游戏过关
拖到ida里,找到main函数
对代码分析一下,让我们把八个灯点亮才能得到flag,进入最后一个函数sub_457AB4()看一下
int __cdecl main_0(int argc, const char **argv, const char **envp)
{
char v4; // [esp+0h] [ebp-FCh]
char v5; // [esp+0h] [ebp-FCh]
char v6; // [esp+0h] [ebp-FCh]
char v7; // [esp+0h] [ebp-FCh]
char v8; // [esp+0h] [ebp-FCh]
char v9; // [esp+0h] [ebp-FCh]
char v10; // [esp+0h] [ebp-FCh]
char v11; // [esp+0h] [ebp-FCh]
char v12; // [esp+0h] [ebp-FCh]
char v13; // [esp+0h] [ebp-FCh]
char v14; // [esp+0h] [ebp-FCh]
char v15; // [esp+0h] [ebp-FCh]
char v16; // [esp+0h] [ebp-FCh]
char v17; // [esp+0h] [ebp-FCh]
char v18; // [esp+0h] [ebp-FCh]
char v19; // [esp+0h] [ebp-FCh]
char v20; // [esp+0h] [ebp-FCh]
char v21; // [esp+0h] [ebp-FCh]
char v22; // [esp+0h] [ebp-FCh]
char v23; // [esp+0h] [ebp-FCh]
int i; // [esp+DCh] [ebp-20h]
unsigned int v25; // [esp+F4h] [ebp-8h] BYREF
sub_45A7BE((int)&unk_50B110, v4);
sub_45A7BE((int)&unk_50B158, v5);
sub_45A7BE((int)&unk_50B1A0, v6);
sub_45A7BE((int)&unk_50B1E8, v7);
sub_45A7BE((int)&unk_50B230, v8);
sub_45A7BE((int)&unk_50B278, v9);
sub_45A7BE((int)&unk_50B2C0, v10);
sub_45A7BE((int)&unk_50B308, v11);
sub_45A7BE((int)&unk_50AFD0, v12);
sub_45A7BE((int)"| by 0x61 |\n", v13);
sub_45A7BE((int)"| |\n", v14);
sub_45A7BE((int)"|------------------------------------------------------|\n", v15);
sub_45A7BE(
(int)"Play a game\n"
"The n is the serial number of the lamp,and m is the state of the lamp\n"
"If m of the Nth lamp is 1,it's on ,if not it's off\n"
"At first all the lights were closed\n",
v16);
sub_45A7BE((int)"Now you can input n to change its state\n", v17);
sub_45A7BE(
(int)"But you should pay attention to one thing,if you change the state of the Nth lamp,the state of (N-1)th and (N+1"
")th will be changed too\n",
v18);
sub_45A7BE((int)"When all lamps are on,flag will appear\n", v19);
sub_45A7BE((int)"Now,input n \n", v20);
while ( 1 )
{
do
{
while ( 1 )
{
sub_45A7BE((int)"input n,n(1-8)\n", v21);
sub_459418();
sub_45A7BE((int)"n=", v22);
sub_4596D4("%d", &v25);
sub_45A7BE((int)"\n", v23);
if ( v25 < 9 )
break;
sub_45A7BE((int)"sorry,n error,try again\n", v21);
}
if ( v25 )
{
sub_4576D6(v25 - 1);
}
else
{
for ( i = 0; i < 8; ++i )
{
if ( (unsigned int)i >= 9 )
j____report_rangecheckfailure();
byte_532E28[i] = 0;
}
}
j__system("CLS");
sub_458054();
}
while ( byte_532E28[0] != 1
|| byte_532E28[1] != 1
|| byte_532E28[2] != 1
|| byte_532E28[3] != 1
|| byte_532E28[4] != 1
|| byte_532E28[5] != 1
|| byte_532E28[6] != 1
|| byte_532E28[7] != 1 );
sub_457AB4();
}
}
这是对flag的操作
int sub_45E940()
{
char v1; // [esp+0h] [ebp-164h]
int i; // [esp+D0h] [ebp-94h]
char v3[22]; // [esp+DCh] [ebp-88h] BYREF
char v4[32]; // [esp+F2h] [ebp-72h] BYREF
char v5[4]; // [esp+112h] [ebp-52h] BYREF
char v6[64]; // [esp+120h] [ebp-44h]
sub_45A7BE((int)"done!!! the flag is ", v1);
v6[0] = 18;
v6[1] = 64;
v6[2] = 98;
v6[3] = 5;
v6[4] = 2;
v6[5] = 4;
v6[6] = 6;
v6[7] = 3;
v6[8] = 6;
v6[9] = 48;
v6[10] = 49;
v6[11] = 65;
