开始

看着是 iOT 的题要跑虚拟机，实则 IDA 都能做出来（雾

IDA 直接加载完主程序，检验逻辑直接写在 main() 里面了，但是有一些不明所以的变量

alt text

直接复制粘贴到 VS Code 里面改变量名就舒服多了 －O－

分析

string_to_code 中 字符串和对应数值的映射

直接看伪代码，可以推出 act=0, con=0, abort=1, cancel=1, enable=2, start=2, run=2, stop=3, reset=4, reboot=4

于是我们可以将伪代码中 string_to_code(x) 直接换成对应的数值

v39 缓冲区填充

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
p_argc = &argc;
printf("key:");
if ( fgets(s, 30, &Stdin) )
{
  v3 = strcspn(s, "\n"); // 去掉换行符 用\x00代替
  s[v3] = 0; 
  idx_1 = 0;
  // string_to_code("act"); 无意义
  
  // 将 key 的前 10 个字符 转为 数字 存入 v39[25] ~ v39[34]
  // d0=v39[25], d1=v39[26], ..., d9=v39[34]
  for ( strIdx = 0; s[strIdx] && strIdx <= 9; ++strIdx ) // 只处理前 10 个字符
  {
    if ( s[strIdx] <= 48 || s[strIdx] > 57 ) // 非 '1' ~ '9'
    {
      /*
      a ~ f  转 10 ~ 15
      其他字符转 16
      */
      if ( s[strIdx] == 97 ) // a
      {
        v39[idx_1++ + 25] = 10;
      }
      else if ( s[strIdx] == 98 ) // b
      {
        v39[idx_1++ + 25] = 11;
      }
      else if ( s[strIdx] == 99 ) // c
      {
        v39[idx_1++ + 25] = 12;
      }
      else if ( s[strIdx] == 100 ) // d
      {
        v39[idx_1++ + 25] = 13;
      }
      else if ( s[strIdx] == 101 ) // e
      {
        v39[idx_1++ + 25] = 14;
      }
      else if ( s[strIdx] == 102 ) // f
      {
        v39[idx_1++ + 25] = 15;
      }
      else
      {
        if ( s[strIdx] == 48 ) // '0'
          v39[idx_1 + 25] = 0;
        else // 其他字符兜底为 16
          v39[idx_1 + 25] = 16;
        ++idx_1;
      }
    }
    else // '1' ~ '9'
    {
      v39[idx_1++ + 25] = s[strIdx] - 48; // 转数字
    }
  }

v39 5x5 矩阵 和 v38 + 272 5x3 矩阵 的填充

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
col = 0;
next = 0;
v42 = 0;
v43 = 0;
v44 = 0;
v45 = 0;
v46 = 0;
v47 = 0;
for ( row = 0; row <= 4; ++row )
{
  for ( col = 0; (int)col <= 4; ++col )
  {
    v4 = 0;
    if ( v4 == row && (v5 = 3, v5 == col) ) // (0,3)
    {
      v39[5 * row + col] = v39[next++ + 25]; // d0
      *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 0
    }
    else
    {
      v6 = 1;
      if ( v6 == row && (v7 = 0, v7 == col) ) // (1,0)
      {
        v39[5 * row + col] = v39[next++ + 25]; // d1
        *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 0
      }
      else
      {
        v8 = 1;
        if ( v8 == row && (v9 = 2, v9 == col) ) // (1,2)
        {
          v39[5 * row + col] = v39[next++ + 25]; // d2
          *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 1
          *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 0
        }
        else
        {
          v10 = 2;
          if ( v10 == row && (v11 = 1, v11 == col) ) // (2,1)
          {
            v39[5 * row + col] = v39[next++ + 25]; // d3
            *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 2
            *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 1
          }
          else
          {
            v12 = 2;
            if ( v12 == row && (v13 = 3, v13 == col) ) // (2,3)
            {
              v39[5 * row + col] = v39[next++ + 25]; // d4
              *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 1
              *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 0
            }
            else
            {
              v14 = 3;
              if ( v14 == row && (v15 = 0, v15 == col) ) // (3,0)
              {
                v39[5 * row + col] = v39[next++ + 25]; // d5
                *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 0
              }
              else if ( row == 3 && col == 2 ) // (3,2) 特例 row==3 && col==2（直接写死） 
              {
                v39[5 * row + 2] = v39[next++ + 25]; // d6
                *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 2
                *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 1
              }
              else
              {
                v16 = 3;
                if ( v16 == row && (v17 = 3, v17 == col) ) // (3,3)
                {
                  v39[5 * row + col] = v39[next++ + 25]; // d7
                  *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 1
                  *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 2
                }
                else
                {
                  v18 = 3;
                  if ( v18 == row && (v19 = 4, v19 == col) ) // (3,4)
                  {
                    v39[5 * row + col] = v39[next++ + 25]; // d8
                    *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 2
                  }
                  else
                  {
                    v20 = 4;
                    if ( v20 == row && (v21 = 2, v21 == col) ) // (4,2)
                    {
                      v39[5 * row + col] = v39[next++ + 25]; // d9
                      *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 2
                    }
                    else // 其他位置 全部设为 row + col
                    {
                      v39[5 * row + col] = row + col;
                    }
                  }
                }
              }
            }
          }
        }
      }
    }

