本文最后更新于66 天前，其中的信息可能已经过时，如有错误可以直接在文章下留言
周末打了两天强网杯，最后就出了两道，另外一道mips是队友出的，强网杯题量有点多，Reverse这边总共6道，不过其他对我来说感觉确实有些难度，这一道题应该是最简单的一道，但是出的竟然比mips少，太不合理了，明显的py。
自己在做这题的时候还拿了个三血，虽然最后被日成50分，额外分可以忽略不记了，但是自己还是挺开心的，人生第一次拿血。
题目描述
#迷宫重重，尝试走出你的地图吧！题目重点主要还是在代码审计
int __fastcall main(int argc, const char **argv, const char **envp)
{
char v4; // [rsp+27h] [rbp-9h] BYREF
int v5; // [rsp+28h] [rbp-8h]
unsigned int i; // [rsp+2Ch] [rbp-4h]
sub_4033D0(argc, argv, envp);
puts(Buffer);
for ( i = 0; (int)i <= 8; ++i )
{
sub_401530(i);
while ( 1 )
{
system("cls");
if ( !dword_40D060[i] )
break;
v5 = scanf("%c", &v4);
if ( v4 == 'd' )
{
sub_40235D(i);
}
else if ( v4 > 'd' )
{
if ( v4 == 's' )
{
sub_401F6B(i);
}
else if ( v4 == 'w' )
{
sub_401789(i);
}
}
else if ( v4 == 'a' )
{
sub_401B7A(i);
}
}
puts(asc_40A068);
}
puts(aFlagMd51FlagMd);
return 0;
}主函数的逻辑也确实像一个迷宫题，wasd，每个方向对应一个处理的函数。for循环中的puts是成功通关一个关卡的信息。
aFlagMd51FlagMd循环后即是我们成功通关后的关于flag的信息，如下
//flag是每个关卡中每个箱子移动的最短的次数拼接的md5码值和几个字符，
//1.flag{四个字符_md5值}，2.注意同一张图箱子不一定只有一个哦3.同一关需要计算所有箱子的总的最小移动次数，将每一关的最短次数拼接 解释：例如第一关是3第二关是5，就是md5(35...)中间有个while，想要跳出，必须得满足dword_40D060[i]为0，它得初始值全为0，我们将其重命名为check，看看函数对他有没有什么处理
前面还有个函数sub_401530，我们先重点分析这个函数
int __fastcall sub_401530(int a1)
{
_DWORD *v1; // rax
int j; // [rsp+28h] [rbp-8h]
int i; // [rsp+2Ch] [rbp-4h]
LODWORD(v1) = printf(&Format);
for ( i = 0; i <= 19; ++i )
{
for ( j = 0; j <= 19; ++j )
//a1为for循环的i，故迷宫的每一层就是一个关卡
//此处遍历了整一层迷宫
{
if ( dword_404040[400 * a1 + 20 * i + j] == 2 )
//这个dword_404040就是我们的maze，可以点进去看
//根据这里的索引可以大致推出是一个400*20*20的maze
//寻找每一层中2的坐标
{
dword_40D040 = j;
//dword_40D040为2的纵坐标y
dword_40D044 = i;
//dword_40D040为2的横坐标x
}
LODWORD(v1) = dword_404040[400 * a1 + 20 * i + j];
if ( (_DWORD)v1 == 3 )
{
v1 = check;
//若这层迷宫当中存在3，则check[i]的值加1
++check[a1];
}
}
}
return (int)v1;
}上面的代码注释的很详细，目前我们知道迷宫中有2，3，我们接着再看d的函数sub_40235D
__int64 __fastcall sub_40235D(int a1)
{
__int64 result; // rax
int v2; // [rsp+8h] [rbp-8h]
unsigned int v3; // [rsp+Ch] [rbp-4h]
result = (unsigned int)x;
if ( x != 19 )
{
v3 = x + 1;
//d，往右走一格，故v3应该是行动后的横坐标
v2 = y;
result = maze[400 * a1 + 1 + 20 * y + x];
//result为行动后的坐标处
if ( (_DWORD)result != 5 )
{
result = maze[400 * a1 + 20 * y + v3];
if ( (_DWORD)result != 1 )
//如果行动后的坐标处不为1，则执行后续代码，此处可判定0为路，1为墙。
{
if ( maze[400 * a1 + 20 * y + v3] == 3 )
//如果行动后的坐标处为3
{
result = maze[400 * a1 + 2 + 20 * y + x];
//设置result的值为行动后的坐标再往右走一格的坐标，即dd的坐标，
if ( (_DWORD)result == 1 )
return result;
if ( maze[400 * a1 + 2 + 20 * y + x] == 4 )
//判断行动后的坐标的右边的值是不是4
{
maze[400 * a1 + 2 + 20 * y + x] = 5;
//如果为4，将4的值变为5
maze[400 * a1 + 20 * v2 + v3] = 0;
//将行动后的坐标恢复为0
--check[a1];
//check数组减1，那么我们的要进入这里的代码处并执行。
}
else
{
maze[400 * a1 + 2 + 20 * y + x] = 3;
//如果不为4，将行动后的坐标的右边值设为3，相当于将3往右推了一格
}
}
maze[400 * a1 + 20 * y + x] = 0;
maze[400 * a1 + 20 * v2 + v3] = 2;
result = v3;
x = v3;
//这里是将走过的地方恢复为路的操作，和将行动后的坐标处的值设置为2，可以判断2就是我们。
}
}
}
return result;
}d方向的函数代码已经进行详细注释，在弄清楚代码逻辑之后，再结合aFlagMd51FlagMd字符串的内容，可以很容易判断这实现的是一个推箱子游戏。
并且2是小人，0是路，1是墙，3是箱子，4是终点，当我们把箱子推到终点之后终点就会变成5。
我们直接将迷宫数组第一层提取出来，先验证一下我们的想法，因为我们只看了d方向的函数，不确定其他was方向的函数有没有进行其他处理，如下，起点坐标为x=4，y=5，如果我们的猜想正确，就会有通关的输出，动态调试输入dwwaadddssaaaww，就是第一关推箱子的路径
mazelayerone=[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,4,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,0,3,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,0,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
