BUUCTF--[BJDCTF2020]JustRE

测试文件：https://www.lanzous.com/ib3dq9c

 

代码分析

 1 BOOL __stdcall DialogFunc(HWND hWnd, UINT a2, WPARAM a3, LPARAM a4)
 2 {
 3   CHAR String; // [esp+0h] [ebp-64h]
 4 
 5   if ( a2 != 272 )
 6   {
 7     if ( a2 != 273 )
 8       return 0;
 9     if ( (_WORD)a3 != 1 && (_WORD)a3 != 2 )
10     {
11       sprintf(&String, aD, ++dword_4099F0);
12       if ( dword_4099F0 == 19999 )
13       {
14         sprintf(&String, aBjdDD2069a4579, 19999, 0);
15         SetWindowTextA(hWnd, &String);
16         return 0;
17       }
18       SetWindowTextA(hWnd, &String);
19       return 0;
20     }
21     EndDialog(hWnd, (unsigned __int16)a3);
22   }
23   return 1;
24 }

第14行代码，sprintf补齐，很明显flag就是BJD{1999902069a45792d233ac}

 

get flag

flag{1999902069a45792d233ac}

 

posted @ 2020-04-07 19:34  Hk_Mayfly  阅读(960)  评论(2)  编辑  收藏  举报