记一次有意思的种树比赛

0990

记一次有意思的种树比赛

在招聘群里有位老哥发了个网址http://geek.qq.com/tree/，发现挺好玩，别说这玩意还真让人极其上头哈哈，这次种树实际上就是类似于一个闯关游戏，种树种到一定数量就会出现新的玩法，当然我也是个小菜鸡，弄了100w就种不下去了，在我玩的这几关就需要解密混淆的js等等一些操作，还是挺好玩的，注意这边是成功种一棵树后才能继续种下一棵树，因此开多线程并行刷接口没有意义。

第一关

第一关是1-1w棵树，第一关还是很简单的，就是一个简单的发起请求，数组中就只有一个值，把这个值取出来再请求携带回去就好，实际上这个闯关游戏的处理都是在这边中间的处理过程。

/**
pull示例
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
返回示例
{"c":"A274075A","a":[73513],"t":"000010510000000086A11C1156D6202A"}
push示例
http://159.75.70.9:8081/push?t=000010510000000086A11C1156D6202A&a=73513
返回示例
{"success":1,"score":1}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A274075A","a":[73513],"t":"000010510000000086A11C1156D6202A"}







push示例




http://159.75.70.9:8081/push?t=000010510000000086A11C1156D6202A&a=73513
返回示例




{"success":1,"score":1}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A274075A","a":[73513],"t":"000010510000000086A11C1156D6202A"}







push示例




http://159.75.70.9:8081/push?t=000010510000000086A11C1156D6202A&a=73513
返回示例




{"success":1,"score":1}

实际上闯关的时候处理的只需要关注这个a即可，这个值就是从上边push的数组中取得的，所以直接pop即可。

var f = function(obj){
    return new Promise(resolve => {
        resolve(obj.a.pop());
    })
}
while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}
// 注：变量cgi已在全局定义
var f = function(obj){


    return new Promise(resolve => {


        resolve(obj.a.pop());
    })
}







while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}
// 注：变量cgi已在全局定义
var f = function(obj){


    return new Promise(resolve => {


        resolve(obj.a.pop());
    })
}







while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}
// 注：变量cgi已在全局定义

第二关

第二关是1w-10w棵树，实际上当请求第一次之后，会根据返回的push对象中的c属性的值动态插入一个<script>实现一个函数挂在到全局window然后再调用这个函数去计算push该提交的值，当然这边的计算要么是给你一个长延时要么就是一个很耗时的循环操作，让你去自己有优化实现再去加速种树。

/**
pull示例
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
返回示例
{"c":"A3C2EA99","a":[79124],"t":"00001051000100011B214AC36A8E9369"}
push示例
http://159.75.70.9:8081/push?t=00001051000100011B214AC36A8E9369&a=6260686500
返回示例
{"success":1,"score":10002}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A3C2EA99","a":[79124],"t":"00001051000100011B214AC36A8E9369"}







push示例




http://159.75.70.9:8081/push?t=00001051000100011B214AC36A8E9369&a=6260686500
返回示例




{"success":1,"score":10002}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A3C2EA99","a":[79124],"t":"00001051000100011B214AC36A8E9369"}







push示例




http://159.75.70.9:8081/push?t=00001051000100011B214AC36A8E9369&a=6260686500
返回示例




{"success":1,"score":10002}

此时动态加载的js是这个样子的。

// http://159.75.70.9:8080/A3C2EA99.js
window.A3C2EA99=async function({a}){return new Promise(_=>setTimeout(__=>_(a[0]*a[0]+a[0]),2000))}
// http://159.75.70.9:8080/A3C2EA99.js
window.A3C2EA99=async function({a}){return new Promise(_=>setTimeout(__=>_(a[0]*a[0]+a[0]),2000))}
// http://159.75.70.9:8080/A3C2EA99.js
window.A3C2EA99=async function({a}){return new Promise(_=>setTimeout(__=>_(a[0]*a[0]+a[0]),2000))}

实际上看起来就是计算了a[0]*a[0]+a[0]，但是如果直接调用这个方法会有大约2s的延迟，所以我们需要自己优化。

var f = function(obj){
    return new Promise(resolve => {
        const a = obj.a.pop();
        resolve(a*a+a);
    })
}
while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}
// 注：变量cgi已在全局定义
var f = function(obj){


    return new Promise(resolve => {


        const a = obj.a.pop();
        resolve(a*a+a);
    })
}

while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}

// 注：变量cgi已在全局定义
var f = function(obj){


    return new Promise(resolve => {


        const a = obj.a.pop();
        resolve(a*a+a);
    })
}

while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}

// 注：变量cgi已在全局定义

第三关

第三关是10w-25w棵树，此时的js就开始向着加密混淆发展了。

/**
pull示例
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
返回示例
{"c":"A5473788","a":[359,626,105471],"t":"0000105100100000072FD4E99C75A6C6"}
push示例
http://159.75.70.9:8081/push?t=0000105100100000072FD4E99C75A6C6&a=17923
返回示例
{"success":1,"score":100001}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A5473788","a":[359,626,105471],"t":"0000105100100000072FD4E99C75A6C6"}