0,0,0,0,2,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
0,1,1,0,0,1,1,0,0,0,1,0,0,0,1,0,0,0,1,0,#2
0,1,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,1,0,0,0,1,1,1,1,1,0,#dwwaadddssaaaww
0,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,1,0,
0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,
0,0,0,0,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1,0,
0,0,0,0,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,1,1,1,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0]
发现我们的猜想正确，那就可以直接将所有迷宫提取出来手搓，题目要求的是每个箱子移动的最短的次数，所以其实主要看箱子就行，注意以下几点
#有些层不止有一个箱子，并且有几个箱子3，就会有几个终点4，并不是只有一个终点，因为要让check[i]减为0，故所有箱子都要推到终点
#小人2的位置也要关注，因为推箱子游戏的性质可能导致，箱子推到靠墙的位置后无法返回
#maze长度为5600，真正用到的迷宫长度为3600，题目要求的四个字符在多余的全1部分，为qwb!，四个字符全部由0组成，如下图
下面代码为手搓过程
maze=[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,4,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,0,3,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,0,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
0,0,0,0,2,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
0,1,1,0,0,1,1,0,0,0,1,0,0,0,1,0,0,0,1,0, #2
0,1,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,1,0,0,0,1,1,1,1,1,0,#dwwaadddssaaaww
0,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,1,0,
0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,
0,0,0,0,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1,0,
0,0,0,0,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,1,1,1,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,
0,1,2,0,0,3,0,0,0,4,0,0,0,0,0,0,0,0,1,0,#ddddddd 4+8=12
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,
0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,0,
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,
0,1,0,0,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1,0,
0,1,0,0,0,0,1,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,1,1,1,1,1,1,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,1,0,
0,0,1,1,1,1,1,0,0,0,1,0,0,0,1,1,1,1,1,0,
0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,
0,0,1,0,0,0,1,0,1,1,1,0,0,0,1,1,1,1,1,0,
0,0,1,0,0,0,3,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,0,1,1,1,1,0,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,0,4,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,
0,1,1,1,1,1,1,1,1,1,1,0,0,0,1,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,
0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,#dssaaaawwwwww 13
1,0,1,0,3,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,
1,0,1,1,1,0,1,1,1,0,1,1,1,1,1,0,0,0,0,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,1,1,
1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,
1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,1,
1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,1,0,0,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,0,0,0,0,0,1,1,1,1,1,1,1,0,0,0,0,0,1,
1,0,0,0,0,0,0,0,3,0,0,0,0,1,0,0,0,0,0,1,
1,0,0,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,0,1,
1,0,0,0,0,0,0,1,0,0,0,0,2,1,0,0,0,0,0,1,#wwaaaaaaaaaasaww
1,0,0,0,0,0,0,1,1,1,1,1,1,1,0,0,0,0,0,1, #9
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,
1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,1,1,
1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,
1,0,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,1,0,0,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,
