ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

# exp01.py
abc = "abcdefghijklmnopqrstuvwxyz"
t = str.maketrans(abc + abc.upper(),
                   abc[13:] + abc[:13] + abc.upper()[13:] + abc.upper()[:13])
ct = open("chall.txt", encoding="utf-8").read()
print(ct.translate(t))

# exp02.py
a, b, mod = 29, 17, 95
a_inv = pow(a, -1, mod)

ct = open("chall.txt", encoding="utf-8").read().strip()
pt = ""
for ch in ct:
    x = (ord(ch) - 32 - b) * a_inv % mod
    pt += chr(x + 32)
print(pt)

# exp03.py
import gmpy2, hashlib
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

p, a = int(ns["p"], 16), int(ns["a"], 16)   # 这题数字是十六进制
s = ns["s"]
ct = bytes.fromhex(ns["ct"])

inv = gmpy2.invert(a, p)
key = hashlib.sha256((str(inv) + s).encode()).hexdigest()[:16].encode()
print(unpad(AES.new(key, AES.MODE_ECB).decrypt(ct), 16).decode())

# exp04.py
import re

raw = open("chall.txt").read()
key = re.search(r"key\s*=\s*(\w+)", raw).group(1)
ct = raw.split("ct = ", 1)[1].strip()          # ct 跨了两行，整段读

order = sorted(range(len(key)), key=lambda i: key[i])   # [1, 0, 2]
ncols = len(key)
nrows = -(-len(ct) // ncols)                   # 上取整
padded = ct.ljust(nrows * ncols, "#")

cols, idx = {}, 0
for c in order:
    cols[c] = padded[idx:idx + nrows]
    idx += nrows

pt = ""
for r in range(nrows):
    for c in range(ncols):
        if r < len(cols[c]):
            pt += cols[c][r]
print(pt.rstrip("#"))

# exp05.py
import re, sys
sys.set_int_max_str_digits(100000)     # Python 3.11 默认限 4300 位，先放开
from sympy import factorint

lines = open("chall.txt").read().splitlines()
i = next(k for k, l in enumerate(lines) if l.startswith("N = "))
N = int(re.sub(r"\D", "", "".join(lines[i:])))   # N 跨行，拼起来

fac = factorint(N)
primes = [2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127]
print(bytes(fac[p] for p in primes if p in fac))

# exp06.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

p, a, b = int(ns["p"]), int(ns["a"]), int(ns["b"])
ct = eval(ns["ct"])
ainv = pow(a, -1, p)
print(bytes(((x - b) * ainv) % p for x in ct))

# exp07.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

p, A, b = int(ns["p"]), eval(ns["A"]), eval(ns["b"])

def solve_mod(A, b, p):
    n = len(A)
    M = [row[:] for row in A]
    v = b[:]
    for i in range(n):
        for k in range(i, n):       # 选第 i 列非零行当主元
            if M[k][i] % p:
                M[i], M[k] = M[k], M[i]
                v[i], v[k] = v[k], v[i]
                break
        inv = pow(M[i][i], -1, p)
        M[i] = [(x * inv) % p for x in M[i]]
        v[i] = (v[i] * inv) % p
        for k in range(n):
            if k != i and M[k][i]:
                f = M[k][i]
                M[k] = [(M[k][j] - f * M[i][j]) % p for j in range(n)]
                v[k] = (v[k] - f * v[i]) % p
    return v

print(bytes(solve_mod(A, b, p)))

# exp08.py
import ast, math

pairs = ast.literal_eval(open("chall.txt").read().split("pairs = ")[1].strip())
a, b = pairs
print(bytes(math.gcd(x, y) for x, y in zip(a, b)))

def egcd(a, b):
    if b == 0:
        return a, 1, 0
    g, x, y = egcd(b, a % b)
    return g, y, x - (a // b) * y

# exp09.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

p = int(ns["p"])
ct = eval(ns["ct"])
print(bytes(pow(x, -1, p) for x in ct))

# exp10.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

p = int(ns["p"])
ct = eval(ns["ct"])
print(bytes(pow(c, p - 2, p) for c in ct))

# exp11.py
import math

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e, ct = int(ns["n"]), int(ns["e"]), eval(ns["ct"])

a = math.isqrt(n) + 1
while True:
    b2 = a * a - n
    b = math.isqrt(b2)
    if b * b == b2:
        break
    a += 1
p, q = a - b, a + b

d = pow(e, -1, (p - 1) * (q - 1))
print(bytes(pow(c, d, n) for c in ct))

