[{"data":1,"prerenderedAt":951},["ShallowReactive",2],{"content:\u002F2026\u002Fweek6-traffic-analysis":3,"surround:\u002F2026\u002Fweek6-traffic-analysis":940},{"id":4,"title":5,"body":6,"categories":916,"date":918,"description":919,"draft":920,"extension":921,"image":922,"meta":923,"navigation":926,"path":927,"permalink":928,"published":928,"readingTime":929,"recommend":928,"references":928,"seo":934,"sitemap":935,"stem":936,"tags":937,"type":938,"updated":928,"__hash__":939},"content\u002Fposts\u002F2026\u002Fweek6-traffic-analysis.md","流量分析两道题WP",{"type":7,"value":8,"toc":888},"minimark",[9,18,21,41,44,49,54,66,73,96,99,106,109,119,126,134,137,145,148,154,165,186,188,192,195,198,201,221,224,228,233,236,242,249,253,256,325,335,355,367,370,376,382,385,404,433,437,441,448,454,461,467,478,483,504,507,510,524,567,581,585,588,591,606,613,617,620,667,678,682,700,798,801,827,834,840,843,849,852,854,857,860],[10,11,12,13,17],"p",{},"这两道流量分析题，都藏在 pcap 文件里，但思路完全不同。第一道是 IP 头 ",[14,15,16],"code",{"code":16},"Identification"," 字段的隐写，靠的是对协议字段的理解；第二道是一条完整的攻击链——DNS 数据外带、加密压缩包、二维码掩码，一环扣一环，挺有意思。",[10,19,20],{},"复现链接：",[22,23,24,34],"ul",{},[25,26,27,28],"li",{},"题目一（IP 标识字段隐写）：",[29,30,31],"a",{"href":31,"rel":32},"https:\u002F\u002Fwww.nssctf.cn\u002Fproblem\u002F7482",[33],"nofollow",[25,35,36,37],{},"题目二（DNS 数据外带）：",[29,38,39],{"href":39,"rel":40},"https:\u002F\u002Fwww.nssctf.cn\u002Fproblem\u002F7174",[33],[42,43],"hr",{},[45,46,48],"h2",{"id":47},"题目一ip-标识字段隐写","题目一：IP 标识字段隐写",[50,51,53],"h3",{"id":52},"前置知识ip-头的-identification-字段","前置知识：IP 头的 Identification 字段",[10,55,56,57,61,62,65],{},"IP 报文头部有一个 16 位的 ",[58,59,60],"strong",{},"Identification（标识）"," 字段，占两个字节，取值范围 ",[14,63,64],{"code":64},"0x0000 ~ 0xFFFF","。",[10,67,68,69,72],{},"它最初的设计用途是",[58,70,71],{},"分片重组","：同一个数据报被分片后，所有分片携带相同的 ID，接收方靠它把分片重新拼起来。但现在网络里的分片越来越少，这个字段大部分时候都是闲置的，于是就成了 CTF 里藏数据的好地方。",[10,74,75,76,79,80,83,84,87,88,91,92,95],{},"所谓\"低字节\"，就是这 16 位的低 8 位，也就是 ",[14,77,78],{"code":78},"ip.id & 0xFF","，在十六进制表示下就是",[58,81,82],{},"末两位","。比如 ",[14,85,86],{"code":86},"ip.id = 0x0969","，低字节就是 ",[14,89,90],{"code":90},"0x69","，对应的 ASCII 字符是 ",[14,93,94],{"code":94},"i","。把每个包的低字节当成一个字符，连续拼起来就是明文。",[50,97,98],{"id":98},"解题过程",[10,100,101,102,105],{},"题目说得很直白：在 ",[14,103,104],{"code":104},"192.168.50.10 → 192.168.0.50"," 的 ICMP 流里，连续 35 个包可以提取出十六进制字符串。",[10,107,108],{},"先用 Wireshark 过滤器定位这条流：",[110,111,116],"pre",{"className":112,"code":114,"language":115},[113],"language-text","ip.src == 192.168.50.10 && ip.dst == 192.168.0.50 && icmp\n","text",[14,117,114],{"__ignoreMap":118},"",[10,120,121,122,125],{},"正好 35 个包。然后提取每个包的 ",[14,123,124],{"code":124},"ip.id"," 低字节。