v6[12] = 32;
v6[13] = 12;
v6[14] = 48;
v6[15] = 65;
v6[16] = 31;
v6[17] = 78;
v6[18] = 62;
v6[19] = 32;
v6[20] = 49;
v6[21] = 32;
v6[22] = 1;
v6[23] = 57;
v6[24] = 96;
v6[25] = 3;
v6[26] = 21;
v6[27] = 9;
v6[28] = 4;
v6[29] = 62;
v6[30] = 3;
v6[31] = 5;
v6[32] = 4;
v6[33] = 1;
v6[34] = 2;
v6[35] = 3;
v6[36] = 44;
v6[37] = 65;
v6[38] = 78;
v6[39] = 32;
v6[40] = 16;
v6[41] = 97;
v6[42] = 54;
v6[43] = 16;
v6[44] = 44;
v6[45] = 52;
v6[46] = 32;
v6[47] = 64;
v6[48] = 89;
v6[49] = 45;
v6[50] = 32;
v6[51] = 65;
v6[52] = 15;
v6[53] = 34;
v6[54] = 18;
v6[55] = 16;
v6[56] = 0;
qmemcpy(v3, "{ ", 2);
v3[2] = 18;
v3[3] = 98;
v3[4] = 119;
v3[5] = 108;
v3[6] = 65;
v3[7] = 41;
v3[8] = 124;
v3[9] = 80;
v3[10] = 125;
v3[11] = 38;
v3[12] = 124;
v3[13] = 111;
v3[14] = 74;
v3[15] = 49;
v3[16] = 83;
v3[17] = 108;
v3[18] = 94;
v3[19] = 108;
v3[20] = 84;
v3[21] = 6;
qmemcpy(v4, "`S,yhn _uec{", 12);
v4[12] = 127;
v4[13] = 119;
v4[14] = 96;
v4[15] = 48;
v4[16] = 107;
v4[17] = 71;
v4[18] = 92;
v4[19] = 29;
v4[20] = 81;
v4[21] = 107;
v4[22] = 90;
v4[23] = 85;
v4[24] = 64;
v4[25] = 12;
v4[26] = 43;
v4[27] = 76;
v4[28] = 86;
v4[29] = 13;
v4[30] = 114;
v4[31] = 1;
strcpy(v5, "u~");
for ( i = 0; i < 56; ++i )
{
v3[i] ^= v6[i];
v3[i] ^= 19u;
}
return sub_45A7BE((int)"%s\n", (char)v3);
}
for循环要进行56次,猜测v6和v3都是对前56操作,应该是反汇编出错了,变成了v4,v5,把v4,v5放到v3中
写成c++运行一下
#include<stdio.h>
int main()
{
int i;
char v3[56];
char v6[56];
v6[0] = 18;
v6[1] = 64;
v6[2] = 98;
v6[3] = 5;
v6[4] = 2;
v6[5] = 4;
v6[6] = 6;
v6[7] = 3;
v6[8] = 6;
v6[9] = 48;
v6[10] = 49;
v6[11] = 65;
v6[12] = 32;
v6[13] = 12;
v6[14] = 48;
v6[15] = 65;
v6[16] = 31;
v6[17] = 78;
v6[18] = 62;
v6[19] = 32;
v6[20] = 49;
v6[21] = 32;
v6[22] = 1;
v6[23] = 57;
v6[24] = 96;
v6[25] = 3;
v6[26] = 21;
v6[27] = 9;
v6[28] = 4;
v6[29] = 62;
v6[30] = 3;
v6[31] = 5;
v6[32] = 4;
v6[33] = 1;
v6[34] = 2;
v6[35] = 3;
v6[36] = 44;
v6[37] = 65;
v6[38] = 78;
v6[39] = 32;
v6[40] = 16;
v6[41] = 97;
v6[42] = 54;
v6[43] = 16;
v6[44] = 44;
v6[45] = 52;
v6[46] = 32;
v6[47] = 64;
v6[48] = 89;
v6[49] = 45;
v6[50] = 32;
v6[51] = 65;
v6[52] = 15;
v6[53] = 34;
v6[54] = 18;
v6[55] = 16;
v3[0]='{';
v3[1]=' ';
v3[2] = 18;
v3[3] = 98;
v3[4] = 119;
v3[5] = 108;
v3[6] = 65;
v3[7] = 41;
v3[8] = 124;
v3[9] = 80;
v3[10] = 125;
v3[11] = 38;
v3[12] = 124;
v3[13] = 111;
v3[14] = 74;
v3[15] = 49;
v3[16] = 83;
v3[17] = 108;
v3[18] = 94;
v3[19] = 108;
v3[20] = 84;
v3[21] = 6;
v3[22]='`';
v3[23]='S';
v3[24]=',';
v3[25]='y';
v3[26]='h';
v3[27]='n';
v3[28]=' ';
v3[29]='_';
v3[30]='u';
v3[31]='e';
v3[32]='c';
v3[33]='{';
v3[34] = 127;
v3[35] = 119;
v3[36] = 96;
v3[37] = 48;
v3[38] = 107;
v3[39] = 71;
v3[40] = 92;
v3[41] = 29;
v3[42] = 81;
v3[43] = 107;
v3[44] = 90;
v3[45] = 85;
v3[46] = 64;
v3[47] = 12;
v3[48] = 43;
v3[49] = 76;
v3[50] = 86;
v3[51] = 13;
v3[52] = 114;
v3[53] = 1;
v3[54]='u';
v3[55]='~';
for ( i = 0; i < 56; ++i )
{
v3[i] ^= v6[i];
v3[i] ^= 19;
}
puts(v3);
puts(v6);
}
得到flag
此题只是对已知数据进行了一个简单异或,写个脚本异或回去就可以,shift+e提取数据