    /* 5x5 矩阵 v39
    [ 0, 1, 2, d0, 4 ]
    [ d1, 2, d2, 4, 5 ]
    [ 2, d3, 4, d4, 6 ]
    [ d5, 4, d6, d7, d8 ]
    [ 4, 5, d9, 7, 8 ]
    */

    /* v38 + 272 处存了 15 个数值 (5 行 3 列)
    v42 -> 第一行 d0 d2 d3
    v43 -> 第二行 d1 d3 d6 
    v44 -> 第三行 d2 d4 d8
    v45 -> 第四行 d4 d7 d9
    v46 -> 第五行 d5 d6 d7
    */

第一次 v47 计算

1
2
3
4
5
6
7
8
  v22 = 4;
  if ( v22 == row ) // row==4
    v47 += v39[5 * row + col];
}
if ( stat("/etc/rc.d", &buf) ) // 该目录在 QNX 下是存在的 所以不会给 v47 额外加值
  v47 += *(_DWORD *)&v38[12 * row + 272 + 4 * col]; // row = 0 ~ 4, col=0
  
// v47 最终等于 4 + 5 + 7 + 8 + d9 = 24 + d9

v38 + 272 5x3 矩阵 的数值检查

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
v48 = 1; // 检查成功flag
// 取 v38 + 272 的行和 应该都为 34
for ( row = 0; row <= 4; ++row ) // row 对应 v42 ~ v46
{
  v51 = 0;
  for ( col = 0; (int)col <= 2; ++col ) // 每行 3 个数值
  {
    v51 += *(_DWORD *)&v38[12 * row + 272 + 4 * col];
    v51 -= 5;
  }
  if ( v51 != 19 ) // 每一行的和-15 应该都为 19 -> 每一行的和应该都为 34
    v48 = 0;
}
/*
可得等式
d0 + d2 + d3 = 34
d1 + d3 + d6 = 34
d2 + d4 + d8 = 34
d4 + d7 + d9 = 34
d5 + d6 + d7 = 34
*/

QNX 系统特定检查

1
2
3
4
5
6
7
// https://www.qnx.com/developers/docs/7.0.0/com.qnx.doc.neutrino.prog/topic/process_DCMD_PROC_INFO.html
memset(v38, 0, 0x110u);                 // 在 QNX 这两步成功 所以不会给 v47 额外 +1
v49 = open("/proc/self/as", (int)"r");      
if ( v49 == -1 )
  ++v47;
if ( devctl(v49, 0x41100801, v38, 272, 0) ) // 0x41100801 -> DCMD_PROC_INFO
  ++v47;

d0,d9 定值范围检查

1
2
3
4
5
6
7
8
9
10
v23 = v47;
v24 = v39[0] + v39[3] * v39[2] * v39[1] * v39[4] + (v38[8] & 0x80); // 0 + d0 * 2 * 1 * 4 = 8 * d0 | (v38[8]&0x80) 在 QNX 是 0
v25 = 4 + 1; // 5
// if ( v23 != v24 + v25 * ~4 - 9 ) 
// if ( v47 != v24 + 5 * ~4 - 9 )  // 5 * ~4 - 9 = 5*(-5) - 9 = -34
if ( v47 != v24 - 34 )  // 5 * ~4 - 9 = 5*(-5) - 9 = -34
  v48 = 0;              // v47 应为 8*d0 - 34
                        // 前文已知 v47 = 24 + d9
                        // 24 + d9 = 8*d0 - 34 -> 8*d0 - d9 = 58
                        // 又因为 d0,d9 范围均为 0 ~ 15 | 暴力求解得 (d0,d9)∈{(8,6), (9,14)}