用 tshark 最方便：",[110,127,132],{"className":128,"code":130,"language":131,"meta":118},[129],"language-bash","tshark -r PrivateChannel.pcap.pcapng \\\n  -Y \"ip.src==192.168.50.10 && ip.dst==192.168.0.50 && icmp.type==8\" \\\n  -T fields -e ip.id \\\n  | sed 's\u002F0x\u002F\u002F' \\\n  | awk '{print substr($0, length($0)-1)}' \\\n  | paste -sd '' -\n","bash",[14,133,130],{"__ignoreMap":118},[10,135,136],{},"也可以直接用 Python + Scapy：",[110,138,143],{"className":139,"code":141,"language":142,"meta":118},[140],"language-python","from scapy.all import rdpcap\n\npkts = rdpcap('PrivateChannel.pcap.pcapng')\nsel = [p for p in pkts\n       if p.haslayer('IP') and p.haslayer('ICMP')\n       and p['IP'].src == '192.168.50.10'\n       and p['IP'].dst == '192.168.0.50'\n       and p['ICMP'].type == 8]\n\nlow = [p['IP'].id & 0xff for p in sel]\nprint(bytes(low))\n","python",[14,144,141],{"__ignoreMap":118},[10,146,147],{},"跑出来结果是：",[110,149,152],{"className":150,"code":151,"language":115},[113],"hex  : 000069226865726520697320796f7572...\n",[14,153,151],{"__ignoreMap":118},[10,155,156,157,160,161,164],{},"前两个包的 ",[14,158,159],{"code":159},"ip.id = 0x0000"," 是填充，第 3 个包是混进来的 echo-reply（",[14,162,163],{"code":163},"ICMP type=0","）干扰包。去掉这些干扰，把剩下的低字节拼起来就是题目要的明文。",[10,166,167,168,171,172,174,175,178,179,178,182,185],{},"这道题本身不难，但它提醒了一点：",[58,169,170],{},"流量隐写不一定藏在 payload 里，协议头部那些\"看起来没用\"的字段一样可以藏数据","。除了 ",[14,173,124],{"code":124},"，常见的还有 ",[14,176,177],{"code":177},"tcp.urgent_pointer","、",[14,180,181],{"code":181},"tcp.seq\u002Fack",[14,183,184],{"code":184},"dns.qry.name"," 这些。",[42,187],{},[45,189,191],{"id":190},"题目二dns-外带-加密压缩包-qr-掩码","题目二：DNS 外带 + 加密压缩包 + QR 掩码",[10,193,194],{},"这道题完整走了一遍攻击链，信息量比第一道大得多。题目描述说\"某内网主机被怀疑通过 DNS 流量悄悄送出了一份文件\"，要我们还原被外带的数据并找到里面的机密信息。",[50,196,197],{"id":197},"整体思路",[10,199,200],{},"分三步：",[202,203,204,211,214],"ol",{},[25,205,206,207,210],{},"从 pcap 里把 DNS 外带的数据拼回来，还原出一个",[58,208,209],{},"加密的 zip","；",[25,212,213],{},"破解 ZipCrypto 加密，解压出一张二维码图片和一份 QR 标准 PDF；",[25,215,216,217,220],{},"二维码被额外的 Mask 3 扰乱，按 ",[14,218,219],{"code":219},"(i+j)%3==0"," 对数据模块做异或恢复，解码出结果。",[10,222,223],{},"下面逐步拆解。",[50,225,227],{"id":226},"step-1dns-数据外带还原","Step 1：DNS 数据外带还原",[229,230,232],"h4",{"id":231},"什么是-dns-数据外带","什么是 DNS 数据外带",[10,234,235],{},"DNS 协议几乎是内网主机必然能用的出站通道——出站 DNS 查询通常不被防火墙拦截。攻击者利用这一点，把数据编码进 DNS 查询的**域名（qname）**里发出去。典型做法是把文件切成小段，每段转成十六进制，作为子域名拼在受控域名前面：",[110,237,240],{"className":238,"code":239,"language":115},[113],"\u003Chex数据>.attacker.com\n",[14,241,239],{"__ignoreMap":118},[10,243,244,245,248],{},"本题的 qname 形如 ",[14,246,247],{"code":247},"\u003Chex>.google.","，伪装成 google 域名，数据就藏在最左边那个 label 里。",[229,250,252],{"id":251},"定位外带通道关键做错会导致还原失败","定位外带通道（关键，做错会导致还原失败）",[10,254,255],{},"先统计 DNS 请求的方向。