push示例




http://159.75.70.9:8081/push?t=0000105100100000072FD4E99C75A6C6&a=17923
返回示例




{"success":1,"score":100001}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A5473788","a":[359,626,105471],"t":"0000105100100000072FD4E99C75A6C6"}







push示例




http://159.75.70.9:8081/push?t=0000105100100000072FD4E99C75A6C6&a=17923
返回示例




{"success":1,"score":100001}

此时动态加载的js是这个样子的。

eval(atob("dmFyIF8weGU5MzY9WydBNTQ3Mzc4OCddOyhmdW5jdGlvbihfMHg0OGU4NWMsXzB4ZTkzNmQ4KXt2YXIgXzB4MjNmYzVhPWZ1bmN0aW9uKF8weDI4NThkOSl7d2hpbGUoLS1fMHgyODU4ZDkpe18weDQ4ZTg1Y1sncHVzaCddKF8weDQ4ZTg1Y1snc2hpZnQnXSgpKTt9fTtfMHgyM2ZjNWEoKytfMHhlOTM2ZDgpO30oXzB4ZTkzNiwweDE5NikpO3ZhciBfMHgyM2ZjPWZ1bmN0aW9uKF8weDQ4ZTg1YyxfMHhlOTM2ZDgpe18weDQ4ZTg1Yz1fMHg0OGU4NWMtMHgwO3ZhciBfMHgyM2ZjNWE9XzB4ZTkzNltfMHg0OGU4NWNdO3JldHVybiBfMHgyM2ZjNWE7fTt3aW5kb3dbXzB4MjNmYygnMHgwJyldPWZ1bmN0aW9uKF8weDMzNTQzNyl7dmFyIF8weDFhYWMwMj0weDMwZDNmO2Zvcih2YXIgXzB4M2JlZDZhPTB4MzBkM2Y7XzB4M2JlZDZhPjB4MDtfMHgzYmVkNmEtLSl7dmFyIF8weDM3NTM0MD0weDA7Zm9yKHZhciBfMHgxZGRiNzc9MHgwO18weDFkZGI3NzxfMHgzYmVkNmE7XzB4MWRkYjc3Kyspe18weDM3NTM0MCs9XzB4MzM1NDM3WydhJ11bMHgwXTt9XzB4Mzc1MzQwJV8weDMzNTQzN1snYSddWzB4Ml09PV8weDMzNTQzN1snYSddWzB4MV0mJl8weDNiZWQ2YTxfMHgxYWFjMDImJihfMHgxYWFjMDI9XzB4M2JlZDZhKTt9cmV0dXJuIF8weDFhYWMwMjt9Ow=="))
eval(atob("dmFyIF8weGU5MzY9WydBNTQ3Mzc4OCddOyhmdW5jdGlvbihfMHg0OGU4NWMsXzB4ZTkzNmQ4KXt2YXIgXzB4MjNmYzVhPWZ1bmN0aW9uKF8weDI4NThkOSl7d2hpbGUoLS1fMHgyODU4ZDkpe18weDQ4ZTg1Y1sncHVzaCddKF8weDQ4ZTg1Y1snc2hpZnQnXSgpKTt9fTtfMHgyM2ZjNWEoKytfMHhlOTM2ZDgpO30oXzB4ZTkzNiwweDE5NikpO3ZhciBfMHgyM2ZjPWZ1bmN0aW9uKF8weDQ4ZTg1YyxfMHhlOTM2ZDgpe18weDQ4ZTg1Yz1fMHg0OGU4NWMtMHgwO3ZhciBfMHgyM2ZjNWE9XzB4ZTkzNltfMHg0OGU4NWNdO3JldHVybiBfMHgyM2ZjNWE7fTt3aW5kb3dbXzB4MjNmYygnMHgwJyldPWZ1bmN0aW9uKF8weDMzNTQzNyl7dmFyIF8weDFhYWMwMj0weDMwZDNmO2Zvcih2YXIgXzB4M2JlZDZhPTB4MzBkM2Y7XzB4M2JlZDZhPjB4MDtfMHgzYmVkNmEtLSl7dmFyIF8weDM3NTM0MD0weDA7Zm9yKHZhciBfMHgxZGRiNzc9MHgwO18weDFkZGI3NzxfMHgzYmVkNmE7XzB4MWRkYjc3Kyspe18weDM3NTM0MCs9XzB4MzM1NDM3WydhJ11bMHgwXTt9XzB4Mzc1MzQwJV8weDMzNTQzN1snYSddWzB4Ml09PV8weDMzNTQzN1snYSddWzB4MV0mJl8weDNiZWQ2YTxfMHgxYWFjMDImJihfMHgxYWFjMDI9XzB4M2JlZDZhKTt9cmV0dXJuIF8weDFhYWMwMjt9Ow=="))
eval(atob("dmFyIF8weGU5MzY9WydBNTQ3Mzc4OCddOyhmdW5jdGlvbihfMHg0OGU4NWMsXzB4ZTkzNmQ4KXt2YXIgXzB4MjNmYzVhPWZ1bmN0aW9uKF8weDI4NThkOSl7d2hpbGUoLS1fMHgyODU4ZDkpe18weDQ4ZTg1Y1sncHVzaCddKF8weDQ4ZTg1Y1snc2hpZnQnXSgpKTt9fTtfMHgyM2ZjNWEoKytfMHhlOTM2ZDgpO30oXzB4ZTkzNiwweDE5NikpO3ZhciBfMHgyM2ZjPWZ1bmN0aW9uKF8weDQ4ZTg1YyxfMHhlOTM2ZDgpe18weDQ4ZTg1Yz1fMHg0OGU4NWMtMHgwO3ZhciBfMHgyM2ZjNWE9XzB4ZTkzNltfMHg0OGU4NWNdO3JldHVybiBfMHgyM2ZjNWE7fTt3aW5kb3dbXzB4MjNmYygnMHgwJyldPWZ1bmN0aW9uKF8weDMzNTQzNyl7dmFyIF8weDFhYWMwMj0weDMwZDNmO2Zvcih2YXIgXzB4M2JlZDZhPTB4MzBkM2Y7XzB4M2JlZDZhPjB4MDtfMHgzYmVkNmEtLSl7dmFyIF8weDM3NTM0MD0weDA7Zm9yKHZhciBfMHgxZGRiNzc9MHgwO18weDFkZGI3NzxfMHgzYmVkNmE7XzB4MWRkYjc3Kyspe18weDM3NTM0MCs9XzB4MzM1NDM3WydhJ11bMHgwXTt9XzB4Mzc1MzQwJV8weDMzNTQzN1snYSddWzB4Ml09PV8weDMzNTQzN1snYSddWzB4MV0mJl8weDNiZWQ2YTxfMHgxYWFjMDImJihfMHgxYWFjMDI9XzB4M2JlZDZhKTt9cmV0dXJuIF8weDFhYWMwMjt9Ow=="))

