1.`p`是 16-bit 素数且`p > max(o) = 0xdeb4`，枚举`(0xdeb4, 65536)`内所有素数；
2.对每个`p`，按上式恢复`c[5..41]`，若全部落在可打印 ASCII 范围则为候选；
3.只有**p = 59441**一个候选，解出尾部为`749d39d4-78db-4c55-b4ff-bca873d0f18e}`（UUID 格式），前缀即`flag{`；
4.用已知明文字符`c[0..4]`从状态`X[4]`逆向递推（`x0=y0/c, x1=y1/y0, ...`）得到初始`k = [28358, 39970, 28105, 42009, 46211]`，正向完整模拟 42 个字符，输出与`output.txt`逐字节一致。
解题exp
```python
fromCrypto.Util.numberimportisPrime
outs = [int(l.strip().split(':')[1],16)forlinopen('output.txt')]
n =len(outs)
# 1) 枚举 p，恢复 c[5..41]
forpinrange(max(outs) +1,65536):
ifnotisPrime(p):
continue
o = outs
I =lambdaa:pow(a, p -2, p)
x3 = [None]*n; x2 = [None]*n; x1 = [None]*n; x0 = [None]*n
foriinrange(1, n): x3[i] = o[i] * I(o[i-1]) % p
foriinrange(2, n): x2[i] = x3[i] * I(x3[i-1]) % p
foriinrange(3, n): x1[i] = x2[i] * I(x2[i-1]) % p
foriinrange(4, n): x0[i] = x1[i] * I(x1[i-1]) % p
chars = [None]*n
ok =True
foriinrange(4, n -1):
prod = x0[i]*x1[i] % p * x2[i] % p * x3[i] % p * o[i] % p
c = o[i+1] * I(prod) % p
ifnot(0x20<= c <0x7f):
ok =False
break
chars[i+1] = c
ifok:
print(p,bytes(chars[5:]))
# 2) p=59441, 拼上前缀 flag{, 反推初始 k 并完整验证
p =59441
flag =b"flag{749d39d4-78db-4c55-b4ff-bca873d0f18e}"
I =lambdaa:pow(a, p -2, p)
o = outs
x3=[None]*n; x2=[None]*n; x1=[None]*n; x0=[None]*n
foriinrange(1, n): x3[i] = o[i]*I(o[i-1]) % p
foriinrange(2, n): x2[i] = x3[i]*I(x3[i-1]) % p
foriinrange(3, n): x1[i] = x2[i]*I(x2[i-1]) % p
foriinrange(4, n): x0[i] = x1[i]*I(x1[i-1]) % p
X = [x0[4], x1[4], x2[4], x3[4], o[4]]
foriinrange(4, -1, -1):
c = flag[i]
y0, y1, y2, y3, y4 = X
X = [y0*I(c)%p, y1*I(y0)%p, y2*I(y1)%p, y3*I(y2)%p, y4*I(y3)%p]
k_init = X
k =list(k_init)
fori, cinenumerate(flag):
g = c
forjinrange(5):
k[j] = g = g * k[j] % p
assertg == o[i], i
print("verified:", flag.decode())
