VM Opcode for Reverse Engineering: Bytecode to Constraints

VM-based reversing challenges often reduce to a bytecode + dispatcher pair. The main task is to recover each opcode’s semantics and lift the bytecode into a form that exposes the verifier’s constraints.

This post uses a small stack VM to show the workflow from dispatcher analysis to direct inversion and SMT solving.

1. VM Skeleton

Many challenge VMs are stack-based. A program counter, stack pointer, condition flag, and small value stack are enough for the example below.

1
typedef struct {
2
    const uint8_t *code;
3
    const uint8_t *input;
4
    uint32_t pc;
5
    uint8_t sp;
6
    uint8_t flag;
7
    uint8_t stack[64];
8
} VM;
9

10
static uint8_t rol8(uint8_t v, unsigned r) {
11
    r &= 7u;
12
    return (uint8_t)((v << r) | (v >> ((8u - r) & 7u)));
13
}
14

15
static int vm_run(VM *vm) {
16
    for (;;) {
17
        uint8_t op = vm->code[vm->pc++];
18
        switch (op) {
19
        case 0x01: { // PUSH imm8
20
            vm->stack[vm->sp++] = vm->code[vm->pc++];
21
            break;
22
        }
23
        case 0x02: { // LOAD idx
24
            uint8_t idx = vm->code[vm->pc++];
25
            vm->stack[vm->sp++] = vm->input[idx];
26
            break;
27
        }
28
        case 0x10: { // XOR
29
            uint8_t b = vm->stack[--vm->sp];
30
            uint8_t a = vm->stack[vm->sp - 1];
31
            vm->stack[vm->sp - 1] = a ^ b;
32
            break;
33
        }
34
        case 0x11: { // ADD
35
            uint8_t b = vm->stack[--vm->sp];
36
            uint8_t a = vm->stack[vm->sp - 1];
37
            vm->stack[vm->sp - 1] = (uint8_t)(a + b);
38
            break;
39
        }
40
        case 0x12: { // ROL imm
41
            uint8_t r = vm->code[vm->pc++];
42
            vm->stack[vm->sp - 1] = rol8(vm->stack[vm->sp - 1], r);
43
            break;
44
        }
45
        case 0x20: { // CMP imm
46
            uint8_t v = vm->stack[--vm->sp];
47
            uint8_t imm = vm->code[vm->pc++];
48
            vm->flag = (v == imm);
49
            break;
50
        }
51
        case 0x30: { // JNZ rel8 (jump when flag == 0)
52
            int8_t off = (int8_t)vm->code[vm->pc++];
53
            if (!vm->flag) {
54
                vm->pc = (uint32_t)(vm->pc + off);
55
            }
56
            break;
57
        }
58
        case 0xFF: { // HALT imm
59
            uint8_t ret = vm->code[vm->pc++];
60
            return ret;
61
        }
62
        default:
63
            return 0;
64
        }
65
    }
66
}

When reversing this interpreter, I would establish the following details first.

Whether pc advances before or after each opcode and operand fetch.
Whether sp changes before or after each push and pop.
Whether the branch uses flag directly or tests an inverted condition.
Whether the JNZ operand is a signed relative offset or an absolute address.

Opcode Table

Recording the stack effect makes it much easier to derive expressions later. Let S denote the stack.

Opcode	Mnemonic	Stack Effect	Desc
`0x01`	`PUSH imm8`	`S -> S, imm`	Push an immediate byte
`0x02`	`LOAD idx`	`S -> S, input[idx]`	Push an input byte
`0x10`	`XOR`	`S, a, b -> S, (a ^ b)`	XOR
`0x11`	`ADD`	`S, a, b -> S, (a + b)`	mod 256
`0x12`	`ROL imm`	`S, a -> S, rol8(a, imm)`	rotate
`0x20`	`CMP imm`	`S, a -> S`	flag = (a == imm)
`0x30`	`JNZ rel8`	`S -> S`	Add `off` to `pc` when `flag == 0`
`0xFF`	`HALT imm`	`S -> S`	Return an immediate byte

Write down stack effects before translating instructions into formulas. In particular, determine whether CMP pops its operand or leaves it on the stack.

Dispatcher

I usually narrow down a VM interpreter in the following order.

