65))\nsolver.add(z3.Implies(flag[13] == 90, flag[2] == 55))\nsolver.add(z3.Implies(flag[13] == 78, flag[0] == 56))\nsolver.add(z3.Implies(flag[13] == 86, flag[8] == 55))\nsolver.add(z3.Implies(flag[13] == 69, flag[7] == 54))\nsolver.add(z3.Implies(flag[13] == 85, flag[18] == 67))\nsolver.add(z3.Implies(flag[13] == 86, flag[16] == 57))\nsolver.add(z3.Implies(flag[13] == 87, flag[5] == 68))\nsolver.add(z3.Implies(flag[13] == 86, flag[1] == 80))\nsolver.add(z3.Implies(flag[13] == 55, flag[15] == 54))\nsolver.add(z3.Implies(flag[13] == 50, flag[10] == 81))\nsolver.add(z3.Implies(flag[14] == 52, flag[13] == 78))\nsolver.add(z3.Implies(flag[14] == 70, flag[9] == 54))\nsolver.add(z3.Implies(flag[14] == 55, flag[18] == 50))\nsolver.add(z3.Implies(flag[14] == 75, flag[11] == 72))\nsolver.add(z3.Implies(flag[14] == 70, flag[1] == 54))\nsolver.add(z3.Implies(flag[14] == 87, flag[4] == 75))\nsolver.add(z3.Implies(flag[14] == 65, flag[2] == 70))\nsolver.add(z3.Implies(flag[14] == 48, flag[6] == 89))\nsolver.add(z3.Implies(flag[14] == 72, flag[16] == 66))\nsolver.add(z3.Implies(flag[14] == 78, flag[15] == 84))\nsolver.add(z3.Implies(flag[15] == 66, flag[9] == 53))\nsolver.add(z3.Implies(flag[15] == 89, flag[10] == 54))\nsolver.add(z3.Implies(flag[15] == 72, flag[13] == 48))\nsolver.add(z3.Implies(flag[15] == 66, flag[11] == 83))\nsolver.add(z3.Implies(flag[15] == 76, flag[17] == 84))\nsolver.add(z3.Implies(flag[15] == 80, flag[3] == 87))\nsolver.add(z3.Implies(flag[15] == 76, flag[1] == 50))\nsolver.add(z3.Implies(flag[15] == 72, flag[8] == 79))\nsolver.add(z3.Implies(flag[15] == 81, flag[2] == 67))\nsolver.add(z3.Implies(flag[15] == 78, flag[16] == 52))\nsolver.add(z3.Implies(flag[16] == 57, flag[10] == 54))\nsolver.add(z3.Implies(flag[16] == 79, flag[11] == 81))\nsolver.add(z3.Implies(flag[16] == 66, flag[6] == 75))\nsolver.add(z3.Implies(flag[16] == 50, flag[5] == 56))\nsolver.add(z3.Implies(flag[16] == 73, flag[19] == 73))\nsolver.add(z3.Implies(flag[16] == 57, flag[17] == 77))\nsolver.add(z3.Implies(flag[16] == 72, flag[0] == 84))\nsolver.add(z3.Implies(flag[16] == 74, flag[1] == 50))\nsolver.add(z3.Implies(flag[16] == 87, flag[15] == 67))\nsolver.add(z3.Implies(flag[16] == 81, flag[4] == 69))\nsolver.add(z3.Implies(flag[17] == 76, flag[15] == 68))\nsolver.add(z3.Implies(flag[17] == 82, flag[4] == 79))\nsolver.add(z3.Implies(flag[17] == 72, flag[6] == 67))\nsolver.add(z3.Implies(flag[17] == 56, flag[8] == 50))\nsolver.add(z3.Implies(flag[17] == 77, flag[2] == 80))\nsolver.add(z3.Implies(flag[17] == 56, flag[0] == 49))\nsolver.add(z3.Implies(flag[17] == 90, flag[10] == 90))\nsolver.add(z3.Implies(flag[17] == 67, flag[13] == 49))\nsolver.add(z3.Implies(flag[17] == 51, flag[18] == 51))\nsolver.add(z3.Implies(flag[17] == 75, flag[5] == 57))\nsolver.add(z3.Implies(flag[18] == 56, flag[5] == 75))\nsolver.add(z3.Implies(flag[18] == 70, flag[11] == 79))\nsolver.add(z3.Implies(flag[18] == 77, flag[17] == 85))\nsolver.add(z3.Implies(flag[18] == 83, flag[0] == 75))\nsolver.add(z3.Implies(flag[18] == 70, flag[3] == 49))\nsolver.add(z3.Implies(flag[18] == 49, flag[13] == 71))\nsolver.add(z3.Implies(flag[18] == 54, flag[4] == 54))\nsolver.add(z3.Implies(flag[18] == 49, flag[6] == 84))\nsolver.add(z3.Implies(flag[18] == 69, flag[19] == 55))\nsolver.add(z3.Implies(flag[18] == 66, flag[8] == 82))\nsolver.add(z3.Implies(flag[19] == 50, flag[8] == 86))\nsolver.add(z3.Implies(flag[19] == 71, flag[14] == 70))\nsolver.add(z3.Implies(flag[19] == 87, flag[9] == 77))\nsolver.add(z3.Implies(flag[19] == 67, flag[13] == 87))\nsolver.add(z3.Implies(flag[19] == 86, flag[4] == 71))\nsolver.add(z3.Implies(flag[19] == 66, flag[2] == 55))\nsolver.add(z3.Implies(flag[19] == 73, flag[1] == 56))\nsolver.add(z3.Implies(flag[19] == 71, flag[5] == 50))\nsolver.add(z3.Implies(flag[19] == 84, flag[12] == 68))\nsolver.add(z3.Implies(flag[19] == 69, flag[11] == 66))\n\nwhile solver.check() == z3.sat:\n    m = solver.model()\n    key = [chr(m[f].as_long()) for f in flag]\n\n    new_key = []\n    for i in range(0, len(key), 5):\n        new_key.extend([*key[i:i+5], '-'])\n\n    print(\"\".join(new_key[:-1]))\n    break
\n

Running this script prints that the correct license key is UPPBK-K0Y7C-6B8VW-Y9M8O, and supplying that to the challenge binary yields the flag.

\n

\n \n