末尾字符串检查

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
// 末 4 位 'a'/'s' 
v50 = 123;
v26 = 2 * 4;
if ( s[v26 + 2] == 97 ) // s[10]: 'a' +45 / 's' -45
  v50 += 45;
v27 = 2 * 4;
if ( s[v27 + 2] == 115 )
  v50 -= 45;
v28 = 2 * 4;
if ( s[v28 + 3] == 97 ) // s[11]: 'a' +67 / 's' -67
  v50 += 67;
v29 = 2 * 4;
if ( s[v29 + 3] == 115 )
  v50 -= 67;
v30 = 2 * 4;
if ( s[v30 + 4] == 97 ) // s[12]: 'a'  +8 / 's'  -8
  v50 += 8;
v31 = 2 * 4;
if ( s[v31 + 4] == 115 )
  v50 -= 8;
v32 = 3 * 4;
if ( s[v32 + 1] == 97 ) // s[13]: 'a'  +9 / 's'  -9
  v50 += 9;
v33 = 3 * 4;
if ( s[v33 + 1] == 115 )
  v50 -= 9;
v34 = 4;
v35 = 1;
if ( 20 * (v34 + v35) != v50 ) // 100 != v50 -> v50 应为 100
                               // 100 = 123 + 45 - 67 + 8 -9 
                               // 即 s[10]='a', s[11]='s', s[12]='a', s[13]='s'
    v48 = 0;

长度和检查成功flag检验

1
2
3
4
if ( v48 == 1 && strlen(s) <= 0xE ) // key 长度 <= 14 -> key 结构为 10 个有效字符 + "asas"
  puts("ok");
else
  puts("no");