当然这只是个base64编码，我们把他解开就可以看到源代码的实现了。

var _0xe936 = ['A5473788']; (function(_0x48e85c, _0xe936d8) {
    var _0x23fc5a = function(_0x2858d9) {
        while (--_0x2858d9) {
            _0x48e85c['push'](_0x48e85c['shift']());
        }
    };
    _0x23fc5a(++_0xe936d8);
} (_0xe936, 0x196));
var _0x23fc = function(_0x48e85c, _0xe936d8) {
    _0x48e85c = _0x48e85c - 0x0;
    var _0x23fc5a = _0xe936[_0x48e85c];
    return _0x23fc5a;
};
window[_0x23fc('0x0')] = function(_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = 0x0;
        for (var _0x1ddb77 = 0x0; _0x1ddb77 < _0x3bed6a; _0x1ddb77++) {
            _0x375340 += _0x335437['a'][0x0];
        }
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }
    return _0x1aac02;
};
var _0xe936 = ['A5473788']; (function(_0x48e85c, _0xe936d8) {
    var _0x23fc5a = function(_0x2858d9) {
        while (--_0x2858d9) {
            _0x48e85c['push'](_0x48e85c['shift']());
        }
    };
    _0x23fc5a(++_0xe936d8);
} (_0xe936, 0x196));
var _0x23fc = function(_0x48e85c, _0xe936d8) {
    _0x48e85c = _0x48e85c - 0x0;
    var _0x23fc5a = _0xe936[_0x48e85c];
    return _0x23fc5a;
};
window[_0x23fc('0x0')] = function(_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = 0x0;
        for (var _0x1ddb77 = 0x0; _0x1ddb77 < _0x3bed6a; _0x1ddb77++) {
            _0x375340 += _0x335437['a'][0x0];
        }
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }

    return _0x1aac02;
};
var _0xe936 = ['A5473788']; (function(_0x48e85c, _0xe936d8) {
    var _0x23fc5a = function(_0x2858d9) {
        while (--_0x2858d9) {
            _0x48e85c['push'](_0x48e85c['shift']());
        }
    };
    _0x23fc5a(++_0xe936d8);
} (_0xe936, 0x196));
var _0x23fc = function(_0x48e85c, _0xe936d8) {
    _0x48e85c = _0x48e85c - 0x0;
    var _0x23fc5a = _0xe936[_0x48e85c];
    return _0x23fc5a;
};
window[_0x23fc('0x0')] = function(_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = 0x0;
        for (var _0x1ddb77 = 0x0; _0x1ddb77 < _0x3bed6a; _0x1ddb77++) {
            _0x375340 += _0x335437['a'][0x0];
        }
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }

    return _0x1aac02;
};