1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,
1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,1,0,1,
1,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,
1,0,0,0,0,0,0,1,1,1,1,1,1,1,1,0,1,1,0,1,
1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, #21
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,1,
1,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,0,1,0,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,1,
1,1,1,1,1,0,1,1,1,1,1,1,1,1,1,0,1,1,1,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,4,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,1,
1,0,1,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,1,
1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,0,1,1,0,1,
1,0,1,0,1,0,0,0,0,0,1,0,0,0,0,0,1,0,0,1,#6+7=13
1,0,1,0,1,0,1,1,1,1,1,0,1,1,1,0,1,0,0,1,
1,0,0,0,1,0,1,0,0,0,1,0,1,0,0,0,1,0,0,1,
1,0,1,1,1,0,1,0,1,0,1,0,1,0,1,0,1,1,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,1,
1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,0,0,0,0,0,1,1,1,1,1,1,1,0,1,1,1,0,1,
1,0,0,0,0,0,0,1,0,0,0,0,0,0,3,0,1,0,0,1,
1,1,1,1,1,1,1,1,4,0,0,0,0,0,0,0,1,0,0,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,
1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,1,0,0,0,0,2,1,0,0,0,0,0,0,0,0,1,
1,0,1,0,1,0,1,1,1,1,1,0,1,1,1,1,1,1,0,1,
1,0,1,0,1,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,
1,0,0,0,1,0,1,0,1,1,1,1,1,0,1,1,1,1,0,1,
1,1,1,1,1,0,1,0,1,0,0,0,0,0,1,0,0,0,0,1,
1,0,0,0,0,0,1,0,1,0,1,1,1,1,1,0,1,1,0,1,
1,0,1,1,1,1,1,0,1,0,1,0,0,0,0,0,1,0,0,1,#25
1,0,1,0,0,0,0,0,1,0,1,0,1,1,1,1,1,0,0,1,
1,0,1,0,1,1,1,1,1,0,1,0,1,0,0,0,0,0,0,1,
1,0,0,0,3,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,
1,1,1,1,1,0,1,1,1,1,1,0,1,0,1,0,0,0,0,1,
1,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,1,1,1,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,0,0,0,1,0,0,1,
1,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,4,0,0,0,0,0,0,0,0,0,0,0,2,0,0,3,0,0,1,
1,0,1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,0,1,1,1,1,1,1,1,0,1,1,1,1,1,0,0,1,
1,0,1,0,1,4,0,0,0,0,1,0,0,0,0,0,1,0,0,1,
1,0,1,0,1,0,1,1,1,1,1,0,1,0,1,0,1,0,0,1,
1,0,1,0,1,0,1,0,0,0,1,0,1,0,1,0,1,0,0,1,
1,0,1,0,1,0,1,0,1,1,1,0,1,0,1,0,1,1,0,1,
1,0,0,0,3,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,0,1,
1,0,0,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,#5+15+11=31
1,0,0,0,3,0,0,0,0,0,0,0,0,0,0,4,1,0,0,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,
1,0,1,0,1,1,1,1,1,1,1,0,1,1,1,1,1,1,0,1,
1,0,1,0,1,0,0,0,0,0,1,0,0,0,0,0,1,0,0,1,
1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,
1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,
1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,0,1,1,1,0,1,1,1,0,1,1,1,1,1,1,0,1,
1,0,0,0,1,0,1,3,0,0,1,0,1,0,0,0,1,0,0,1,
1,1,1,1,1,0,0,2,1,1,1,0,1,0,1,0,1,0,0,1,
1,0,0,0,0,0,1,0,1,0,0,0,0,0,1,0,1,0,0,1,
1,0,1,1,1,1,1,4,1,0,1,1,1,1,1,1,1,0,0,1,
1,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,#3
1,0,1,0,1,1,1,1,1,0,1,1,1,1,1,1,1,1,0,1,
1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,
1,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,
1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,0,1,
1,0,1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
]
print(len(maze))
#x=4 y=5
#flag{qwb!_md5(212139211325313)}
#flag{qwb!_fec2d316d20dbacbe0cdff8fb6ff07b9}故flag为flag{qwb!_fec2d316d20dbacbe0cdff8fb6ff07b9}