Opcode fetch: find a loop that repeatedly performs something like op = code[pc++].
Switch or jump table: look for switch (op) or an indirect branch such as jmp [table + op*8].
Operand fetch: note which handlers read additional bytes with code[pc++]. These reads determine each instruction’s length.
Stack updates: use the positions of sp++ and --sp to fix the exact push and pop semantics.
Flag use: trace whether the result of CMP or TEST feeds a later JZ or JNZ handler.

An obfuscated VM may transform each fetched opcode with XOR or ADD, or decrypt the whole bytecode buffer at runtime. Keep the raw encoded byte separate from the decoded dispatch value. Per-opcode transforms usually appear directly before dispatch; whole-buffer decryption means the bytecode should be extracted after that routine runs.

Bytecode Extraction and Disassembly

Once the bytecode is dumped, the next step is a small disassembler. If the opcode lengths are known, a linear parser is enough for this VM.

1
op_info = {
2
    0x01: ("PUSH", 1),
3
    0x02: ("LOAD", 1),
4
    0x10: ("XOR", 0),
5
    0x11: ("ADD", 0),
6
    0x12: ("ROL", 1),
7
    0x20: ("CMP", 1),
8
    0x30: ("JNZ", 1),
9
    0xFF: ("HALT", 1),
10
}
11

12
def disasm(code):
13
    pc = 0
14
    out = []
15
    while pc < len(code):
16
        op = code[pc]
17
        name, imm_len = op_info.get(op, ("DB", 0))
18
        if name == "DB":
19
            out.append(f"{pc:02X}: DB 0x{op:02X}")
20
            pc += 1
21
            continue
22
        imm = None
23
        if imm_len:
24
            imm = code[pc + 1]
25
        if name == "JNZ":
26
            off = imm if imm < 0x80 else imm - 0x100
27
            tgt = (pc + 2 + off) & 0xFFFFFFFF
28
            out.append(f"{pc:02X}: JNZ {off:+#x} ; -> {tgt:02X}")
29
        elif imm_len:
30
            out.append(f"{pc:02X}: {name} 0x{imm:02X}")
31
        else:
32
            out.append(f"{pc:02X}: {name}")
33
        pc += 1 + imm_len
34
    return out

JNZ rel8 is relative to the program counter after the operand has been read. The one-byte operand is sign-extended before it is added. Using the instruction start or treating the offset as unsigned shifts every branch target.

\text{target} = \text{pc}_{after} + \text{sign\_extend}(off)

2. Bytecode Example

This bytecode verifies an 8-byte input. Every input byte passes through the same instruction pattern, so a correct disassembly exposes the constraints immediately.

1
static const uint8_t program[] = {
2
    0x02, 0x00, 0x01, 0x13, 0x10, 0x01, 0x05, 0x11, 0x12, 0x01, 0x20, 0xEE, 0x30, 0x64,
3
    0x02, 0x01, 0x01, 0x57, 0x10, 0x01, 0x11, 0x11, 0x12, 0x01, 0x20, 0x94, 0x30, 0x56,
4
    0x02, 0x02, 0x01, 0x9B, 0x10, 0x01, 0x1F, 0x11, 0x12, 0x01, 0x20, 0x3C, 0x30, 0x48,
5
    0x02, 0x03, 0x01, 0xDF, 0x10, 0x01, 0x2A, 0x11, 0x12, 0x01, 0x20, 0xAD, 0x30, 0x3A,
6
    0x02, 0x04, 0x01, 0x22, 0x10, 0x01, 0x07, 0x11, 0x12, 0x01, 0x20, 0xA8, 0x30, 0x2C,
7
    0x02, 0x05, 0x01, 0x68, 0x10, 0x01, 0x19, 0x11, 0x12, 0x01, 0x20, 0x62, 0x30, 0x1E,
8
    0x02, 0x06, 0x01, 0xA1, 0x10, 0x01, 0x2D, 0x11, 0x12, 0x01, 0x20, 0x06, 0x30, 0x10,
9
    0x02, 0x07, 0x01, 0x3C, 0x10, 0x01, 0x3B, 0x11, 0x12, 0x01, 0x20, 0x1B, 0x30, 0x02,
10
    0xFF, 0x01, 0xFF, 0x00
11
};

The disassembly repeats the following block.