在这个js中有非常耗时的循环操作，看这个0x30d3f = 199999并且内部还有一个for就知道了，但是我们可以精简这个循环与整个代码，让我们种树种的更快。

var f = function(_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = _0x335437['a'][0x0] * _0x3bed6a;
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }
    return _0x1aac02;
};
while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}
// 注：变量cgi已在全局定义
var f = function(_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = _0x335437['a'][0x0] * _0x3bed6a;
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }
    return _0x1aac02;
};


while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}

// 注：变量cgi已在全局定义
var f = function(_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = _0x335437['a'][0x0] * _0x3bed6a;
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }
    return _0x1aac02;
};


while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}

// 注：变量cgi已在全局定义

第四关

第四关是25w-50w棵树，这个js就更加让人难受了，全是[]的混淆。

/**
pull示例
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
返回示例
{"c":"A593C8B8","a":[649,2356,222,1344,506,1797,840],"t":"000008100036230024B0D39DA416E5DD"}
push示例
http://159.75.70.9:8081/push?t=000008100036230024B0D39DA416E5DD&a=151231471
返回示例
{"success":1,"score":250001}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A593C8B8","a":[649,2356,222,1344,506,1797,840],"t":"000008100036230024B0D39DA416E5DD"}







push示例




http://159.75.70.9:8081/push?t=000008100036230024B0D39DA416E5DD&a=151231471
返回示例




{"success":1,"score":250001}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A593C8B8","a":[649,2356,222,1344,506,1797,840],"t":"000008100036230024B0D39DA416E5DD"}







push示例




http://159.75.70.9:8081/push?t=000008100036230024B0D39DA416E5DD&a=151231471
返回示例




{"success":1,"score":250001}

此时动态加载的js是这个样子的。

window.A593C8B8=async(_)=>(($,_,__,___,____)=>{let _____=function*(){while([])yield[(_,__)=>_+__,(_,__)=>_-__,(_,__)=>_*__][++__%(!+[]+!+[]+!+[])][(+(+!+[]+[+!+[]]))[(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+[]])+([![图片转存失败，建议将图片保存下来直接上传](+[],___,____)}();let ______=function(_____,______,_______){____=_____;___=______[([][[]]+'')[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[!+[]+!+[]+!+[]+!+[]])[+!+[]]+(!![]+'')[+[]]]()[(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([][[]]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]]();__==_[(![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+!+[]])[+!+[]]]&&_______(-___)};return new Promise(__=>_[(![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+![]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]]+[+[]]+(![]+[+![]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])()[([][(![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+!+[]])[+!+[]]](___=>$[(![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])()(([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[+!+[]]])[!+[]+!+[]]+(![图片转存失败，建议将图片保存下来直接上传](____=>______(___,_____,__),___)))})(window,_,+[],+[],+[])
window.A593C8B8=async(_)=>(($,_,__,___,____)=>{let _____=function*(){while([])yield[(_,__)=>_+__,(_,__)=>_-__,(_,__)=>_*__][++__%(!+[]+!+[]+!+[])][(+(+!+[]+[+!+[]]))[(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+[]])+([![图片转存失败，建议将图片保存下来直接上传](+[],___,____)}();let ______=function(_____,______,_______){____=_____;___=______[([][[]]+'')[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[!+[]+!+[]+!+[]+!+[]])[+!+[]]+(!![]+'')[+[]]]()[(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([][[]]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]]();__==_[(![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+!+[]])[+!+[]]]&&_______(-___)};return new Promise(__=>_[(![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+![]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]]+[+[]]+(![]+[+![]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])()[([][(![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+!+[]])[+!+[]]](___=>$[(![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])()(([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[+!+[]]])[!+[]+!+[]]+(![图片转存失败，建议将图片保存下来直接上传](____=>______(___,_____,__),___)))})(window,_,+[],+[],+[])
window.A593C8B8=async(_)=>(($,_,__,___,____)=>{let _____=function*(){while([])yield[(_,__)=>_+__,(_,__)=>_-__,(_,__)=>_*__][++__%(!+[]+!+[]+!+[])][(+(+!+[]+[+!+[]]))[(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+[]])+([![图片转存失败，建议将图片保存下来直接上传](+[],___,____)}();let ______=function(_____,______,_______){____=_____;___=______[([][[]]+'')[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[!+[]+!+[]+!+[]+!+[]])[+!+[]]+(!![]+'')[+[]]]()[(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([][[]]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]]();__==_[(![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+!+[]])[+!+[]]]&&_______(-___)};return new Promise(__=>_[(![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+![]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]]+[+[]]+(![]+[+![]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])()[([][(![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+[+!+[]])[+!+[]]](___=>$[(![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传]((!![]+[])[+!+[]]+(!![图片转存失败，建议将图片保存下来直接上传](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])()(([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[+!+[]]])[!+[]+!+[]]+(![图片转存失败，建议将图片保存下来直接上传](____=>______(___,_____,__),___)))})(window,_,+[],+[],+[])

