I'm sorry my English is not enough to use English to describe the details. Writeup will try my best to use standard Chinese which is easy to translate.

https://lorexxar.cn/2017/11/15/hctf2017-babycrack/