1
00: LOAD 0
2
02: PUSH 0x13
3
04: XOR
4
05: PUSH 0x05
5
07: ADD
6
08: ROL 1
7
0A: CMP 0xEE
8
0C: JNZ +0x64
9
(repeated)
10
70: HALT 1
11
72: HALT 0

Each block is 14 bytes long.

The first JNZ offset is 0x72 - 0x0E = 0x64.
The failure address is 0x72, where HALT 0 begins.
The success address is 0x70, where HALT 1 begins.

Deriving the Constraints

Because every block has the same shape, it is enough to lift one block. Tracking the stack after each instruction gives the expression directly.

1
LOAD i           -> [x_i]
2
PUSH k[i]        -> [x_i, k_i]
3
XOR              -> [x_i ^ k_i]
4
PUSH c[i]        -> [x_i ^ k_i, c_i]
5
ADD              -> [(x_i ^ k_i) + c_i]
6
ROL 1            -> [rol8((x_i ^ k_i) + c_i, 1)]
7
CMP t[i]         -> flag = (top == t_i), stack pop
8
JNZ fail         -> if flag == 0, jump to fail

y_i = \text{rol}_8((x_i \oplus k_i) + c_i, 1)

y_i = t_i

Here, $x_i$ is an input byte, $k_i$ is the XOR key, $c_i$ is the addition constant, and $t_i$ is the comparison target. Every arithmetic result is truncated to 8 bits.

Reversing the operations in the opposite order gives:

x_i = \left(\left(\operatorname{ror}_8(t_i, 1) - c_i\right) \bmod 256\right) \oplus k_i

The constants extracted from the VM are:

1
k = [0x13, 0x57, 0x9B, 0xDF, 0x22, 0x68, 0xA1, 0x3C]
2
c = [0x05, 0x11, 0x1F, 0x2A, 0x07, 0x19, 0x2D, 0x3B]
3
t = [0xEE, 0x94, 0x3C, 0xAD, 0xA8, 0x62, 0x06, 0x1B]

Real challenge VMs may mix ROL and ROR, reorder the addition, or move values between stacks and registers. The workflow is still the same: recover one handler at a time, record its state effect, and lift one repeated block before generalizing it.

3. Solving

Direct

1
def ror8(v, r):
2
    return ((v >> r) | (v << (8 - r))) & 0xFF
3

4
keys = [0x13, 0x57, 0x9B, 0xDF, 0x22, 0x68, 0xA1, 0x3C]
5
adds = [0x05, 0x11, 0x1F, 0x2A, 0x07, 0x19, 0x2D, 0x3B]
6
targets = [0xEE, 0x94, 0x3C, 0xAD, 0xA8, 0x62, 0x06, 0x1B]
7

8
out = []
9
for i in range(8):
10
    v = ror8(targets[i], 1)
11
    v = (v - adds[i]) & 0xFF
12
    v = v ^ keys[i]
13
    out.append(v)
14

15
print(bytes(out))

The eight constraints are independent, so direct inversion is the simplest solution. It is deterministic, easy to audit, and avoids introducing a solver when no variables depend on one another.

The script recovers b'andsopwn'. Replay those bytes through the original VM as a final check; a correct-looking inverse is not enough if an opcode, width, or truncation point was transcribed incorrectly.

SMT

SMT becomes useful when instructions mix several input bytes, share state across blocks, or constrain a path through control flow. The same lifted expression can be modeled with 8-bit bit-vectors.

1
from z3 import *
2

3
def rol8(v, r):
4
    return ((v << r) | LShR(v, 8 - r)) & 0xFF
5

6
keys = [0x13, 0x57, 0x9B, 0xDF, 0x22, 0x68, 0xA1, 0x3C]
7
adds = [0x05, 0x11, 0x1F, 0x2A, 0x07, 0x19, 0x2D, 0x3B]
8
targets = [0xEE, 0x94, 0x3C, 0xAD, 0xA8, 0x62, 0x06, 0x1B]
9

10
x = [BitVec(f"x{i}", 8) for i in range(8)]
11
s = Solver()
12

13
for i in range(8):
14
    expr = rol8((x[i] ^ keys[i]) + adds[i], 1)
15
    s.add(expr == targets[i])
16

17
if s.check() == sat:
18
    m = s.model()
19
    ans = bytes([m[x[i]].as_long() for i in range(8)])
20
    print(ans)

Here, sat only proves that the translated constraints have a model. It does not prove that the translation matches the binary or that the model is unique. Run the candidate through the original interpreter and, when uniqueness matters, add a blocking constraint and ask for a second model.