# exp12.py
import re

raw = open("chall.txt").read()
m1, m2, m3 = [int(x) for x in re.search(r"^m1, m2, m3 = (.+)$", raw, re.M).group(1).split(",")]
a1, a2, a3 = [int(x) for x in re.search(r"^a1, a2, a3 = (.+)$", raw, re.M).group(1).split(",")]

M = m1 * m2 * m3
x = (a1 * (M//m1) * pow(M//m1, -1, m1)
   + a2 * (M//m2) * pow(M//m2, -1, m2)
   + a3 * (M//m3) * pow(M//m3, -1, m3)) % M
print(x.to_bytes((x.bit_length() + 7) // 8, "big"))

# exp13.py
import re

raw = open("chall.txt").read()
p = int(re.search(r"^p = (\d+)$", raw, re.M).group(1))
g = int(re.search(r"^g = (\d+)$", raw, re.M).group(1))
ct = eval(re.search(r"^ct = \[(.*)\]$", raw, re.M).group(0).split(" = ", 1)[1])

table = {pow(g, i, p): i for i in range(256)}
print(bytes(table[y] for y in ct))

# exp14.py
import re

raw = open("chall.txt").read()
p = int(re.search(r"^p = (\d+)$", raw, re.M).group(1))
g = int(re.search(r"^g = (\d+)$", raw, re.M).group(1))
ct = eval(re.search(r"^ct = \[(.*)\]$", raw, re.M).group(0).split(" = ", 1)[1])

m = 16                                        # 本题 t < 256，取 16 够
tbl = {pow(g, j, p): j for j in range(m)}     # baby steps
factor = pow(g, -m, p)                        # giant step 乘子

msg = []
for y in ct:
    cur = y
    for i in range(m):
        if cur in tbl:
            msg.append(i * m + tbl[cur])
            break
        cur = cur * factor % p
print(bytes(msg))

# exp15.py
raw = open("chall.txt").read()
ct = raw.split("ct = ", 1)[1].replace("\n", "").strip()

def zigdec(s):
    n = len(s)
    half = (n + 1) // 2
    r0, r1 = s[:half], s[half:]
    pt = ""
    for i in range(n):
        if i % 2 == 0:
            pt += r0[i // 2] if i // 2 < len(r0) else ""
        else:
            pt += r1[i // 2] if i // 2 < len(r1) else ""
    return pt

for b in range(len(ct)):
    d = zigdec(ct[b:])
    if "flag{" in d:
        print(d)
        break

# exp16.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

ct = bytes.fromhex(ns["ct"])
for k in range(256):
    m = bytes(b ^ k for b in ct)
    if m.startswith(b"flag{"):
        print(hex(k), m.decode())
        break

# exp17.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

K = eval(ns["K"])
ct = ns["ct"]
mod = 95

det = (K[0][0] * K[1][1] - K[0][1] * K[1][0]) % mod
dinv = pow(det, -1, mod)
K_inv = [[ K[1][1] * dinv % mod, -K[0][1] * dinv % mod],
         [-K[1][0] * dinv % mod,  K[0][0] * dinv % mod]]

vals = [ord(c) - 32 for c in ct]
pt = ""
for i in range(0, len(vals), 2):
    v = vals[i:i + 2]
    pt += chr((K_inv[0][0]*v[0] + K_inv[0][1]*v[1]) % mod + 32)
    pt += chr((K_inv[1][0]*v[0] + K_inv[1][1]*v[1]) % mod + 32)
print(pt)

# exp18.py
def rot47(s):
    return "".join(chr(33 + (ord(c) - 33 + 47) % 94)
                   if 33 <= ord(c) <= 126 else c
                   for c in s)

print(rot47(open("chall.txt", encoding="utf-8").read()))

# exp19.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

key, ct = ns["key"], ns["ct"]
msg = ""
for i, c in enumerate(ct):
    shift = ord(key[i % len(key)]) - 32
    msg += chr((ord(c) - 32 - shift) % 95 + 32)
print(msg)

# exp20.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

ct = ns["ct"]
print("".join(chr((ord(c) - 32 - 7) % 95 + 32) for c in ct))