求解

用 Python 写出求解器, 符合要求的解一共有 470 个（我勒个多解大王

求解器下载链接

注释完的主程序伪代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
8fbfdf4fa6asas OK
8ebfde5fa6asas OK
8dbfdd6fa6asas OK
8cbfdc7fa6asas OK
8bbfdb8fa6asas OK
8abfda9fa6asas OK
89bfd9afa6asas OK
88bfd8bfa6asas OK
87bfd7cfa6asas OK
86bfd6dfa6asas OK
85bfd5efa6asas OK
84bfd4ffa6asas OK
8ebfef5e96asas OK
8dbfee6e96asas OK
8cbfed7e96asas OK
8bbfec8e96asas OK
8abfeb9e96asas OK
89bfeaae96asas OK
88bfe9be96asas OK
87bfe8ce96asas OK
86bfe7de96asas OK
85bfe6ee96asas OK
84bfe5fe96asas OK
8dbfff6d86asas OK
8cbffe7d86asas OK
8bbffd8d86asas OK
8abffc9d86asas OK
89bffbad86asas OK
88bffabd86asas OK
87bff9cd86asas OK
86bff8dd86asas OK
85bff7ed86asas OK
84bff6fd86asas OK
8fcede5f96asas OK
8ecedd6f96asas OK
8dcedc7f96asas OK
8ccedb8f96asas OK
8bceda9f96asas OK
8aced9af96asas OK
89ced8bf96asas OK
88ced7cf96asas OK
87ced6df96asas OK
86ced5ef96asas OK
85ced4ff96asas OK
8fceef5e86asas OK
8eceee6e86asas OK
8dceed7e86asas OK
8cceec8e86asas OK
8bceeb9e86asas OK
8aceeaae86asas OK
89cee9be86asas OK
88cee8ce86asas OK
87cee7de86asas OK
86cee6ee86asas OK
85cee5fe86asas OK
8eceff6d76asas OK
8dcefe7d76asas OK
8ccefd8d76asas OK
8bcefc9d76asas OK
8acefbad76asas OK
89cefabd76asas OK
88cef9cd76asas OK
87cef8dd76asas OK
86cef7ed76asas OK
85cef6fd76asas OK
8fdddd6f86asas OK
8edddc7f86asas OK
8ddddb8f86asas OK
8cddda9f86asas OK
8bddd9af86asas OK
8addd8bf86asas OK
89ddd7cf86asas OK
88ddd6df86asas OK
87ddd5ef86asas OK
86ddd4ff86asas OK
8fddee6e76asas OK
8edded7e76asas OK
8dddec8e76asas OK
8cddeb9e76asas OK
8bddeaae76asas OK
8adde9be76asas OK
89dde8ce76asas OK
88dde7de76asas OK
87dde6ee76asas OK
86dde5fe76asas OK
8fddff6d66asas OK
8eddfe7d66asas OK
8dddfd8d66asas OK
8cddfc9d66asas OK
8bddfbad66asas OK
8addfabd66asas OK
89ddf9cd66asas OK
88ddf8dd66asas OK
87ddf7ed66asas OK
86ddf6fd66asas OK
8fecdc7f76asas OK
8eecdb8f76asas OK
8decda9f76asas OK
8cecd9af76asas OK
8becd8bf76asas OK
8aecd7cf76asas OK
89ecd6df76asas OK
88ecd5ef76asas OK
87ecd4ff76asas OK
8feced7e66asas OK
8eecec8e66asas OK
8deceb9e66asas OK
8ceceaae66asas OK
8bece9be66asas OK
8aece8ce66asas OK
89ece7de66asas OK
88ece6ee66asas OK
87ece5fe66asas OK
8fecfe7d56asas OK
8eecfd8d56asas OK
8decfc9d56asas OK
8cecfbad56asas OK
8becfabd56asas OK
8aecf9cd56asas OK
89ecf8dd56asas OK
88ecf7ed56asas OK
87ecf6fd56asas OK
8ffbdb8f66asas OK
8efbda9f66asas OK
8dfbd9af66asas OK
8cfbd8bf66asas OK
8bfbd7cf66asas OK
8afbd6df66asas OK
89fbd5ef66asas OK
88fbd4ff66asas OK
8ffbec8e56asas OK
8efbeb9e56asas OK
8dfbeaae56asas OK
8cfbe9be56asas OK
8bfbe8ce56asas OK
8afbe7de56asas OK
89fbe6ee56asas OK
88fbe5fe56asas OK
8ffbfd8d46asas OK
8efbfc9d46asas OK
8dfbfbad46asas OK
8cfbfabd46asas OK
8bfbf9cd46asas OK
8afbf8dd46asas OK
89fbf7ed46asas OK
88fbf6fd46asas OK
9baf9f8bfeasas OK
9aaf9e9bfeasas OK
99af9dabfeasas OK
98af9cbbfeasas OK
97af9bcbfeasas OK
96af9adbfeasas OK
95af99ebfeasas OK