看起来很让人难受，对于这个混淆，我们将其中的自执行函数处理一下，让其生成调用的函数名就比较明朗了，这里不得不说vscode真好用，在这里我为了便于测试还有一些其他的代码，现在对于这个混淆的代码就有一个整体的了解了。

var f = async(_)=>(($,obj,__,___,____)=>{
    let _____ = function*() {
        while([]){
            console.log(__, ___, ____);
            yield[(_,__)=>_ + __, (_,__)=>_ - __, (_,__)=>_ * __][++__ % 3]["bind"](0, ___, ____)
        }
    }();
    let fff = function(_____, fff, ffff) {
        ____ = _____;
        ___ = fff["next"]()["value"]();
        console.log(___)
        __ == obj["a"]["length"] && ffff(-___)
    };
    return new Promise(__=>obj["a"]["forEach"](___=>$["setTimeout"](____=>{fff(___, _____, __);}, ___)))
}
)(typeof window === "undefined" ? global : window, _, +[], +[], +[])
f({"c":"A593C8B8","a":[1205,890,624,1689,389,144,2129],"t":"0000081000250018B3E6669F59D9A3EF"}).then(res => console.log(res))
// 67820250
var f = async(_)=>(($,obj,__,___,____)=>{
    let _____ = function*() {
        while([]){
            console.log(__, ___, ____);
            yield[(_,__)=>_ + __, (_,__)=>_ - __, (_,__)=>_ * __][++__ % 3]["bind"](0, ___, ____)
        }
    }();
    let fff = function(_____, fff, ffff) {
        ____ = _____;
        ___ = fff["next"]()["value"]();
        console.log(___)
        __ == obj["a"]["length"] && ffff(-___)
    };
    return new Promise(__=>obj["a"]["forEach"](___=>$["setTimeout"](____=>{fff(___, _____, __);}, ___)))
}
)(typeof window === "undefined" ? global : window, _, +[], +[], +[])


f({"c":"A593C8B8","a":[1205,890,624,1689,389,144,2129],"t":"0000081000250018B3E6669F59D9A3EF"}).then(res => console.log(res))
// 67820250
var f = async(_)=>(($,obj,__,___,____)=>{
    let _____ = function*() {
        while([]){
            console.log(__, ___, ____);
            yield[(_,__)=>_ + __, (_,__)=>_ - __, (_,__)=>_ * __][++__ % 3]["bind"](0, ___, ____)
        }
    }();
    let fff = function(_____, fff, ffff) {
        ____ = _____;
        ___ = fff["next"]()["value"]();
        console.log(___)
        __ == obj["a"]["length"] && ffff(-___)
    };
    return new Promise(__=>obj["a"]["forEach"](___=>$["setTimeout"](____=>{fff(___, _____, __);}, ___)))
}
)(typeof window === "undefined" ? global : window, _, +[], +[], +[])


f({"c":"A593C8B8","a":[1205,890,624,1689,389,144,2129],"t":"0000081000250018B3E6669F59D9A3EF"}).then(res => console.log(res))
// 67820250

在此处不得不吐槽一句，为了混淆这个文件真的变得好大，处理完了才这么一点代码，还有就是这个代码用生成器搞了个类似于那个使用Java多线程去排序的计算方法(当然js是单线程的)，去搞时间延迟阻止我们种树，这里我们就根据他的逻辑自己实现一下计算方式。

var f = function(obj){
    return new Promise(resolve => {
        let counter = 0;
        obj.a.sort((a, b) => a-b);
        obj.a.forEach((v, i) => {
            const operater = [(_,__)=>_ + __, (_,__)=>_ - __, (_,__)=>_ * __][(i+1) % 3];
            counter = operater(counter, v);
        })
        resolve(-counter);
    })
}
while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push)
        if (!push.success) throw push;
    }catch(e){
        break;
    }
}
// 注：变量cgi已在全局定义
var f = function(obj){


    return new Promise(resolve => {


        let counter = 0;
        obj.a.sort((a, b) => a-b);
        obj.a.forEach((v, i) => {
            const operater = [(_,__)=>_ + __, (_,__)=>_ - __, (_,__)=>_ * __][(i+1) % 3];
            counter = operater(counter, v);
        })
        resolve(-counter);
    })
}

while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push)
        if (!push.success) throw push;
    }catch(e){
        break;
    }
}



// 注：变量cgi已在全局定义
var f = function(obj){


    return new Promise(resolve => {


        let counter = 0;
        obj.a.sort((a, b) => a-b);
        obj.a.forEach((v, i) => {
            const operater = [(_,__)=>_ + __, (_,__)=>_ - __, (_,__)=>_ * __][(i+1) % 3];
            counter = operater(counter, v);
        })
        resolve(-counter);
    })
}

while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push)
        if (!push.success) throw push;
    }catch(e){
        break;
    }
}



// 注：变量cgi已在全局定义

第五关

第五关是50w-100w棵树，第五关突然出来了一个WebAssembly也就是wasm，这个是真没用过，着实把我看傻了，虽然没了解过但是硬刚了一波，晚上恶补了一波指令，过了50w这一关。