# 偏移未知时通用爆破，人工挑可读的：
# for k in range(1, 95):
#     print(k, "".join(chr((ord(c)-32-k) % 95 + 32) for c in ct))

# exp21.py
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

key = bytes.fromhex(ns["key"])
ct = bytes.fromhex(ns["ct"])
print(unpad(AES.new(key, AES.MODE_ECB).decrypt(ct), 16).decode())

# exp22.py
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

key, iv, ct = bytes.fromhex(ns["key"]), bytes.fromhex(ns["iv"]), bytes.fromhex(ns["ct"])

ecb = AES.new(key, AES.MODE_ECB)
prev, pt = iv, b""
for i in range(0, len(ct), 16):
    blk = ecb.decrypt(ct[i:i+16])                       # 先解
    pt += bytes(a ^ b for a, b in zip(blk, prev))       # 后异或
    prev = ct[i:i+16]
print(unpad(pt, 16).decode())

# exp23.py
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

key, iv, ct = bytes.fromhex(ns["key"]), bytes.fromhex(ns["iv"]), bytes.fromhex(ns["ct"])
print(unpad(AES.new(key, AES.MODE_CBC, iv).decrypt(ct), 16).decode())

# exp24.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

known = bytes.fromhex(ns["known"])
ct_known = bytes.fromhex(ns["ct_known"])
ct_flag = bytes.fromhex(ns["ct_flag"])

ks = bytes(a ^ b for a, b in zip(known, ct_known))
print(bytes(a ^ b for a, b in zip(ct_flag, ks)).decode())

# exp25.py
from Crypto.Cipher import AES

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

key, iv, ct = bytes.fromhex(ns["key"]), bytes.fromhex(ns["iv"]), bytes.fromhex(ns["ct"])

ecb = AES.new(key, AES.MODE_ECB)
ks, pt = iv, b""
for i in range(0, len(ct), 16):
    ks = ecb.encrypt(ks)
    pt += bytes(a ^ b for a, b in zip(ct[i:i+16], ks))
print(pt.decode())

# exp26.py
from Crypto.Cipher import AES

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

key = bytes.fromhex(ns["key_hex"])
ct = bytes.fromhex(ns["ct_hex"])
print(AES.new(key, AES.MODE_ECB).decrypt(ct))

# exp27.py
from Crypto.Cipher import DES

def dk(b):
    return bytes([b]) * 8

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

pt = bytes.fromhex(ns["known_plaintext_hex"])
ct = bytes.fromhex(ns["known_ciphertext_hex"])
ct_flag = bytes.fromhex(ns["ct_flag_hex"])

table = {}
for b in range(256):
    table[DES.new(dk(b), DES.MODE_ECB).encrypt(pt)] = b

for b in range(256):
    mid = DES.new(dk(b), DES.MODE_ECB).decrypt(ct)
    if mid in table:
        k1, k2 = table[mid], b
        break

flag = DES.new(dk(k1), DES.MODE_ECB).decrypt(
       DES.new(dk(k2), DES.MODE_ECB).decrypt(ct_flag))
print(flag)

# exp28.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

pt_known = bytes.fromhex(ns["known_plaintext_hex"])
ct_known = bytes.fromhex(ns["ct_known_hex"])
ct_flag = bytes.fromhex(ns["ct_flag_hex"])

ks = bytes(a ^ b for a, b in zip(ct_known, pt_known))
print(bytes(a ^ b for a, b in zip(ct_flag, ks)).decode())

# exp29.py
ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

known = ns["known_plaintext"].encode()
ct_known = bytes.fromhex(ns["ct_known_hex"])
ct_flag = bytes.fromhex(ns["ct_flag_hex"])

ks = bytes(a ^ b for a, b in zip(ct_known, known))
print(bytes(a ^ b for a, b in zip(ct_flag, ks)).decode())

# exp30.py
import re

raw = open("chall.txt").read()
seq = [int(b) for b in re.search(r"= ([01]+)", raw).group(1)]
ct = bytes.fromhex(re.search(r"ct_flag_hex = ([0-9a-f]+)", raw).group(1))

def berlekamp_massey(s):
    C, B = [1], [1]
    L, m, b = 0, 1, 1
    for N in range(len(s)):
        d = s[N]
        for i in range(1, L + 1):
            d ^= C[i] & s[N - i]
        if d == 0:
            m += 1
        else:
            T = C[:]
            coef = d * pow(b, -1, 2) % 2
            if len(C) < len(B) + m:
                C += [0] * (len(B) + m - len(C))
            for j in range(len(B)):
                C[j + m] ^= coef & B[j]
            if 2 * L <= N:
                L, B, b, m = N + 1 - L, T, d, 1
            else:
                m += 1
    return L, C