发现请求只发往三个目的地：",[257,258,259,278],"table",{},[260,261,262],"thead",{},[263,264,265,269,272,275],"tr",{},[266,267,268],"th",{},"源",[266,270,271],{},"目的",[266,273,274],{},"数量",[266,276,277],{},"含义",[279,280,281,298,311],"tbody",{},[263,282,283,287,292,295],{},[284,285,286],"td",{},"192.168.33.167",[284,288,289],{},[58,290,291],{},"8.8.8.8",[284,293,294],{},"203625",[284,296,297],{},"✅ 真正的数据外带通道",[263,299,300,302,305,308],{},[284,301,286],{},[284,303,304],{},"192.168.33.1",[284,306,307],{},"471",[284,309,310],{},"网关 DNS（干扰）",[263,312,313,316,319,322],{},[284,314,315],{},"127.0.0.1",[284,317,318],{},"127.0.0.53",[284,320,321],{},"427",[284,323,324],{},"本地 systemd-resolved（干扰）",[10,326,327,334],{},[58,328,329,330,333],{},"为什么必须过滤 ",[14,331,332],{"code":332},"ip.addr == 8.8.8.8","？"," 这是这道题最大的坑。",[10,336,337,338,340,341,344,345,340,348,351,352,65],{},"发往 8.8.8.8 的查询，qname 是 ",[14,339,247],{"code":247},"（以 ",[14,342,343],{"code":343},".google."," 结尾）；而发往本地 DNS 的查询，qname 是 ",[14,346,347],{"code":347},"\u003Chex>.google.com",[14,349,350],{"code":350},".google.com"," 结尾）。两套查询的 hex 前缀相同，但",[58,353,354],{},"是两套独立的查询流",[10,356,357,358,360,361,363,364,65],{},"如果不过滤 IP，把 ",[14,359,343],{"code":343}," 和 ",[14,362,350],{"code":350}," 混在一起按包顺序拼接，就会把同一段数据重复插进来、或顺序错位。我一开始就踩了这个坑——还原出的 zip 文件表能读出来，但 deflate 数据解压直接报 ",[14,365,366],{"code":366},"invalid distance too far back",[10,368,369],{},"正确的过滤器：",[110,371,374],{"className":372,"code":373,"language":115},[113],"dns.flags.response == 0 && ip.dst == 8.8.8.8 && dns.qry.name contains \"google\"\n",[14,375,373],{"__ignoreMap":118},[10,377,378,379,381],{},"即只取发往 8.8.8.8 的、qname 以 ",[14,380,343],{"code":343}," 结尾的请求，取第一个 label 的 hex 拼接。",[229,383,384],{"id":384},"提取并还原",[10,386,387,388,391,392,395,396,399,400,403],{},"从 pcap 里提取出 ",[58,389,390],{},"203610 个 hex 片段","，拼接后得到 ",[58,393,394],{},"6108269 字节"," 的文件，头四个字节是 ",[14,397,398],{"code":398},"50 4b 03 04","（",[14,401,402],{"code":402},"PK\\x03\\x04","），确认是 ZIP。",[405,406,407],"blockquote",{},[10,408,409,412,413,416,417,420,421,424,425,428,429,432],{},[58,410,411],{},"小知识点：pcapng 格式与 SLL 链路层","\n附件虽然是 ",[14,414,415],{"code":415},".pcap"," 后缀，但魔数是 ",[14,418,419],{"code":419},"0a0d0d0a","，实际是 ",[58,422,423],{},"pcapng"," 格式。解析时要处理 Section Header Block、Interface Description Block、Enhanced Packet Block 三种 block。\n其中 IDB 里的 linktype = ",[58,426,427],{},"113","，是 Linux cooked capture（SLL），IP 头前面是 16 字节的 SLL 头（而不是以太网的 14 字节）。这就是脚本里 ",[14,430,431],{"code":431},"ip_off = 16"," 的由来。",[50,434,436],{"id":435},"step-2破解-zipcrypto-加密","Step 2：破解 ZipCrypto 加密",[229,438,440],{"id":439},"zip-传统加密原理","ZIP 传统加密原理",[10,442,443,444,447],{},"ZIP 的加密标志在文件头的 flags 字段，bit0 表示加密。本题两个文件的 flags 都是 ",[14,445,446],{"code":446},"0x0009","：",[110,449,452],{"className":450,"code":451,"language":115},[113],"0x0001 = encrypted（加密）\n0x0008 = data descriptor（数据描述符）\n",[14,453,451],{"__ignoreMap":118},[10,455,456,457,460],{},"ZipCrypto 是一个",[58,458,459],{},"基于 CRC32 的流密码","，不是 AES。