94af98fbfeasas OK
9aafaf9aeeasas OK
99afaeaaeeasas OK
98afadbaeeasas OK
97afaccaeeasas OK
96afabdaeeasas OK
95afaaeaeeasas OK
94afa9faeeasas OK
99afbfa9deasas OK
98afbeb9deasas OK
97afbdc9deasas OK
96afbcd9deasas OK
95afbbe9deasas OK
94afbaf9deasas OK
98afcfb8ceasas OK
97afcec8ceasas OK
96afcdd8ceasas OK
95afcce8ceasas OK
94afcbf8ceasas OK
97afdfc7beasas OK
96afded7beasas OK
95afdde7beasas OK
94afdcf7beasas OK
96afefd6aeasas OK
95afeee6aeasas OK
94afedf6aeasas OK
95afffe59easas OK
94affef59easas OK
9dbe8f7cfeasas OK
9cbe8e8cfeasas OK
9bbe8d9cfeasas OK
9abe8cacfeasas OK
99be8bbcfeasas OK
98be8accfeasas OK
97be89dcfeasas OK
96be88ecfeasas OK
95be87fcfeasas OK
9cbe9f8beeasas OK
9bbe9e9beeasas OK
9abe9dabeeasas OK
99be9cbbeeasas OK
98be9bcbeeasas OK
97be9adbeeasas OK
96be99ebeeasas OK
95be98fbeeasas OK
9bbeaf9adeasas OK
9abeaeaadeasas OK
99beadbadeasas OK
98beaccadeasas OK
97beabdadeasas OK
96beaaeadeasas OK
95bea9fadeasas OK
9abebfa9ceasas OK
99bebeb9ceasas OK
98bebdc9ceasas OK
97bebcd9ceasas OK
96bebbe9ceasas OK
95bebaf9ceasas OK
99becfb8beasas OK
98becec8beasas OK
97becdd8beasas OK
96becce8beasas OK
95becbf8beasas OK
98bedfc7aeasas OK
97beded7aeasas OK
96bedde7aeasas OK
95bedcf7aeasas OK
97beefd69easas OK
96beeee69easas OK
95beedf69easas OK
96beffe58easas OK
95befef58easas OK
9fcd7f6dfeasas OK
9ecd7e7dfeasas OK
9dcd7d8dfeasas OK
9ccd7c9dfeasas OK
9bcd7badfeasas OK
9acd7abdfeasas OK
99cd79cdfeasas OK
98cd78ddfeasas OK
97cd77edfeasas OK
96cd76fdfeasas OK
9ecd8f7ceeasas OK
9dcd8e8ceeasas OK
9ccd8d9ceeasas OK
9bcd8caceeasas OK
9acd8bbceeasas OK
99cd8acceeasas OK
98cd89dceeasas OK
97cd88eceeasas OK
96cd87fceeasas OK
9dcd9f8bdeasas OK
9ccd9e9bdeasas OK
9bcd9dabdeasas OK
9acd9cbbdeasas OK
99cd9bcbdeasas OK
98cd9adbdeasas OK
97cd99ebdeasas OK
96cd98fbdeasas OK
9ccdaf9aceasas OK
9bcdaeaaceasas OK
9acdadbaceasas OK
99cdaccaceasas OK
98cdabdaceasas OK
97cdaaeaceasas OK
96cda9faceasas OK
9bcdbfa9beasas OK
9acdbeb9beasas OK
99cdbdc9beasas OK
98cdbcd9beasas OK
97cdbbe9beasas OK
96cdbaf9beasas OK
9acdcfb8aeasas OK
99cdcec8aeasas OK
98cdcdd8aeasas OK
97cdcce8aeasas OK
96cdcbf8aeasas OK
99cddfc79easas OK
98cdded79easas OK
97cddde79easas OK
96cddcf79easas OK
98cdefd68easas OK
97cdeee68easas OK
96cdedf68easas OK
97cdffe57easas OK
96cdfef57easas OK
9fdc6d7efeasas OK
9edc6c8efeasas OK
9ddc6b9efeasas OK
9cdc6aaefeasas OK
9bdc69befeasas OK
9adc68cefeasas OK
99dc67defeasas OK
98dc66eefeasas OK
97dc65fefeasas OK
9fdc7e7deeasas OK
9edc7d8deeasas OK
9ddc7c9deeasas OK
9cdc7badeeasas OK
9bdc7abdeeasas OK
9adc79cdeeasas OK
99dc78ddeeasas OK
98dc77edeeasas OK
97dc76fdeeasas OK
9fdc8f7cdeasas OK
9edc8e8cdeasas OK
9ddc8d9cdeasas OK
9cdc8cacdeasas OK
9bdc8bbcdeasas OK
9adc8accdeasas OK
99dc89dcdeasas OK
98dc88ecdeasas OK
97dc87fcdeasas OK
9edc9f8bceasas OK
9ddc9e9bceasas OK
9cdc9dabceasas OK
9bdc9cbbceasas OK
9adc9bcbceasas OK
99dc9adbceasas OK
