easy_Maze

下载附件查看到是ELF文件，在Linux下运行

尝试输入几次错误后用IDA打开

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 v3; // rax
  int v5[7]; // [rsp+0h] [rbp-270h]
  int v6; // [rsp+C0h] [rbp-1B0h]
  int v7[7]; // [rsp+D0h] [rbp-1A0h]
  int v8; // [rsp+190h] [rbp-E0h]
  int v9[7]; // [rsp+1A0h] [rbp-D0h]
  int v10; // [rsp+1BCh] [rbp-B4h]
  int v11; // [rsp+1C0h] [rbp-B0h]
  int v12; // [rsp+1C4h] [rbp-ACh]
  int v13; // [rsp+1C8h] [rbp-A8h]
  int v14; // [rsp+1CCh] [rbp-A4h]
  int v15; // [rsp+1D0h] [rbp-A0h]
  int v16; // [rsp+1D4h] [rbp-9Ch]
  int v17; // [rsp+1D8h] [rbp-98h]
  int v18; // [rsp+1DCh] [rbp-94h]
  int v19; // [rsp+1E0h] [rbp-90h]
  int v20; // [rsp+1E4h] [rbp-8Ch]
  int v21; // [rsp+1E8h] [rbp-88h]
  int v22; // [rsp+1ECh] [rbp-84h]
  int v23; // [rsp+1F0h] [rbp-80h]
  int v24; // [rsp+1F4h] [rbp-7Ch]
  int v25; // [rsp+1F8h] [rbp-78h]
  int v26; // [rsp+1FCh] [rbp-74h]
  int v27; // [rsp+200h] [rbp-70h]
  int v28; // [rsp+204h] [rbp-6Ch]
  int v29; // [rsp+208h] [rbp-68h]
  int v30; // [rsp+20Ch] [rbp-64h]
  int v31; // [rsp+210h] [rbp-60h]
  int v32; // [rsp+214h] [rbp-5Ch]
  int v33; // [rsp+218h] [rbp-58h]
  int v34; // [rsp+21Ch] [rbp-54h]
  int v35; // [rsp+220h] [rbp-50h]
  int v36; // [rsp+224h] [rbp-4Ch]
  int v37; // [rsp+228h] [rbp-48h]
  int v38; // [rsp+22Ch] [rbp-44h]
  int v39; // [rsp+230h] [rbp-40h]
  int v40; // [rsp+234h] [rbp-3Ch]
  int v41; // [rsp+238h] [rbp-38h]
  int v42; // [rsp+23Ch] [rbp-34h]
  int v43; // [rsp+240h] [rbp-30h]
  int v44; // [rsp+244h] [rbp-2Ch]
  int v45; // [rsp+248h] [rbp-28h]
  int v46; // [rsp+24Ch] [rbp-24h]
  int v47; // [rsp+250h] [rbp-20h]
  int v48; // [rsp+254h] [rbp-1Ch]
  int v49; // [rsp+258h] [rbp-18h]
  int v50; // [rsp+25Ch] [rbp-14h]
  int v51; // [rsp+260h] [rbp-10h]

  v9[0] = 1;        //初始迷宫
  v9[1] = 1;
  v9[2] = -1;
  v9[3] = 1;
  v9[4] = -1;
  v9[5] = 1;
  v9[6] = -1;
  v10 = 0;
  v11 = 0;
  v12 = 0;
  v13 = 0;
  v14 = 1;
  v15 = -1;
  v16 = 0;
  v17 = 0;
  v18 = 1;
  v19 = 0;
  v20 = 0;
  v21 = 1;
  v22 = 0;
  v23 = -1;
  v24 = -1;
  v25 = 0;
  v26 = 1;
  v27 = 0;
  v28 = 1;
  v29 = -1;
  v30 = 0;
  v31 = -1;
  v32 = 0;
  v33 = 0;
  v34 = 0;
  v35 = 0;
  v36 = 0;
  v37 = 1;
  v38 = -1;
  v39 = -1;
  v40 = 1;
  v41 = -1;
  v42 = 0;
  v43 = -1;
  v44 = 2;
  v45 = 1;
  v46 = -1;
  v47 = 0;
  v48 = 0;
  v49 = -1;
  v50 = 1;
  v51 = 0;
  memset(v7, 0, 0xC0uLL);
  v8 = 0;
  memset(v5, 0, 0xC0uLL);
  v6 = 0;
  Step_0((int (*)[7])v9, 7, (int (*)[7])v7);    //对迷宫一次加密
  Step_1((int (*)[7])v7, 7, (int (*)[7])v5);	//对迷宫二次加密	
  v3 = std::operator<<<std::char_traits<char>>(&_bss_start, "Please help me out!");
  std::ostream::operator<<(v3, &std::endl<char,std::char_traits<char>>);
  Step_2((int (*)[7])v5);   //两次加密后的迷宫传入
  system("pause");
  return 0;
}

推测应该是一个7*7的迷宫经过了两次加密
进入Step_2

__int64 __fastcall Step_2(int (*a1)[7])
{
  int v1; // eax
  __int64 v2; // rax
  __int64 v3; // rax
  __int64 result; // rax
  __int64 v5; // rax
  char v6[35]; // [rsp+10h] [rbp-30h]
  char v7; // [rsp+33h] [rbp-Dh]
  int v8; // [rsp+34h] [rbp-Ch]
  int v9; // [rsp+38h] [rbp-8h]
  int v10; // [rsp+3Ch] [rbp-4h]

  v10 = 0;
  v9 = 0;
  v8 = 0;
  while ( v8 <= 29 && (*a1)[7 * v10 + v9] == 1 )  //步数<=30且只能经过1
  {
    std::operator>><char,std::char_traits<char>>(&std::cin, &v7);
    v1 = v8++;
    v6[v1] = v7;
    if ( v7 == 'd' )     //向右一格 
    {
      ++v9;
    }
    else if ( v7 > 'd' )
    {
      if ( v7 == 's' )   //向下一格
      {
        ++v10;
      }
      else
      {
        if ( v7 != 'w' )  //向上一格
          goto LABEL_14;
        --v10;
      }
    }
    else if ( v7 == 'a' )   //向左一格
    {
      --v9;
    }
    else
    {
LABEL_14:
      v2 = std::operator<<<std::char_traits<char>>(&_bss_start, "include illegal words.");
      std::ostream::operator<<(v2, &std::endl<char,std::char_traits<char>>);
    }
  }
  if ( v10 != 6 || v9 != 6 )   //走到maze[6][6]成功
  {
    v5 = std::operator<<<std::char_traits<char>>(&_bss_start, "Oh no!,Please try again~~");
    std::ostream::operator<<(v5, &std::endl<char,std::char_traits<char>>);
    result = 0LL;
  }
  else
  {
    v3 = std::operator<<<std::char_traits<char>>(&_bss_start, "Congratulations!");
    std::ostream::operator<<(v3, &std::endl<char,std::char_traits<char>>);
    output(v6, v8);
    result = 1LL;
  }
  return result;
}

Step_0和Step_1的变化比较复杂，加密前maze是定的，那加密后应该也是定的，用gdb动态调试
b Step_2

r运行到函数开始位置

函数刚开始运行时，会为我们的输入分配内存空间。因为是x64系统，所以函数传递参数时会先通过寄存器传参，rdi中存放的就是加密后的maze

将该片内存空间的前49个数据打印出来，这便是maze中的元素

ssddwdwdddssaasasaaassddddwdds

UNCTF{ssddwdwdddssaasasaaassddddwdds}