Small semantic differences can change the entire solution path. I would keep the following checklist nearby.

Treat a JNZ rel8 operand as signed unless the handler proves otherwise. An int8_t cast is a strong clue.
Fix the PC base precisely. Relative offsets are often measured from the PC after the operand fetch.
Fix the stack and register widths. Confusing uint8_t with uint32_t changes overflow behavior.
Check whether CMP pops its operand. The stack expression changes if the value remains live.
Look for XOR or ADD opcode decoding, or a buffer-decryption loop, before the dispatcher.
When a pattern repeats, lift one block and apply the resulting expression to the rest.

4. Practice

✨ Free Challenge Download ✨

1
#include <stdint.h>
2
#include <stdio.h>
3

4
static uint8_t ror8(uint8_t v, unsigned r) {
5
    return (uint8_t)((v >> r) | (v << (8 - r)));
6
}
7

8
static int run_vm(const uint8_t *code, size_t code_len, uint8_t *out, size_t out_cap, size_t *out_len) {
9
    uint8_t stack[64];
10
    size_t sp = 0;
11
    size_t pc = 0;
12
    size_t out_idx = 0;
13

14
    while (pc < code_len) {
15
        uint8_t op = code[pc++];
16
        switch (op) {
17
        case 0xA1: { // PUSH imm8
18
            if (pc >= code_len || sp >= sizeof(stack)) {
19
                return 0;
20
            }
21
            stack[sp++] = code[pc++];
22
            break;
23
        }
24
        case 0xB2: { // ADD imm8
25
            if (pc >= code_len || sp == 0) {
26
                return 0;
27
            }
28
            uint8_t imm = code[pc++];
29
            stack[sp - 1] = (uint8_t)(stack[sp - 1] + imm);
30
            break;
31
        }
32
        case 0xC3: { // XOR imm8
33
            if (pc >= code_len || sp == 0) {
34
                return 0;
35
            }
36
            uint8_t imm = code[pc++];
37
            stack[sp - 1] ^= imm;
38
            break;
39
        }
40
        case 0xD4: { // ROR imm8
41
            if (pc >= code_len || sp == 0) {
42
                return 0;
43
            }
44
            uint8_t imm = code[pc++];
45
            stack[sp - 1] = ror8(stack[sp - 1], imm & 7u);
46
            break;
47
        }
48
        case 0xE5: { // OUT
49
            if (sp == 0 || out_idx >= out_cap) {
50
                return 0;
51
            }
52
            out[out_idx++] = stack[--sp];
53
            break;
54
        }
55
        case 0xF6: { // HALT
56
            *out_len = out_idx;
57
            return 1;
58
        }
59
        default:
60
            return 0;
61
        }
62
    }
63