L, C = berlekamp_massey(seq)
print("递推长度 L =", L)

bits = seq[:]
while len(bits) < len(seq) + len(ct) * 8:
    nxt = 0
    for i in range(1, L + 1):
        nxt ^= C[i] & bits[-i]
    bits.append(nxt)

ksbits = bits[len(seq):len(seq) + len(ct) * 8]
ks = bytes(int("".join(map(str, ksbits[i*8:(i+1)*8])), 2) for i in range(len(ct)))
print(bytes(a ^ b for a, b in zip(ct, ks)))

# exp31.py
import re

raw = open("chall.txt").read()
m = int(re.search(r"modulus_m = (\d+)", raw).group(1))
X = [int(x) for x in re.search(r"outputs = (.+)", raw).group(1).split(",")]
M = [int(x) for x in re.search(r"more_outputs = (.+)", raw).group(1).split(",")]
ct = bytes.fromhex(re.search(r"ct_flag_hex = ([0-9a-f]+)", raw).group(1))

a = (X[2] - X[1]) * pow(X[1] - X[0], -1, m) % m
c = (X[1] - a * X[0]) % m

state = M[-1]
ks = b""
for _ in range(len(ct)):
    state = (a * state + c) % m
    ks += bytes([state & 0xff])

print(bytes(x ^ k for x, k in zip(ct, ks)))

# exp32.py
import re, random, struct

raw = open("chall.txt").read()
rand32 = eval(re.search(r"rand32 = (\[.*?\])", raw, re.S).group(1))
next_output = float(re.search(r"next_output = ([\d.]+)", raw).group(1))
ct = bytes.fromhex(re.search(r"ct_flag_hex = ([0-9a-f]+)", raw).group(1))

def unshift_right(y, shift):
    x = y
    for _ in range(32 // shift + 1):
        x = y ^ (x >> shift)
    return x

def unshift_left(y, shift, mask):
    x = y
    for _ in range(32 // shift + 1):
        x = y ^ ((x << shift) & mask)
    return x & 0xffffffff

def untemper(y):
    y = unshift_right(y, 18)
    y = unshift_left(y, 15, 0xefc60000)
    y = unshift_left(y, 7, 0x9d2c5680)
    y = unshift_right(y, 11)
    return y

mt = [untemper(x) for x in rand32[:624]]
r = random.Random()
r.setstate((3, tuple(mt + [624]), None))

assert r.random() == next_output          # next_output 是 float，用 random() 消耗对齐
ks = b"".join(struct.pack(">d", r.random()) for _ in range((len(ct) + 7) // 8))[:len(ct)]
print(bytes(x ^ k for x, k in zip(ct, ks)))

# exp33.py
import re, random

raw = open("chall.txt").read()
prev = eval(re.search(r"prev_randbits32 = (\[.*?\])", raw, re.S).group(1))
ct = bytes.fromhex(re.search(r"ct_flag_hex = ([0-9a-f]+)", raw).group(1))

def unshift_right(y, shift):
    x = y
    for _ in range(32 // shift + 1):
        x = y ^ (x >> shift)
    return x

def unshift_left(y, shift, mask):
    x = y
    for _ in range(32 // shift + 1):
        x = y ^ ((x << shift) & mask)
    return x & 0xffffffff

def untemper(y):
    y = unshift_right(y, 18)
    y = unshift_left(y, 15, 0xefc60000)
    y = unshift_left(y, 7, 0x9d2c5680)
    y = unshift_right(y, 11)
    return y

mt = [untemper(x) for x in prev[:624]]
r = random.Random()
r.setstate((3, tuple(mt + [624]), None))

ks = b"".join(r.getrandbits(32).to_bytes(4, "big") for _ in range((len(ct) + 3) // 4))[:len(ct)]
print(bytes(x ^ k for x, k in zip(ct, ks)))

from Crypto.Util.number import long_to_bytes, inverse

# exp34.py
import sympy
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e = int(ns["n"]), int(ns["e"])
ct = [int(x) for x in ns["ct_bytes"].split(",")]

p, q = sympy.factorint(n).keys()
d = inverse(e, (p - 1) * (q - 1))
print(b"".join(long_to_bytes(pow(c, d, n)) for c in ct))