/**
pull示例
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
返回示例
{"c":"A661E542","a":[334562437,6452978],"t":"0000081000666290FA5B0B81481B32CD"}
push示例
http://159.75.70.9:8081/push?t=0000081000666290FA5B0B81481B32CD&a=334562804
返回示例
{"success":1,"score":500006}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A661E542","a":[334562437,6452978],"t":"0000081000666290FA5B0B81481B32CD"}







push示例




http://159.75.70.9:8081/push?t=0000081000666290FA5B0B81481B32CD&a=334562804
返回示例




{"success":1,"score":500006}
/**




pull示例




http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1




返回示例




{"c":"A661E542","a":[334562437,6452978],"t":"0000081000666290FA5B0B81481B32CD"}







push示例




http://159.75.70.9:8081/push?t=0000081000666290FA5B0B81481B32CD&a=334562804
返回示例




{"success":1,"score":500006}

此时动态加载的js是这个样子的。

window.A661E542=async function({a:A}){return(await WebAssembly.instantiate(await WebAssembly.compile(await (await fetch("data:application/octet-binary;base64,AGFzbQEAAAABBwFgAn9/AX8CFwIETWF0aANtaW4AAARNYXRoA21heAAAAwIBAAcHAQNSdW4AAgpgAV4BBn8gACECIAFBAWsiBARAA0AgAiEDQQAhBkEKIQcDQCADQQpwIQUgA0EKbiEDIAUgBhABIQYgBSAHEAAhByADQQBLDQALIAIgBiAHbGohAiAEQQFrIgQNAAsLIAIL")).arrayBuffer()),{Math:Math})).exports.Run(...A)}
window.A661E542=async function({a:A}){return(await WebAssembly.instantiate(await WebAssembly.compile(await (await fetch("data:application/octet-binary;base64,AGFzbQEAAAABBwFgAn9/AX8CFwIETWF0aANtaW4AAARNYXRoA21heAAAAwIBAAcHAQNSdW4AAgpgAV4BBn8gACECIAFBAWsiBARAA0AgAiEDQQAhBkEKIQcDQCADQQpwIQUgA0EKbiEDIAUgBhABIQYgBSAHEAAhByADQQBLDQALIAIgBiAHbGohAiAEQQFrIgQNAAsLIAIL")).arrayBuffer()),{Math:Math})).exports.Run(...A)}
window.A661E542=async function({a:A}){return(await WebAssembly.instantiate(await WebAssembly.compile(await (await fetch("data:application/octet-binary;base64,AGFzbQEAAAABBwFgAn9/AX8CFwIETWF0aANtaW4AAARNYXRoA21heAAAAwIBAAcHAQNSdW4AAgpgAV4BBn8gACECIAFBAWsiBARAA0AgAiEDQQAhBkEKIQcDQCADQQpwIQUgA0EKbiEDIAUgBhABIQYgBSAHEAAhByADQQBLDQALIAIgBiAHbGohAiAEQQFrIgQNAAsLIAIL")).arrayBuffer()),{Math:Math})).exports.Run(...A)}

使用了这个WebAssembly我也是头疼了半天，搜索了很多教程都得新安装一个软件进行反编译，然后我自己在不断尝试下发现谷歌浏览器可以直接查看甚至调试，不得不说谷歌浏览器还是牛逼啊。

var f = async function({a:A}){
    const fetcher = await fetch("data:application/octet-binary;base64,AGFzbQEAAAABBwFgAn9/AX8CFwIETWF0aANtaW4AAARNYXRoA21heAAAAwIBAAcHAQNSdW4AAgpgAV4BBn8gACECIAFBAWsiBARAA0AgAiEDQQAhBkEKIQcDQCADQQpwIQUgA0EKbiEDIAUgBhABIQYgBSAHEAAhByADQQBLDQALIAIgBiAHbGohAiAEQQFrIgQNAAsLIAIL");
    const buffer = await (fetcher).arrayBuffer();
    const compiler = await WebAssembly.compile(buffer);
    const instantiate = (await WebAssembly.instantiate(compiler, {Math:Math}));
    console.log(instantiate.exports); // 查看Run方法的[[FunctionLocation]]
    return instantiate.exports.Run(...A)
}
console.log(f({"c":"A661E542","a":[116823665, 6153003],"t":"0000081000500002F1D882C546C34290"}).then(res => console.log(res)));
// 116823707
// https://www.wasm.com.cn/docs/semantics/#32-bit-integer-operators
var f = async function({a:A}){

