maze

IDA打开查看字符串

跟进去，迷宫题最终应该就是要到达#

 if ( asc_601060[8 * v9 + v10[0]] != '#' )
    goto LABEL_20;
  v7 = "Congratulations!";
LABEL_21:
  puts(v7);
  return 0LL;

查看asc_601060：

查看迷宫：把v9看成x轴，把v9+1看成y轴

 if ( strlen(&s1) - 1 > 5 )
  {
    while ( 1 )
    {
      v4 = *(&s1 + v3);
      v5 = 0;
      if ( v4 > 78 )
      {
        if ( (unsigned __int8)v4 == 'O' )
        {
          v6 = sub_400650(v10);
          v1 = (*a1)--;     //向左走
          return v1 > 0;
          goto LABEL_14;
        }
        if ( (unsigned __int8)v4 == 'o' )
        {
          v6 = sub_400660(v10)
          v1 = *a1 + 1;
         *a1 = v1;           //向右走
          return v1 < 8;
          goto LABEL_14;
        }
      }
      else
      {
        if ( (unsigned __int8)v4 == '.' )
        {
          v6 = sub_400670(&v9);
          v1 = (*a1)--;  //向上走
          return v1 > 0;
          goto LABEL_14;
        }
        if ( (unsigned __int8)v4 == '0' )
        {
          v6 = sub_400680((int *)&v9);
           v1 = *a1 + 1;   //向下走
          *a1 = v1;
           return v1 < 8;
LABEL_14:
          v5 = v6;
          goto LABEL_15;
        }
      }
LABEL_15:
      if ( !(unsigned __int8)sub_400690((__int64)asc_601060, v10[0], v9) )
        goto LABEL_22;
      if ( ++v3 >= strlen(&s1) - 1 )
      {
        if ( v5 )
          break;
LABEL_20:
        v7 = "Wrong flag!";
        goto LABEL_21;
      }
    }
  }

写脚本：

str='  *******   *  **** * ****  * ***  *#  *** *** ***     *********'
count=1
for x in str:
    if count<8:
        print(x,end='')
        count+=1
    else:
        print(x)
        count=1

运行

  ******
*   *  *
*** * **
**  * **
*  *#  *
** *** *
**     *
********

走一下

nctf{o0oo00O000oooo..OO}