# exp35.py
import math
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e, c = int(ns["n"]), int(ns["e"]), int(ns["c"])

a = math.isqrt(n)
if a * a < n:
    a += 1
while True:
    b2 = a * a - n
    b = math.isqrt(b2)
    if b * b == b2:
        break
    a += 1
p, q = a - b, a + b

d = inverse(e, (p - 1) * (q - 1))
print(long_to_bytes(pow(c, d, n)))

# exp36.py
from math import gcd
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e = int(ns["n"]), int(ns["e"])
ct = [int(x) for x in ns["ct_bytes"].split(",")]

def pollard_pm1(n, B=100000):
    a = 2
    for i in range(2, B + 1):
        a = pow(a, i, n)
        if i % 1000 == 0:
            g = gcd(a - 1, n)
            if 1 < g < n:
                return g
    return None

p = pollard_pm1(n)
q = n // p
d = inverse(e, (p - 1) * (q - 1))
print(b"".join(long_to_bytes(pow(c, d, n)) for c in ct))

# exp37.py
from math import gcd
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e = int(ns["n"]), int(ns["e"])
ct = [int(x) for x in ns["ct_bytes"].split(",")]

def pollard_rho(n):
    if n % 2 == 0:
        return 2
    x = y = 2
    c = 1
    d = 1
    while d == 1:
        x = (x * x + c) % n
        y = (y * y + c) % n
        y = (y * y + c) % n
        d = gcd(abs(x - y), n)
        if d == n:
            x = y = 2
            c += 1
            d = 1
    return d

p = pollard_rho(n)
q = n // p
d = inverse(e, (p - 1) * (q - 1))
print(b"".join(long_to_bytes(pow(c, d, n)) for c in ct))

# exp38.py
import sympy
from Crypto.Util.number import long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e1, e2 = int(ns["n"]), int(ns["e1"]), int(ns["e2"])
c1, c2 = int(ns["c1"]), int(ns["c2"])

s, t, g = sympy.gcdex(int(e1), int(e2))
s, t = int(s), int(t)

m = pow(c1, s, n) if s >= 0 else pow(pow(c1, -1, n), -s, n)
m = m * (pow(c2, t, n) if t >= 0 else pow(pow(c2, -1, n), -t, n)) % n

print(long_to_bytes(m))

# exp39.py
import sympy
from Crypto.Util.number import long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n1, n2, n3 = int(ns["n1"]), int(ns["n2"]), int(ns["n3"])
c1, c2, c3 = int(ns["c1"]), int(ns["c2"]), int(ns["c3"])

def crt(rs, ms):
    M = 1
    for m in ms:
        M *= m
    x = 0
    for r, m in zip(rs, ms):
        x += r * (M // m) * pow(M // m, -1, m)
    return x % M

x = crt([c1, c2, c3], [n1, n2, n3])
m = sympy.integer_nthroot(x, 3)[0]
print(long_to_bytes(m))

# exp40.py
import sympy
from Crypto.Util.number import inverse

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e = int(ns["n"]), int(ns["e"])
chunks = eval(ns["ct_chunks"])

p, q = sympy.factorint(n).keys()
d = inverse(e, (p - 1) * (q - 1))
flag = b"".join(pow(c, d, n).to_bytes(15, "big").lstrip(b"\x00") for c in chunks)
print(flag)

from Crypto.Util.number import inverse, long_to_bytes
from math import gcd

# exp43.py
import math
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e, c = int(ns["n"]), int(ns["e"]), int(ns["c"])

s = math.isqrt(4 + 12 * n)
assert s * s == 4 + 12 * n
p = (-2 + s) // 6
q = n // p

d = inverse(e, (p - 1) * (q - 1))
print(long_to_bytes(pow(c, d, n)))

# exp44.py
import math
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e, c = int(ns["n"]), int(ns["e"]), int(ns["c"])

cf = []
a, b = e, n
while b:
    cf.append(a // b)
    a, b = b, a % b

p0, q0 = 1, 0
p1, q1 = cf[0], 1
for a in cf[1:]:
    p0, q0, p1, q1 = p1, q1, a * p1 + p0, a * q1 + q0
    k, d = p1, q1
    if k == 0:
        continue
    if (e * d - 1) % k:
        continue
    phi = (e * d - 1) // k
    s = n - phi + 1
    t = math.isqrt(s * s - 4 * n)
    if t * t == s * s - 4 * n:
        p = (s + t) // 2
        q = (s - t) // 2
        if p * q == n:
            print(long_to_bytes(pow(c, d, n)))
            break

