diff --git a/xiaosai/ecb_padding/crack.py b/xiaosai/ecb_padding/crack.py
index cd09a65..85a3702 100644
--- a/xiaosai/ecb_padding/crack.py
+++ b/xiaosai/ecb_padding/crack.py
@@ -5,7 +5,7 @@ first_flag = b''
 wordlist = b'0123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM{}_'
 for i in range(16):
     for j in wordlist:
-        r = remote("172.20.14.117", 65311)
+        r = remote("172.20.14.117", 59250)
         payload = b'0'*(16-5) + b'0' * (15 - i)\
             + first_flag + j.to_bytes() + \
             b'0' * (15 - i)
@@ -20,7 +20,7 @@ for i in range(16):
 last_flag = b''
 for i in range(21-16):
     for j in wordlist:
-        r = remote("172.20.14.117", 65311)
+        r = remote("172.20.14.117", 59250)
         payload = b'0' * 11 +  j.to_bytes() + \
             last_flag + b'0' * 27
         r.sendline(payload)
@@ -31,4 +31,4 @@ for i in range(21-16):
             last_flag = j.to_bytes() + last_flag
             break            
 
-print(first_flag + last_flag)
\ No newline at end of file
+print(first_flag + last_flag)
diff --git a/xiaosai/factor_2048bits/crack.sage b/xiaosai/factor_2048bits/crack.sage
new file mode 100644
index 0000000..8969c75
--- /dev/null
+++ b/xiaosai/factor_2048bits/crack.sage
@@ -0,0 +1,15 @@
+hint = 170021659067442061523756541191993539248601165314725269340063885026090819928194021233489114706002869522375199940625136026822330472394573193982550217044532146962203411567638298486561460035048451998397915884861905155825573014911356931040204843324084786281107112092211904426426572148513199575481399847133231710208
+n =  26572534665683235245636883276068606612246011683144885473463339711820331993493357279285848391008791322234296406608539840620252625886064149394162998948970494176467317183311068211754639508369506106626167584042532674048767021259563143175030276397301094824563794971045331643148544039656526615133318494601670688100830427083371422333448416345157657081894568628680132969792458721329931299527818220689347292610785587787837487603664368727957712489422350366840751269348100479824826707549651813948243868760028344290958809882314383956517334878930614926458454637703779278161529934602431923391507121553686269628353968327172758558101
+cipher =  6757305476823187630788813544175078002034639295382430908622959031152682951668576844271799811383004513343837564381952708716729553254090143798506889925295074373036913929804491380602451212049174613264171604463300669869149837525862922090696673791849544763152707468306110063163234629066598567091839169641464962113876354673950799668460699078314705550375034690000052853842247971910604379818131880965835942702654798359475442300498917978942357402126717495842970216610908374556549274105304987976888600967085331993375097585293113427600688155704013684617306744103329525203776458981287207246516848585805560812026318668317699834254
+def phase3(high_p, n):
+    R.<x> = PolynomialRing(Zmod(n), implementation='NTL')
+    p = high_p + x
+    x0 = p.small_roots(X = 2^256, beta = 0.1)[0]
+    
+    P = int(p(x0))
+    Q = n // P
+    assert n == P*Q
+    return P, Q
+
+p, q = phase3(hint, n)
+print(p, q)
\ No newline at end of file
diff --git a/xiaosai/factor_2048bits/main.py b/xiaosai/factor_2048bits/main.py
index 384d0c6..a0da652 100644
--- a/xiaosai/factor_2048bits/main.py
+++ b/xiaosai/factor_2048bits/main.py
@@ -9,11 +9,12 @@ n = p * q
 e = 65537
 message = bytes_to_long(flag)
 cipher = pow(message, e, n)
-print(p)
-print(q)
+hint = (p >> 256) << 256
+print('hint =', hint)
 print('n = ', n)
 print('cipher = ', cipher)
 '''
+hint = 170021659067442061523756541191993539248601165314725269340063885026090819928194021233489114706002869522375199940625136026822330472394573193982550217044532146962203411567638298486561460035048451998397915884861905155825573014911356931040204843324084786281107112092211904426426572148513199575481399847133231710208
 n =  26572534665683235245636883276068606612246011683144885473463339711820331993493357279285848391008791322234296406608539840620252625886064149394162998948970494176467317183311068211754639508369506106626167584042532674048767021259563143175030276397301094824563794971045331643148544039656526615133318494601670688100830427083371422333448416345157657081894568628680132969792458721329931299527818220689347292610785587787837487603664368727957712489422350366840751269348100479824826707549651813948243868760028344290958809882314383956517334878930614926458454637703779278161529934602431923391507121553686269628353968327172758558101
 cipher =  6757305476823187630788813544175078002034639295382430908622959031152682951668576844271799811383004513343837564381952708716729553254090143798506889925295074373036913929804491380602451212049174613264171604463300669869149837525862922090696673791849544763152707468306110063163234629066598567091839169641464962113876354673950799668460699078314705550375034690000052853842247971910604379818131880965835942702654798359475442300498917978942357402126717495842970216610908374556549274105304987976888600967085331993375097585293113427600688155704013684617306744103329525203776458981287207246516848585805560812026318668317699834254
 '''
\ No newline at end of file