64
    return 0;
65
}
66

67
int main(int argc, char **argv) {
68
    (void)argc;
69
    (void)argv;
70
    static const uint8_t program[] = {
71
        0xA1, 0xA7, 0xB2, 0x3A, 0xC3, 0x05, 0xD4, 0x01, 0xE5,
72
        0xA1, 0x02, 0xB2, 0x7F, 0xC3, 0x2D, 0xD4, 0x05, 0xE5,
73
        0xA1, 0xB0, 0xB2, 0x12, 0xC3, 0x71, 0xD4, 0x03, 0xE5,
74
        0xA1, 0x3D, 0xB2, 0xC6, 0xC3, 0x13, 0xD4, 0x07, 0xE5,
75
        0xA1, 0xDB, 0xB2, 0x9D, 0xC3, 0xA9, 0xD4, 0x02, 0xE5,
76
        0xA1, 0x96, 0xB2, 0x21, 0xC3, 0x6C, 0xD4, 0x06, 0xE5,
77
        0xA1, 0x55, 0xB2, 0xB8, 0xC3, 0x0F, 0xD4, 0x04, 0xE5,
78
        0xA1, 0xE8, 0xB2, 0x4E, 0xC3, 0xD2, 0xD4, 0x01, 0xE5,
79
        0xA1, 0x95, 0xB2, 0x3A, 0xC3, 0x05, 0xD4, 0x01, 0xE5,
80
        0xA1, 0xC2, 0xB2, 0x7F, 0xC3, 0x2D, 0xD4, 0x05, 0xE5,
81
        0xA1, 0xF8, 0xB2, 0x12, 0xC3, 0x71, 0xD4, 0x03, 0xE5,
82
        0xA1, 0x62, 0xB2, 0xC6, 0xC3, 0x13, 0xD4, 0x07, 0xE5,
83
        0xA1, 0x9F, 0xB2, 0x9D, 0xC3, 0xA9, 0xD4, 0x02, 0xE5,
84
        0xA1, 0xCF, 0xB2, 0x21, 0xC3, 0x6C, 0xD4, 0x06, 0xE5,
85
        0xA1, 0x55, 0xB2, 0xB8, 0xC3, 0x0F, 0xD4, 0x04, 0xE5,
86
        0xA1, 0xD0, 0xB2, 0x4E, 0xC3, 0xD2, 0xD4, 0x01, 0xE5,
87
        0xA1, 0xA3, 0xB2, 0x3A, 0xC3, 0x05, 0xD4, 0x01, 0xE5,
88
        0xA1, 0x82, 0xB2, 0x7F, 0xC3, 0x2D, 0xD4, 0x05, 0xE5,
89
        0xA1, 0x38, 0xB2, 0x12, 0xC3, 0x71, 0xD4, 0x03, 0xE5,
90
        0xA1, 0xBD, 0xB2, 0xC6, 0xC3, 0x13, 0xD4, 0x07, 0xE5,
91
        0xF6
92
    };
93

94
    uint8_t out[256];
95
    size_t out_len = 0;
96
    int ok = run_vm(program, sizeof(program), out, sizeof(out), &out_len);
97

98
    if (!ok) {
99
        return 1;
100
    }
101

102
    fwrite(out, 1, out_len, stdout);
103
    fputc('\n', stdout);
104
    return 0;
105
}

This VM has the following instruction set.

Opcode	Mnemonic	Stack Effect	Desc
`0xA1`	`PUSH imm8`	`S -> S, imm`	Push an immediate byte
`0xB2`	`ADD imm8`	`S, a -> S, (a + imm)`	mod 256
`0xC3`	`XOR imm8`	`S, a -> S, (a ^ imm)`	XOR
`0xD4`	`ROR imm8`	`S, a -> S, ror8(a, imm)`	rotate
`0xE5`	`OUT`	`S, a -> S`	Append to the output buffer
`0xF6`	`HALT`	`S -> S`	Stop execution

The bytecode repeats this pattern.

1
PUSH e_i
2
ADD k_i
3
XOR a_i
4
ROR r_i
5
OUT

y_i = \text{ror}_8(((e_i + k_i) \bmod 256) \oplus a_i, r_i)

Each $e_i$ was chosen so that $y_i$ becomes one byte of the hint string. Solving the expression for $e_i$ gives:

e_i = (\text{rol}_8(y_i, r_i) \oplus a_i) - k_i \pmod{256}

The flag file contains bytecode in which these $e_i$ values are interleaved with the opcodes.

