Skip to content

Latest commit

 

History

History
382 lines (328 loc) · 19.8 KB

记一次有意思的种树比赛.md

File metadata and controls

382 lines (328 loc) · 19.8 KB

A fun tree-planting competition

I found a interesting website http://geek.qq.com/tree/ shared by a friend in the recruitment group. It's really addictive! This tree-planting activity is actually like a game of passing levels. As you plant more trees, new gameplay elements are unlocked. I'm just a newbie, and when I reached 1 million trees, I couldn't keep up. In the levels I played, I had to decrypt and deobfuscate js and perform other operations, which was quite entertaining. It's important to note that you can only plant the next tree after successfully planting one, so running multiple threads to parallel the interface is pointless.

Level One

The first level consists of planting 1-10,000 trees, and it's quite simple. It's just a matter of issuing a simple request. There's only one value in the array, and you just need to retrieve it and send it back. In fact, most of the processing for this game takes place in the middle of this process.

/**
pull example
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
example response
{"c":"A274075A","a":[73513],"t":"000010510000000086A11C1156D6202A"}

push example
http://159.75.70.9:8081/push?t=000010510000000086A11C1156D6202A&a=73513
example response
{"success":1,"score":1}

In fact, during the game, all you need to pay attention to is the a property, which is obtained from the array in the push part, so you can just use pop directly.

var f = function(obj){
    return new Promise(resolve => {
        resolve(obj.a.pop());
    })
}

while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}
// Note: the variable cgi has been globally defined

Level Two

The second level consists of planting 10,000-100,000 trees. After the first request, a <script> will be dynamically inserted into the global window based on the value of the c property in the returned push object. Then, a function is called to calculate the value to be submitted for the push. The calculations given are either a long delay or a time-consuming looping operation, challenging you to optimize it in order to speed up the tree planting process.

/**
pull example
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
example response
{"c":"A3C2EA99","a":[79124],"t":"00001051000100011B214AC36A8E9369"}

push example
http://159.75.70.9:8081/push?t=00001051000100011B214AC36A8E9369&a=6260686500
example response
{"success":1,"score":10002}

The dynamically loaded js looks like this.

// http://159.75.70.9:8080/A3C2EA99.js
window.A3C2EA99 = async function({a}){return new Promise(_=>setTimeout(__=>_(a[0]*a[0]+a[0]),2000))}

It seems straightforward, just calculating a[0]*a[0]+a[0], but if you call this method directly, there will be a delay of about 2s, so you need to optimize it yourself.

