BUUCTF_Re_不一样的flag
无壳,ida伪代码:
int __cdecl __noreturn main(int argc, const char **argv, const char **envp) { char v3[29]; // [esp+17h] [ebp-35h] BYREF int v4; // [esp+34h] [ebp-18h] int v5; // [esp+38h] [ebp-14h] BYREF int i; // [esp+3Ch] [ebp-10h] char v7[12]; // [esp+40h] [ebp-Ch] BYREF __main(); v4 = 0; strcpy(v3, "*11110100001010000101111#"); while ( 1 ) { puts("you can choose one action to execute"); puts("1 up"); puts("2 down"); puts("3 left"); printf("4 right\n:"); scanf("%d", &v5); if ( v5 == 2 ) { ++*(_DWORD *)&v3[25]; } else if ( v5 > 2 ) { if ( v5 == 3 ) { --v4; } else { if ( v5 != 4 ) LABEL_13: exit(1); ++v4; } } else { if ( v5 != 1 ) goto LABEL_13; --*(_DWORD *)&v3[25]; } for ( i = 0; i <= 1; ++i ) { if ( *(int *)&v3[4 * i + 25] < 0 || *(int *)&v3[4 * i + 25] > 4 ) exit(1); } if ( v7[5 * *(_DWORD *)&v3[25] - 41 + v4] == 49 ) exit(1); if ( v7[5 * *(_DWORD *)&v3[25] - 41 + v4] == 35 ) { puts("\nok, the order you enter is the flag!"); exit(0); } } }
看到v3这个奇怪的字符,一共25位,然后有上下左右,
我一直在分析代码,然后想着怎么写脚本,结果,一看
5x5的迷宫,把v3分解成迷宫的样子:
*1111
01000
01010
00010
1111#
#号就是终点,*号就是起点
最后把路径转换成数字就是flag:
flag{222441144222}