    const fetcher = await fetch("data:application/octet-binary;base64,AGFzbQEAAAABBwFgAn9/AX8CFwIETWF0aANtaW4AAARNYXRoA21heAAAAwIBAAcHAQNSdW4AAgpgAV4BBn8gACECIAFBAWsiBARAA0AgAiEDQQAhBkEKIQcDQCADQQpwIQUgA0EKbiEDIAUgBhABIQYgBSAHEAAhByADQQBLDQALIAIgBiAHbGohAiAEQQFrIgQNAAsLIAIL");
    const buffer = await (fetcher).arrayBuffer();
    const compiler = await WebAssembly.compile(buffer);
    const instantiate = (await WebAssembly.instantiate(compiler, {Math:Math}));
    console.log(instantiate.exports); // 查看Run方法的[[FunctionLocation]]
    return instantiate.exports.Run(...A)
}


console.log(f({"c":"A661E542","a":[116823665, 6153003],"t":"0000081000500002F1D882C546C34290"}).then(res => console.log(res)));
// 116823707
// https://www.wasm.com.cn/docs/semantics/#32-bit-integer-operators
var f = async function({a:A}){

    const fetcher = await fetch("data:application/octet-binary;base64,AGFzbQEAAAABBwFgAn9/AX8CFwIETWF0aANtaW4AAARNYXRoA21heAAAAwIBAAcHAQNSdW4AAgpgAV4BBn8gACECIAFBAWsiBARAA0AgAiEDQQAhBkEKIQcDQCADQQpwIQUgA0EKbiEDIAUgBhABIQYgBSAHEAAhByADQQBLDQALIAIgBiAHbGohAiAEQQFrIgQNAAsLIAIL");
    const buffer = await (fetcher).arrayBuffer();
    const compiler = await WebAssembly.compile(buffer);
    const instantiate = (await WebAssembly.instantiate(compiler, {Math:Math}));
    console.log(instantiate.exports); // 查看Run方法的[[FunctionLocation]]
    return instantiate.exports.Run(...A)
}


console.log(f({"c":"A661E542","a":[116823665, 6153003],"t":"0000081000500002F1D882C546C34290"}).then(res => console.log(res)));
// 116823707
// https://www.wasm.com.cn/docs/semantics/#32-bit-integer-operators

(module
  (func $Math.min (;0;) (import "Math" "min") (param i32 i32) (result i32))
  (func $Math.max (;1;) (import "Math" "max") (param i32 i32) (result i32))
  (func $Run (;2;) (export "Run") (param $var0 i32) (param $var1 i32) (result i32)
    (local $var2 i32) (local $var3 i32) (local $var4 i32) (local $var5 i32) (local $var6 i32) (local $var7 i32)
    local.get $var0
    local.set $var2
    local.get $var1
    i32.const 1
    i32.sub
    local.tee $var4
    if
      loop $label1
        local.get $var2
        local.set $var3
        i32.const 0
        local.set $var6
        i32.const 10
        local.set $var7
        loop $label0
          local.get $var3
          i32.const 10
          i32.rem_u
          local.set $var5
          local.get $var3
          i32.const 10
          i32.div_u
          local.set $var3
          local.get $var5
          local.get $var6
          call $Math.max
          local.set $var6
          local.get $var5
          local.get $var7
          call $Math.min
          local.set $var7
          local.get $var3
          i32.const 0
          i32.gt_u
          br_if $label0
        end $label0
        local.get $var2
        local.get $var6
        local.get $var7
        i32.mul
        i32.add
        local.set $var2
        local.get $var4
        i32.const 1
        i32.sub
        local.tee $var4
        br_if $label1
      end $label1
    end
    local.get $var2
  )
)
(module
  (func $Math.min (;0;) (import "Math" "min") (param i32 i32) (result i32))
  (func $Math.max (;1;) (import "Math" "max") (param i32 i32) (result i32))
  (func $Run (;2;) (export "Run") (param $var0 i32) (param $var1 i32) (result i32)
    (local $var2 i32) (local $var3 i32) (local $var4 i32) (local $var5 i32) (local $var6 i32) (local $var7 i32)
    local.get $var0
    local.set $var2
    local.get $var1
    i32.const 1
    i32.sub
    local.tee $var4
    if
      loop $label1
        local.get $var2
        local.set $var3
        i32.const 0
        local.set $var6
        i32.const 10
        local.set $var7
        loop $label0
          local.get $var3
          i32.const 10
          i32.rem_u
          local.set $var5
          local.get $var3
          i32.const 10
          i32.div_u
          local.set $var3
          local.get $var5
          local.get $var6
          call $Math.max
          local.set $var6
          local.get $var5
          local.get $var7
          call $Math.min
          local.set $var7
          local.get $var3
          i32.const 0
          i32.gt_u
          br_if $label0
        end $label0
        local.get $var2
        local.get $var6
        local.get $var7
        i32.mul
        i32.add
        local.set $var2
        local.get $var4
        i32.const 1
        i32.sub
        local.tee $var4
        br_if $label1
      end $label1
    end
    local.get $var2
  )
)
(module
  (func $Math.min (;0;) (import "Math" "min") (param i32 i32) (result i32))
  (func $Math.max (;1;) (import "Math" "max") (param i32 i32) (result i32))
  (func $Run (;2;) (export "Run") (param $var0 i32) (param $var1 i32) (result i32)
    (local $var2 i32) (local $var3 i32) (local $var4 i32) (local $var5 i32) (local $var6 i32) (local $var7 i32)
    local.get $var0
    local.set $var2
    local.get $var1
    i32.const 1
    i32.sub
    local.tee $var4
    if
      loop $label1
        local.get $var2
        local.set $var3
        i32.const 0
        local.set $var6
        i32.const 10
        local.set $var7
        loop $label0
          local.get $var3
          i32.const 10
          i32.rem_u
          local.set $var5
          local.get $var3
          i32.const 10
          i32.div_u
          local.set $var3
          local.get $var5
          local.get $var6
          call $Math.max
          local.set $var6
          local.get $var5
          local.get $var7
          call $Math.min
          local.set $var7
          local.get $var3
          i32.const 0
          i32.gt_u
          br_if $label0
        end $label0
        local.get $var2
        local.get $var6
        local.get $var7
        i32.mul
        i32.add
        local.set $var2
        local.get $var4
        i32.const 1
        i32.sub
        local.tee $var4
        br_if $label1
      end $label1
    end
    local.get $var2
  )
)