1
A1 8D B2 3A C3 05 D4 01 E5 A1 61 B2 7F C3 2D D4
2
05 E5 A1 40 B2 12 C3 71 D4 03 E5 A1 E4 B2 C6 C3
3
13 D4 07 E5 A1 77 B2 9D C3 A9 D4 02 E5 A1 91 B2
4
21 C3 6C D4 06 E5 A1 11 B2 B8 C3 0F D4 04 E5 A1
5
C2 B2 4E C3 D2 D4 01 E5 A1 89 B2 3A C3 05 D4 01
6
E5 A1 E4 B2 7F C3 2D D4 05 E5 A1 F8 B2 12 C3 71
7
D4 03 E5 A1 E1 B2 C6 C3 13 D4 07 E5 A1 AB B2 9D
8
C3 A9 D4 02 E5 A1 9A B2 21 C3 6C D4 06 E5 A1 B1
9
B2 B8 C3 0F D4 04 E5 A1 6C B2 4E C3 D2 D4 01 E5
10
A1 2D B2 3A C3 05 D4 01 E5 A1 8C B2 7F C3 2D D4
11
05 E5 A1 C6 B2 12 C3 71 D4 03 E5 A1 F6 B2 C6 C3
12
13 D4 07 E5 A1 DC B2 9D C3 A9 D4 02 E5 A1 8F B2
13
21 C3 6C D4 06 E5 A1 11 B2 B8 C3 0F D4 04 E5 A1
14
66 B2 4E C3 D2 D4 01 E5 A1 29 B2 3A C3 05 D4 01
15
E5 A1 A4 B2 7F C3 2D D4 05 E5 A1 79 B2 12 C3 71
16
D4 03 E5 A1 E2 B2 C6 C3 13 D4 07 E5 A1 D0 B2 9D
17
C3 A9 D4 02 E5 A1 80 B2 21 C3 6C D4 06 E5 A1 D1
18
B2 B8 C3 0F D4 04 E5 A1 1E B2 4E C3 D2 D4 01 E5
19
A1 3D B2 3A C3 05 D4 01 E5 A1 A1 B2 7F C3 2D D4
20
05 E5 A1 DE B2 12 C3 71 D4 03 E5 A1 E4 B2 C6 C3
21
13 D4 07 E5 A1 DB B2 9D C3 A9 D4 02 E5 A1 9A B2
22
21 C3 6C D4 06 E5 A1 C0 B2 B8 C3 0F D4 04 E5 A1
23
B4 B2 4E C3 D2 D4 01 E5 A1 2D B2 3A C3 05 D4 01
24
E5 A1 0C B2 7F C3 2D D4 05 E5 A1 E0 B2 12 C3 71
25
D4 03 E5 A1 C4 B2 C6 C3 13 D4 07 E5 A1 9F B2 9D
26
C3 A9 D4 02 E5 A1 CF B2 21 C3 6C D4 06 E5 A1 42
27
B2 B8 C3 0F D4 04 E5 A1 F0 B2 4E C3 D2 D4 01 E5
28
A1 A5 B2 3A C3 05 D4 01 E5 A1 03 B2 7F C3 2D D4
29
05 E5 F6

Because every bytecode block has the same fixed shape, we can parse $e_i$ , $k_i$ , $a_i$ , and $r_i$ directly.

y_i = \text{ror}_8(((e_i + k_i) \bmod 256) \oplus a_i, r_i)

1
from pathlib import Path
2

3
def ror8(v, r):
4
    return ((v >> r) | (v << (8 - r))) & 0xFF
5

6

7
def load_bytecode(path):
8
    data = path.read_text().strip().split()
9
    if not data:
10
        return []
11
    return [int(tok, 16) for tok in data]
12

13

14
def parse_blocks(code):
15
    blocks = []
16
    pc = 0
17

18
    while pc < len(code):
19
        op = code[pc]
20
        if op == 0xF6:
21
            return blocks
22

23
        if pc + 8 >= len(code):
24
            raise ValueError("truncated block")
25

26
        if code[pc] != 0xA1 or code[pc + 2] != 0xB2 or code[pc + 4] != 0xC3:
27
            raise ValueError(f"unexpected opcode sequence at {pc:04X}")
28
        if code[pc + 6] != 0xD4 or code[pc + 8] != 0xE5:
29
            raise ValueError(f"unexpected opcode sequence at {pc:04X}")
30

31
        e = code[pc + 1]
32
        k = code[pc + 3]
33
        a = code[pc + 5]
34
        r = code[pc + 7]
35
        blocks.append((e, k, a, r))
36
        pc += 9
37

38
    raise ValueError("missing HALT")
39

40

41
def recover_output(blocks):
42
    out = []
43
    for e, k, a, r in blocks:
44
        v = (e + k) & 0xFF
45
        v ^= a
46
        v = ror8(v, r)
47
        out.append(v)
48
    return bytes(out)
49

50

51
def main():
52
    bytecode_path = Path(__file__).with_name("flag")
53
    code = load_bytecode(bytecode_path)
54
    blocks = parse_blocks(code)
55
    output = recover_output(blocks)
56
    print(output.decode("ascii"))
57

58

59
if __name__ == "__main__":
60
    main()

parse_blocks also validates the instruction sequence and rejects truncated data. This prevents a single wrong opcode length from silently desynchronizing the rest of the bytecode.

Top 3 Solver (Discord @badabodaa)

1
@lacroix RubiyaLab 2025.12.31
2
@Gunter RubiyaLab 2025.12.31
3
@minzu RubiyaLab 2025.12.31