98dc99ebceasas OK
97dc98fbceasas OK
9ddcaf9abeasas OK
9cdcaeaabeasas OK
9bdcadbabeasas OK
9adcaccabeasas OK
99dcabdabeasas OK
98dcaaeabeasas OK
97dca9fabeasas OK
9cdcbfa9aeasas OK
9bdcbeb9aeasas OK
9adcbdc9aeasas OK
99dcbcd9aeasas OK
98dcbbe9aeasas OK
97dcbaf9aeasas OK
9bdccfb89easas OK
9adccec89easas OK
99dccdd89easas OK
98dccce89easas OK
97dccbf89easas OK
9adcdfc78easas OK
99dcded78easas OK
98dcdde78easas OK
97dcdcf78easas OK
99dcefd67easas OK
98dceee67easas OK
97dcedf67easas OK
98dcffe56easas OK
97dcfef56easas OK
9feb5b8ffeasas OK
9eeb5a9ffeasas OK
9deb59affeasas OK
9ceb58bffeasas OK
9beb57cffeasas OK
9aeb56dffeasas OK
99eb55effeasas OK
98eb54fffeasas OK
9feb6c8eeeasas OK
9eeb6b9eeeasas OK
9deb6aaeeeasas OK
9ceb69beeeasas OK
9beb68ceeeasas OK
9aeb67deeeasas OK
99eb66eeeeasas OK
98eb65feeeasas OK
9feb7d8ddeasas OK
9eeb7c9ddeasas OK
9deb7baddeasas OK
9ceb7abddeasas OK
9beb79cddeasas OK
9aeb78dddeasas OK
99eb77eddeasas OK
98eb76fddeasas OK
9feb8e8cceasas OK
9eeb8d9cceasas OK
9deb8cacceasas OK
9ceb8bbcceasas OK
9beb8accceasas OK
9aeb89dcceasas OK
99eb88ecceasas OK
98eb87fcceasas OK
9feb9f8bbeasas OK
9eeb9e9bbeasas OK
9deb9dabbeasas OK
9ceb9cbbbeasas OK
9beb9bcbbeasas OK
9aeb9adbbeasas OK
99eb99ebbeasas OK
98eb98fbbeasas OK
9eebaf9aaeasas OK
9debaeaaaeasas OK
9cebadbaaeasas OK
9bebaccaaeasas OK
9aebabdaaeasas OK
99ebaaeaaeasas OK
98eba9faaeasas OK
9debbfa99easas OK
9cebbeb99easas OK
9bebbdc99easas OK
9aebbcd99easas OK
99ebbbe99easas OK
98ebbaf99easas OK
9cebcfb88easas OK
9bebcec88easas OK
9aebcdd88easas OK
99ebcce88easas OK
98ebcbf88easas OK
9bebdfc77easas OK
9aebded77easas OK
99ebdde77easas OK
98ebdcf77easas OK
9aebefd66easas OK
99ebeee66easas OK
98ebedf66easas OK
99ebffe55easas OK
98ebfef55easas OK
9ffa5a9feeasas OK
9efa59afeeasas OK
9dfa58bfeeasas OK
9cfa57cfeeasas OK
9bfa56dfeeasas OK
9afa55efeeasas OK
99fa54ffeeasas OK
9ffa6b9edeasas OK
9efa6aaedeasas OK
9dfa69bedeasas OK
9cfa68cedeasas OK
9bfa67dedeasas OK
9afa66eedeasas OK
99fa65fedeasas OK
9ffa7c9dceasas OK
9efa7badceasas OK
9dfa7abdceasas OK
9cfa79cdceasas OK
9bfa78ddceasas OK
9afa77edceasas OK
99fa76fdceasas OK
9ffa8d9cbeasas OK
9efa8cacbeasas OK
9dfa8bbcbeasas OK
9cfa8accbeasas OK
9bfa89dcbeasas OK
9afa88ecbeasas OK
99fa87fcbeasas OK
9ffa9e9baeasas OK
9efa9dabaeasas OK
9dfa9cbbaeasas OK
9cfa9bcbaeasas OK
9bfa9adbaeasas OK
9afa99ebaeasas OK
99fa98fbaeasas OK
9ffaaf9a9easas OK
9efaaeaa9easas OK
9dfaadba9easas OK
9cfaacca9easas OK
9bfaabda9easas OK
9afaaaea9easas OK
99faa9fa9easas OK
9efabfa98easas OK
9dfabeb98easas OK
9cfabdc98easas OK
9bfabcd98easas OK
9afabbe98easas OK
99fabaf98easas OK
9dfacfb87easas OK
9cfacec87easas OK
9bfacdd87easas OK
9afacce87easas OK
99facbf87easas OK
9cfadfc76easas OK
9bfaded76easas OK
9afadde76easas OK
99fadcf76easas OK
9bfaefd65easas OK
9afaeee65easas OK
99faedf65easas OK
9afaffe54easas OK
99fafef54easas OK
总共Key数: 470