密钥调度是这样的：",[110,462,465],{"className":463,"code":464,"language":142,"meta":118},[140],"key0, key1, key2 = 0x12345678, 0x23456789, 0x34567890\nfor c in password:\n    key0 = crc32(key0, c)\n    key1 = (key1 + (key0 & 0xFF)) * 134775813 + 1\n    key2 = crc32(key2, key1 >> 24)\n",[14,466,464],{"__ignoreMap":118},[10,468,469,470,473,474,477],{},"加密数据 = ",[58,471,472],{},"12 字节加密头 + 压缩数据（deflate）","。加密头前 11 字节是随机数，",[58,475,476],{},"第 12 字节是 check byte（校验字节）","，用来快速验证密码对不对。",[10,479,480],{},[58,481,482],{},"坑点在于 check byte 的取值规则：",[22,484,485,495],{},[25,486,487,488,491,492,210],{},"如果 flags 的 bit3 ",[58,489,490],{},"未设置","：check byte = CRC32 的",[58,493,494],{},"最高字节",[25,496,487,497,500,501,65],{},[58,498,499],{},"已设置","（有 data descriptor）：check byte = ",[58,502,503],{},"修改时间（mod time）的最高字节",[10,505,506],{},"本题 bit3 置位了，所以校验时要用 mod time 高位，而不是 CRC 高位。用错规则会误判成\"密码错误\"。",[229,508,509],{"id":509},"解密",[10,511,512,513,516,517,399,520,523],{},"密码是 ",[14,514,515],{"code":515},"XUt59@wG","。解密后去掉 12 字节加密头，剩下的是 raw deflate 流，用 ",[14,518,519],{"code":519},"zlib.decompress(data, -15)",[14,521,522],{"code":522},"-15"," 表示 raw deflate，无 zlib 头）解压，得到两个文件：",[257,525,526,539],{},[260,527,528],{},[263,529,530,533,536],{},[266,531,532],{},"文件名",[266,534,535],{},"大小",[266,537,538],{},"类型",[279,540,541,554],{},[263,542,543,548,551],{},[284,544,545],{},[14,546,547],{"code":547},"3号面具.png",[284,549,550],{},"53174 字节",[284,552,553],{},"PNG 图片",[263,555,556,561,564],{},[284,557,558],{},[14,559,560],{"code":560},"ISO_IEC18004-2015.pdf",[284,562,563],{},"6346542 字节",[284,565,566],{},"QR 码国际标准文档",[10,568,569,570,573,574,577,578,65],{},"文件名 ",[14,571,572],{"code":572},"3号面具"," 的 GBK 编码是 ",[14,575,576],{"code":576},"3\\xba\\xc5\\xc3\\xe6\\xbe\\xdf","，\"面具\" = mask，",[58,579,580],{},"\"3号\"就暗示了 Mask pattern 3",[50,582,584],{"id":583},"step-3qr-码-mask-隐写解码","Step 3：QR 码 Mask 隐写解码",[229,586,587],{"id":587},"解压结果分析",[10,589,590],{},"两个文件其实都在给提示：",[22,592,593,598],{},[25,594,595,597],{},[14,596,547],{"code":547},"：1080×1080 的图片，实际是一张二维码，但被\"面具\"（mask）扰乱了。",[25,599,600,447,602,605],{},[14,601,560],{"code":560},[58,603,604],{},"QR 码的国际标准","，里面定义了 8 种 mask pattern 的公式。出题人放这份文档，就是让你去查 mask 的定义。",[10,607,608,609,612],{},"PNG 里还藏了一个非标准 chunk ",[14,610,611],{"code":611},"fdEC","（5 字节 payload），也是提示线索。",[229,614,616],{"id":615},"qr-码结构基础","QR 码结构基础",[10,618,619],{},"QR 码由两类模块组成：",[22,621,622,658],{},[25,623,624,627,628,631,632],{},[58,625,626],{},"功能图形（function patterns）","：定位、校正、格式信息，帮解码器找到并理解二维码，",[58,629,630],{},"不参与数据 mask","。