var f = function(obj){
    return new Promise(resolve => {
        const a = obj.a.pop();
        resolve(a*a+a);
    })
}


```javascript
while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}

// Note: The variable `cgi` has been globally defined

Level 3

Level 3 involves 100,000-250,000 trees, and this is where the JavaScript starts to move towards encryption and obfuscation.

/**
Example of pull
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
Example response
{"c":"A5473788","a":[359,626,105471],"t":"0000105100100000072FD4E99C75A6C6"}

Example of push
http://159.75.70.9:8081/push?t=0000105100100000072FD4E99C75A6C6&a=17923
Example response
{"success":1,"score":100001}

At this point, the dynamically-loaded JavaScript looks like this.

eval(atob("dmFyIF8weGU5MzY9WydBNTQ3Mzc4OCddOyhmdW5jdGlvbihfMHg0OGU4NWMsXzB4ZTkzNmQ4KXt2YXIgXzB4MjNmYzVhPWZ1bmN0aW9uKF8weDI4NThkOSl7d2hpbGUoLS1fMHgyODU4ZDkpe18weDQ4ZTg1Y1sncHVzaCddKF8weDQ4ZTg1Y1snc2hpZnQnXSgpKTt9fTtfMHgyM2ZjNWEoKytfMHhlOTM2ZDgpO30oXzB4ZTkzNiwweDE5NikpO3ZhciBfMHgyM2ZjPWZ1bmN0aW9uKF8weDQ4ZTg1YyxfMHhlOTM2ZDgpe18weDQ4ZTg1Yz1fMHg0OGU4NWMtMHgwO3ZhciBfMHgyM2ZjNWE9XzB4ZTkzNltfMHg0OGU4NWNdO3JldHVybiBfMHgyM2ZjNWE7fTt3aW5kb3dbXzB4MjNmYygnMHgwJyldPWZ1bmN0aW9uKF8weDMzNTQzNyl7dmFyIF8weDFhYWMwMj0weDMwZDNmO2Zvcih2YXIgXzB4M2JlZDZhPTB4MzBkM2Y7XzB4M2JlZDZhPjB4MDtfMHgzYmVkNmEtLSl7dmFyIF8weDM3NTM0MD0weDA7Zm9yKHZhciBfMHgxZGRiNzc9MHgwO18weDFkZGI3NzxfMHgzYmVkNmE7XzB4MWRkYjc3Kyspe18weDM3NTM0MCs9XzB4MzM1NDM3WydhJ11bMHgwXTt9XzB4Mzc1MzQwJV8weDMzNTQzN1snYSddWzB4Ml09PV8weDMzNTQzN1snYSddWzB4MV0mJl8weDNiZWQ2YTxfMHgxYWFjMDImJihfMHgxYWFjMDI9XzB4M2JlZDZhKTt9cmV0dXJuIF8weDFhYWMwMjt9Ow=="))

Of course, this is just a base64 encoding. Unfolding it reveals the implementation of the source code.

var f = function(_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = _0x335437['a'][0x0] * _0x3bed6a;
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }
    return _0x1aac02;
};

while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push);
        if(!push.success) throw push;
    }catch(e){
        break;
    }
}

// 注：The variable cgi has been defined globally

Level 4

In this js, the loop operation is very time-consuming. Just by looking at 0x30d3f = 199999 and the internal for loop, we can tell. But we can simplify this loop and the entire code to plant trees faster.

var f = function(_0x335437) {
    var _0x1aac02 = 0x30d3f;
    for (var _0x3bed6a = 0x30d3f; _0x3bed6a > 0x0; _0x3bed6a--) {
        var _0x375340 = _0x335437['a'][0x0] * _0x3bed6a;
        _0x375340 % _0x335437['a'][0x2] == _0x335437['a'][0x1] && _0x3bed6a < _0x1aac02 && (_0x1aac02 = _0x3bed6a);
    }
    return _0x1aac02;
};
window.A593C8B8 = async(_) => {
  ($, _, __, ___, ____) => {
    let _____ = function* () {
      while([]) yield [
        (_,__)=>_+__,
        (_,__)=>_-__,
        (_,__)=>_*__
      ][++__%(!+[]+!+[]+!+[])][(+(+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]](+[], ___, ____)
    };
    let ______ = function(_____, _______, _______){
      ___ = _____;
      ___ = ______[([][[]]+''[+!+[]]+!![])[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+'')[!+[]+!+[]+!+[]+!+[]+!+[]]+(+!+[]+[+!+[]]+[+!+[]])[!![]+!+[]+!+[]+!+[]+!+[]]||(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]];
    };
    return new Promise(__ => _[(![]+'')[+!+[]]][(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+![]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+![]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]](!+[]+!+[]+[+!+[]])[+!+[]]](___=>$[(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]](![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]](!![]+[])[+!+[]]+[+!+[]]+[+!+[]])[!![]+!+[]+!+[]+!+[]+[]]]+[])[!+[]+

It looks very uncomfortable, for this confusion, we will handle the self-executing function to make the generated function name clearer. I have to say vscode is really useful. Here I have some other code to facilitate testing. Now, we have an overall understanding of this obfuscated code.

var f = async(_)=>(($,obj,__,___,____)=>{
    let _____ = function*() {
        while([]){
            console.log(__, ___, ____);
            yield[(_,__)=>_ + __, (_,__)=>_ - __, (_,__)=>_ * __][++__ % 3]["bind"](0, ___, ____)
        }
    }();
    let fff = function(_____, fff, ffff) {
        ____ = _____;
        ___ = fff["next"]()["value"]();
        console.log(___)
        __ == obj["a"]["length"] && ffff(-___)
    };
    return new Promise(__=>obj["a"]["forEach"](___=>$["setTimeout"](____=>{fff(___, _____, __);}, ___)))
}
)(typeof window === "undefined" ? global : window, _, +[], +[], +[])


f({"c":"A593C8B8","a":[1205,890,624,1689,389,144,2129],"t":"0000081000250018B3E6669F59D9A3EF"}).then(res => console.log(res))
// 67820250

I must complain here. It really became so big to obfuscate this file, and there's only this much code after processing. Also, this code uses a generator to implement a calculation method similar to using Java multi-threading to sort (of course js is single-threaded) and to create time delays to prevent us from planting trees. Here we will implement the calculation method based on its logic.

var f = function(obj){
    return new Promise(resolve => {
        let counter = 0;
        obj.a.sort((a, b) => a-b);
        obj.a.forEach((v, i) => {
            const operater = [(_,__)=>_ + __, (_,__)=>_ - __, (_,__)=>_ * __][(i+1) % 3];
            counter = operater(counter, v);
        })
        resolve(-counter);
    })
}

while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push)
        if (!push.success) throw push;
    }catch(e){
        break;
    }
}

// Note: The variable cgi has been globally defined

Level 5

Level 5 is 500k-1M trees. A WebAssembly suddenly appeared in level 5, which I have never used before, and it really caught me off guard. Although I didn't understand it before, I tried to learn it overnight and passed level 5.

/**
pull example
http://159.75.70.9:8081/pull?u=0000081082CCDB14682A1505892071B1
Example response
{"c":"A661E542","a":[334562437,6452978],"t":"0000081000666290FA5B0B81481B32CD"}

push example
http://159.75.70.9:8081/push?t=0000081000666290FA5B0B81481B32CD&a=334562804
Example response
{"success":1,"score":500006}

At this time, the dynamically loaded js looks like this.


