查壳:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230505161047351-1752717521.png)
不赘述了:64位进IDA老思想进主函数:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230505161528733-1714459953.png)
对输入flag进行一个方法加密sub_4009AE:跟进:
![](https://img2023.cnblogs.com/blog/3074711/202305/3074711-20230505161627134-1055442595.png)
上个脚本先:
int main(){
string flag = "";
flag += 166163712 / 1629056;
flag += 731332800 / 6771600;
flag += 357245568 / 3682944;
flag += 1074393000 / 10431000;
flag += 489211344 / 3977328;
flag += 518971936 / 5138336;
flag += 406741500 / 7532250;
flag += 294236496 / 5551632;
flag += 177305856 / 3409728;
flag += 650683500 / 13013670;
flag += 298351053 / 6088797;
flag += 386348487 / 7884663;
flag += 438258597 / 8944053;
flag += 249527520 / 5198490;
flag += 445362764 / 4544518;
flag += 981182160 / 10115280;
flag += 174988800 / 3645600;
flag += 493042704 / 9667504;
flag += 257493600 / 5364450;
flag += 767478780 / 13464540;
flag += 312840624 / 5488432;
flag += 1404511500 / 14479500;
flag += 316139670 / 6451830;
flag += 619005024 / 6252576;
flag += 372641472 / 7763364;
flag += 373693320 / 7327320;
flag += 498266640 / 8741520;
flag += 452465676 / 8871876;
flag += 208422720 / 4086720;
flag += 515592000 / 9374400;
flag += 719890500 / 5759124;
cout << flag << endl;
return 0;
}
得到flag{e65421110ba03099a1c039337},前边我们说到会有缺失,在哪呢,就是e后边那有一个字符没有,没办法咯爆破,一个个试
最后flag{e165421110ba03099a1c039337}收工。