\n",[22,633,634,640,646,652],{},[25,635,636,639],{},[58,637,638],{},"Finder pattern（定位图案）","：三个角上的 7×7 同心方块，黑白比例 1:1:3:1:1，用来定位。",[25,641,642,645],{},[58,643,644],{},"Timing pattern（时序图案）","：第 6 行\u002F第 6 列的交替黑白线，用来确定模块大小。",[25,647,648,651],{},[58,649,650],{},"Alignment pattern（校正图案）","：version ≥2 出现，帮助校正扭曲。",[25,653,654,657],{},[58,655,656],{},"Format info（格式信息）","：15 位，编码纠错级别和 mask 编号，带 BCH 纠错。",[25,659,660,663,664,65],{},[58,661,662],{},"数据模块（data modules）","：真正承载内容的模块，",[58,665,666],{},"会被 mask 处理",[10,668,669,670,673,674,677],{},"本题二维码是 ",[58,671,672],{},"version 5 = 37×37 模块","。从 finder pattern 的 1:1:3:1:1 比例（24:24:72:24:24 像素）可算出",[58,675,676],{},"模块大小 = 24 像素","，1080÷24 = 45 模块 = 4（静区）+ 37（二维码）+ 4（静区）。",[229,679,681],{"id":680},"mask-pattern-原理核心","Mask Pattern 原理（核心）",[10,683,684,685,688,689,692,693,695,696,699],{},"QR 码编码时，为了防止出现大片同色区域影响识别，会用一种 ",[58,686,687],{},"mask（掩码）"," 对数据模块做异或，让黑白分布更均匀。标准定义了 ",[58,690,691],{},"8 种 mask","，公式如下（",[14,694,94],{"code":94}," 行、",[14,697,698],{"code":698},"j"," 列，从 0 起）：",[257,701,702,712],{},[260,703,704],{},[263,705,706,709],{},[266,707,708],{},"Mask",[266,710,711],{},"条件（满足则反转）",[279,713,714,724,734,744,758,768,778,788],{},[263,715,716,719],{},[284,717,718],{},"0",[284,720,721],{},[14,722,723],{"code":723},"(i + j) % 2 == 0",[263,725,726,729],{},[284,727,728],{},"1",[284,730,731],{},[14,732,733],{"code":733},"i % 2 == 0",[263,735,736,739],{},[284,737,738],{},"2",[284,740,741],{},[14,742,743],{"code":743},"j % 3 == 0",[263,745,746,751],{},[284,747,748],{},[58,749,750],{},"3",[284,752,753],{},[58,754,755],{},[14,756,757],{"code":757},"(i + j) % 3 == 0",[263,759,760,763],{},[284,761,762],{},"4",[284,764,765],{},[14,766,767],{"code":767},"(i\u002F\u002F2 + j\u002F\u002F3) % 2 == 0",[263,769,770,773],{},[284,771,772],{},"5",[284,774,775],{},[14,776,777],{"code":777},"(i*j) % 2 + (i*j) % 3 == 0",[263,779,780,783],{},[284,781,782],{},"6",[284,784,785],{},[14,786,787],{"code":787},"((i*j) % 2 + (i*j) % 3) % 2 == 0",[263,789,790,793],{},[284,791,792],{},"7",[284,794,795],{},[14,796,797],{"code":797},"((i+j) % 2 + (i*j) % 3) % 2 == 0",[10,799,800],{},"这道题有两层坑：",[202,802,803,818],{},[25,804,805,806,809,810,813,814,817],{},"读 format info 得到 ",[14,807,808],{"code":808},"0x662f","，BCH 解码后是 ",[58,811,812],{},"EC=L，mask=4","——这是",[58,815,816],{},"原始","二维码编码时用的 mask。",[25,819,820,821,399,824,826],{},"但出题人又",[58,822,823],{},"额外对数据模块叠加了一次 Mask 3",[14,825,219],{"code":219}," 的异或），这才是\"3号面具\"的真正含义。",[10,828,829,830,833],{},"所以要恢复：",[58,831,832],{},"只对数据模块","（跳过功能图形）再异或一次 Mask 3，剩下的交给标准解码器（它会自动用 format info 里的 mask 4 完成反转）。",[10,835,836,839],{},[58,837,838],{},"为什么必须\"只对数据模块\"？"," 如果对整个矩阵（包括 finder\u002Ftiming\u002Falignment\u002Fformat info）都做异或，会破坏定位图案和格式信息，解码器直接找不到二维码。