```javascript
var f = async function({a:A}){
    const fetcher = await fetch("data:application/octet-binary;base64,AGFzbQEAAAABBwFgAn9/AX8CFwIETWF0aANtaW4AAARNYXRoA21heAAAAwIBAAcHAQNSdW4AAgpgAV4BBn8gACECIAFBAWsiBARAA0AgAiEDQQAhBkEKIQcDQCADQQpwIQUgA0EKbiEDIAUgBhABIQYgBSAHEAAhByADQQBLDQALIAIgBiAHbGohAiAEQQFrIgQNAAsL");
    const buffer = await fetcher.arrayBuffer();
    const compiler = await WebAssembly.compile(buffer);
    const instantiate = await WebAssembly.instantiate(compiler, {Math:Math});
    console.log(instantiate.exports); // Check the location of the Run method [[FunctionLocation]]
    return instantiate.exports.Run(...A)
}

console.log(f({"c":"A661E542","a":[116823665, 6153003],"t":"0000081000500002F1D882C546c34290"}).then(res => console.log(res)));
// 116823707
// https://www.wasm.com.cn/docs/semantics/#32-bit-integer-operators

(module
  (func $Math.min (;0;) (import "Math" "min") (param i32 i32) (result i32))
  (func $Math.max (;1;) (import "Math" "max") (param i32 i32) (result i32))
  (func $Run (;2;) (export "Run") (param $var0 i32) (param $var1 i32) (result i32)
    (local $var2 i32) (local $var3 i32) (local $var4 i32) (local $var5 i32) (local $var6 i32) (local $var7 i32)
    local.get $var0
    local.set $var2
    local.get $var1
    i32.const 1
    i32.sub
    local.tee $var4
    if
      loop $label1
        local.get $var2
        local.set $var3
        i32.const 0
        local.set $var6
        i32.const 10
        local.set $var7
        loop $label0
          local.get $var3
          i32.const 10
          i32.rem_u
          local.set $var5
          local.get $var3
          i32.const 10
          i32.div_u
          local.set $var3
          local.get $var5
          local.get $var6
          call $Math.max
          local.set $var6
          local.get $var5
          local.get $var7
          call $Math.min
          local.set $var7
          local.get $var3
          i32.const 0
          i32.gt_u
          br_if $label0
        end $label0
        local.get $var2
        local.get $var6
        local.get $var7
        i32.mul
        i32.add
        local.set $var2
        local.get $var4
        i32.const 1
        i32.sub
        local.tee $var4
        br_if $label1
      end $label1
    end
    local.get $var2
  )
)

Finally, I debugged it slowly and simulated the operation of this wasm with js, the running speed was much faster. Then I passed this level, this stack-based language is quite fun.

var f = async function({a:A}){
    let $var0 = A[0];
    let $var1 = A[1];
    let $var2 = $var0;
    let $var4 = $var1-1;

    let $var3=0, $var5=0, $var6=0, $var7=0;
    while(1){
        $var3 = $var2;
        $var6 = 0;
        $var7 = 10;
        while(1){
            $var5 = $var3 % 10;
            $var3 = ($var3 / 10) >> 0;
            $var6 = Math.max($var5, $var6);
            $var7 = Math.min($var5, $var7);
            if($var3 <= 0) break; 
        }
        $var2 = $var6 * $var7 + $var2;
        $var4--;
        if($var4 <= 0) break;
    }
    return $var2;
}
while(true){
    try{
        let token = "0000081082CCDB14682A1505892071B1"
        let pull = await (await fetch(`${cgi}/pull?u=${token}`)).json();
        let val = await f(pull);
        let push = await (await fetch(`${cgi}/push?t=${pull.t}&a=${val}`)).json();
        console.log(push)
        if (!push.success) throw push;
    }catch(e){
        break;
    }
}

// // Note: The variable cgi has been defined globally

Finally

I know I got a bit carried away writing this, but there's still a lot of things left to do. My teacher's paper needs to be presented next week. I spent the whole afternoon playing, but now I better get back to work. As I'm writing this, some bigwigs have already planted 2 million trees. I've only planted 1 million so far and I'm ranked 82nd. Hats off to those big shots.

BLOG

https://github.com/WindrunnerMax/EveryDay/