# exp45.py
import sympy
from Crypto.Util.number import long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e, c = int(ns["n"]), int(ns["e"]), int(ns["c"])

m = sympy.integer_nthroot(c, e)[0]
print(long_to_bytes(m))

# exp46.py
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e, c = int(ns["n"]), int(ns["e"]), int(ns["c"])
p_high_hex = ns["p_high_hex"]

lead = int(p_high_hex, 16)
for lo in range(65536):
    cand = (lead << 16) + lo
    if n % cand == 0:
        p = cand
        break

q = n // p
d = inverse(e, (p - 1) * (q - 1))
print(long_to_bytes(pow(c, d, n)))

# exp47.py
from math import gcd
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k.strip()] = v.strip()      # 有些行 = 前有多个空格，再 strip

n, e, c = int(ns["n"]), int(ns["e"]), int(ns["c"])
s_ok = int(ns["s_correct"])
s_bad = int(ns["s_faulty"])

p = gcd(s_ok - s_bad, n)
q = n // p

d = inverse(e, (p - 1) * (q - 1))
print(long_to_bytes(pow(c, d, n)))

# exp48.py
from math import gcd
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n1, n2, e = int(ns["n1"]), int(ns["n2"]), int(ns["e"])
c = int(ns["c"])

p = gcd(n1, n2)
q = n1 // p

d = inverse(e, (p - 1) * (q - 1))
print(long_to_bytes(pow(c, d, n1)))

# exp49.py
from Crypto.Util.number import inverse, long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v

n, e, c = int(ns["n"]), int(ns["e"]), int(ns["c"])
base = int(ns["base"])
window = int(ns["window"])

for x in range(window):
    if n % (base + x) == 0:
        p = base + x
        break

q = n // p
d = inverse(e, (p - 1) * (q - 1))
print(long_to_bytes(pow(c, d, n)))

def ecc_add(p, a, P, Q):
    if P is None:
        return Q
    if Q is None:
        return P
    x1, y1 = P
    x2, y2 = Q
    if x1 == x2 and (y1 + y2) % p == 0:
        return None
    if P == Q:
        lam = (3 * x1 * x1 + a) * pow(2 * y1, -1, p) % p
    else:
        lam = (y2 - y1) * pow((x2 - x1) % p, -1, p) % p
    x3 = (lam * lam - x1 - x2) % p
    y3 = (lam * (x1 - x3) - y1) % p
    return (x3, y3)

def ecc_mul(p, a, k, P):
    R = None
    while k:
        if k & 1:
            R = ecc_add(p, a, R, P)
        P = ecc_add(p, a, P, P)
        k >>= 1
    return R

def bsgs(p, a, G, Q, r):
    m = math.isqrt(r) + 1
    table = {}
    cur = None
    for j in range(m):
        table[cur] = j
        cur = ecc_add(p, a, cur, G)
    mG = ecc_mul(p, a, m, G)
    neg = None if mG is None else (mG[0], (-mG[1]) % p)
    cur = Q
    for i in range(m):
        if cur in table:
            return (i * m + table[cur]) % r
        cur = ecc_add(p, a, cur, neg)
    return None

# exp50.py
import math
from Crypto.Util.number import long_to_bytes

ns = {}
for line in open("chall.txt"):
    if " = " in line:
        k, v = line.strip().split(" = ", 1)
        ns[k] = v
p = int(ns["p"]); a = int(ns["a"])
P = eval(ns["P"]); Q = eval(ns["Q"])
N = int(ns["group_order"])
facts = eval(ns["order_factorization"])

# --- ecc_add / ecc_mul / bsgs 粘贴上方 ---

def crt(rs, ms):
    M = 1
    for m in ms:
        M *= m
    x = 0
    for r, m in zip(rs, ms):
        x += r * (M // m) * pow(M // m, -1, m)
    return x % M

res, mods = [], []
for q, e in facts.items():
    mod = q ** e
    G = ecc_mul(p, a, N // mod, P)
    H = ecc_mul(p, a, N // mod, Q)
    x = bsgs(p, a, G, H, mod)
    res.append(x)
    mods.append(mod)

d = crt(res, mods)
print("d =", d)