功能图形永远不参与数据 mask，这是标准规定的。",[229,841,842],{"id":842},"解码核心逻辑",[110,844,847],{"className":845,"code":846,"language":142,"meta":118},[140],"def is_function(i, j, N=37):\n    # 三个角的 finder + separator + format info 区域（9x9）\n    if i \u003C= 8 and j \u003C= 8: return True\n    if i \u003C= 8 and j >= N-9: return True\n    if i >= N-9 and j \u003C= 8: return True\n    # timing pattern\n    if i == 6 or j == 6: return True\n    # alignment pattern（version5 中心 30,30，5x5）\n    if abs(i-30) \u003C= 2 and abs(j-30) \u003C= 2: return True\n    return False\n\nfor i in range(N):\n    for j in range(N):\n        if not is_function(i, j) and (i + j) % 3 == 0:\n            m[i, j] = 255 - m[i, j]   # 异或反转\n",[14,848,846],{"__ignoreMap":118},[10,850,851],{},"处理完放大交给 pyzbar 解码，直接得到结果。",[42,853],{},[45,855,856],{"id":856},"总结",[10,858,859],{},"这两道题串起来是一套很完整的流量分析 + 隐写思路：",[202,861,862,870,876,882],{},[25,863,864,447,867,869],{},[58,865,866],{},"隐写不一定在 payload 里",[14,868,124],{"code":124}," 这种协议头字段一样能藏数据。",[25,871,872,875],{},[58,873,874],{},"DNS 外带还原的关键是分清通道","：发往哪个 DNS 服务器、qname 后缀是什么，过滤错了数据就拼不起来。",[25,877,878,881],{},[58,879,880],{},"ZipCrypto 是流密码","，check byte 的取值规则跟文件头 flags 的 data descriptor 位有关。",[25,883,884,887],{},[58,885,886],{},"QR 的 mask 只作用于数据模块","：功能图形不能碰，否则解码器直接找不到码。",{"title":118,"searchDepth":889,"depth":889,"links":890},4,[891,897,915],{"id":47,"depth":892,"text":48,"children":893},2,[894,896],{"id":52,"depth":895,"text":53},3,{"id":98,"depth":895,"text":98},{"id":190,"depth":892,"text":191,"children":898},[899,900,905,909],{"id":197,"depth":895,"text":197},{"id":226,"depth":895,"text":227,"children":901},[902,903,904],{"id":231,"depth":889,"text":232},{"id":251,"depth":889,"text":252},{"id":384,"depth":889,"text":384},{"id":435,"depth":895,"text":436,"children":906},[907,908],{"id":439,"depth":889,"text":440},{"id":509,"depth":889,"text":509},{"id":583,"depth":895,"text":584,"children":910},[911,912,913,914],{"id":587,"depth":889,"text":587},{"id":615,"depth":889,"text":616},{"id":680,"depth":889,"text":681},{"id":842,"depth":889,"text":842},{"id":856,"depth":892,"text":856},[917],"未分类","2026-08-14","两道流量分析题：IP 标识字段隐写，以及 DNS 数据外带还原加密压缩包再破解 QR 码掩码",false,"md","\u002Fweek6-traffic-cover.jpg",{"category":924,"slots":925},"安全",{},true,"\u002F2026\u002Fweek6-traffic-analysis",null,{"text":930,"minutes":931,"time":932,"words":933},"12 min read",11.93,715800,2386,{"title":5,"description":919},{"loc":927},"posts\u002F2026\u002Fweek6-traffic-analysis",[],"tech","8uQuey_pyKr_Grki0C_bciqis58HRRw9n1UVKsWA9lo",[941,946],{"title":942,"path":943,"stem":944,"date":945,"type":938,"children":-1},"网鼎杯流量分析两道题WP","\u002F2026\u002Fwangdingcup-traffic-analysis","posts\u002F2026\u002Fwangdingcup-traffic-analysis","2026-08-10",{"title":947,"path":948,"stem":949,"date":950,"type":938,"children":-1},"栈溢出几道题","\u002F2026\u002Fweek7-stack-overflow","posts\u002F2026\u002Fweek7-stack-overflow","2026-08-22",1790348237538]