https://blog.wh1sper.com/posts/nctf2019_fakexml/