[中文](./README_zh.md) [English](./README.md)## Cplusplus
> source code : `Cplusplus.exe`>> problem : `Cplusplus.exe`>> compile : `compile.txt`  
### analyze
```C++struct st {	unsigned short num1;	unsigned short num2;	unsigned short num3;};
st boostFn(const std::string& s) {	using boost::spirit::qi::_1;	using boost::spirit::qi::ushort_;	using boost::spirit::qi::char_;	using boost::phoenix::ref;
	struct st res;	const char* first = s.data();	const char* const end = first + s.size();	bool success = boost::spirit::qi::parse(first, end,		ushort_[ref(res.num1) = _1] >> char('@')		>> ushort_[ref(res.num2) = _1] >> char('#')		>> ushort_[ref(res.num3) = _1]	);
	if (!success || first != end) {		//throw std::logic_error("Parsing failed");		_exit(0);	}	return res;}```
This code is related to `boost::spirit`. The input is such as `num1@num2#num3`, and the three `unsigned short` values are separated by `@ #`.
```C++void boostFunc(unsigned short& num) {	//random number check	//The expected num is 78	if (num > 111) {		_exit(0);	}	boost::mt19937 rng(num);	rng.discard(num % 12);	//Copy Construction, retain all the state	boost::mt19937 rng_(rng);	rng_.discard(num / 12);	//discarding num random results	if (rng_() != 3570126595) {		_exit(0);	}	num -= (rng_() % 45);	// 45}```
An `unsigned short` is passed in, less than or equal to 111. It is used as the seed of the random engine, discarding `num % 12` random numbers, and then constructing a random engine copy.
> Note that the copy construct here completely preserves the state of the random engine, not the initial state.>> In IDA, it behaves as a direct memcpy
Then discard the `num/12` random numbers.
Then output a random number requirement equal to `3570126595`, and finally the value passed in is changed because it is a reference.
There is nothing to say in the second check .
The third check is my mistake
```C++if ((res.num3 % res.num1 != 12) && (res.num3 / res.num1) != 3) {		//3 * 34 + 12 == 114		std::cout << "You failed...again";		_exit(0);	}```
There have been many solutions here, and later I found out that `||` was mistakenly written as `&&`, so as long as the formula on the right is satisfied, the flag will be output, and finally `md5` will be guaranteed to guarantee the unique solution.
This is my mistake, I am sincerely sorry.