from Crypto.Util.number import *
c = 17267007548350134211446534538562532393987607956398472220551618753087082023879735062442545398431870403872077195818978989886709629866990217347439170223507808164879731729759157752461662209938291986405423704335805393839979165773499714878470151278415094133786535946476503084049717463486099847254665931743627071610
d = 15752258185352337654082846377897348689758687031968786034503680876894166455217514255597901688908424136052403746641807704787562349822148913951970347309546537765183467045213301168433455090131147662630933001405065553783578099091001885819766898162581045129599564003306979636805994413087552852437577804628737608073
def recover_n_from_ed(e, d, B=5000):
# φ(n) 至少应该是 1023~1024 bit,可以做一些粗略过滤
if phi.bit_length() < 1000:
# 在 sqrt(phi) 附近找因子 a ≈ p-1
for delta in range(-B, B + 1):
# 粗略过滤:p,q bit 长度应该接近 512
if not (510 <= p.bit_length() <= 514):
if not (510 <= q.bit_length() <= 514):
if not isPrime(p) or not isPrime(q):
# 检查 q 确实是 next_prime(p)
return None, None, None, None, None
n, p, q, k, phi = recover_n_from_ed(e, d, B)
print("[-] 没找到合适的 n,可以考虑增大 B 或检查 d/e 是否正确。")