最后慢慢debug然后用js模拟实现了一下这个wasm的操作，运行速度会快得多，然后这一关就闯过了，这个栈式语言也还是挺好玩的。

var f = async function({a:A}){
    let $var0 = A[0];
    let $var1 = A[1];
    let $var2 = $var0;
    let $var4 = $var1-1;
    let $var3=0, $var5=0, $var6=0, $var7=0;
    while(1){
        $var3 = $var2;
        $var6 = 0;
        $var7 = 10;
        while(1){
            $var5 = $var3 % 10;
            $var3 = ($var3 / 10) >> 0;
            $var6 = Math.max($var5, $var6);
            $var7 = Math.min($var5, $var7);
            if($var3 <= 0) break; 
        }
        $var2 = $var6 * $var7 + $var2;
        $var4--;
        if($var4 <= 0) break;
    }
    return $var2;
}
while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push)
        if (!push.success) throw push;
    }catch(e){
        break;
    }
}
// // 注：变量cgi已在全局定义
var f = async function({a:A}){

    let $var0 = A[0];
    let $var1 = A[1];
    let $var2 = $var0;
    let $var4 = $var1-1;







    let $var3=0, $var5=0, $var6=0, $var7=0;
    while(1){
        $var3 = $var2;
        $var6 = 0;
        $var7 = 10;
        while(1){
            $var5 = $var3 % 10;
            $var3 = ($var3 / 10) >> 0;
            $var6 = Math.max($var5, $var6);
            $var7 = Math.min($var5, $var7);
            if($var3 <= 0) break; 
        }
        $var2 = $var6 * $var7 + $var2;
        $var4--;
        if($var4 <= 0) break;
    }

    return $var2;
}



while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push)
        if (!push.success) throw push;
    }catch(e){
        break;
    }
}

// // 注：变量cgi已在全局定义
var f = async function({a:A}){

    let $var0 = A[0];
    let $var1 = A[1];
    let $var2 = $var0;
    let $var4 = $var1-1;







    let $var3=0, $var5=0, $var6=0, $var7=0;
    while(1){
        $var3 = $var2;
        $var6 = 0;
        $var7 = 10;
        while(1){
            $var5 = $var3 % 10;
            $var3 = ($var3 / 10) >> 0;
            $var6 = Math.max($var5, $var6);
            $var7 = Math.min($var5, $var7);
            if($var3 <= 0) break; 
        }
        $var2 = $var6 * $var7 + $var2;
        $var4--;
        if($var4 <= 0) break;
    }

    return $var2;
}



while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push)
        if (!push.success) throw push;
    }catch(e){
        break;
    }
}

// // 注：变量cgi已在全局定义

最后

虽然写这个极其上头，但是还有很多事没做，比如老师给的论文下周要做汇报，玩了一下午先不玩了，在我写下这篇文章的时候已经有大佬种到200w棵了，我才种了100w，然后排行是82，在此仰望大佬们哈哈。

BLOG

https://github.com/WindrunnerMax/EveryDay/
https://github.com/WindrunnerMax/EveryDay/
https://github.com/WindrunnerMax/EveryDay/

© 版权声明
文章版权归作者所有，未经允许请勿转载，侵权请联系 admin@trc20.tw 删除。
THE END

# 前端
喜欢就支持一下吧
点赞0

Warning: mysqli_query(): (HY000/3): Error writing file '/tmp/MYWpKy3d' (Errcode: 28 - No space left on device) in /www/wwwroot/583.cn/wp-includes/class-wpdb.php on line 2345
admin的头像-五八三
相关推荐
评论 抢沙发
头像
欢迎您留下宝贵的见解！
提交
头像

昵称

图形验证码
取消
昵称

请填写用户信息：

  • 昵称(必填)
  • 邮箱(必填)
代码

请输入代码：

确认
图片
文章目录
文章目录
热门推荐