ctfshow r3

伪代码

int __cdecl main(int argc, const char **argv, const char **envp)
{
  size_t v3; // rax
  int v5; // [rsp+Ch] [rbp-134h] BYREF
  unsigned int i; // [rsp+10h] [rbp-130h]
  int v7; // [rsp+14h] [rbp-12Ch]
  int v8; // [rsp+18h] [rbp-128h]
  int v9; // [rsp+1Ch] [rbp-124h]
  int v10; // [rsp+20h] [rbp-120h]
  int v11; // [rsp+24h] [rbp-11Ch]
  int v12; // [rsp+28h] [rbp-118h]
  int v13; // [rsp+2Ch] [rbp-114h]
  int v14; // [rsp+30h] [rbp-110h]
  int v15; // [rsp+34h] [rbp-10Ch]
  unsigned __int64 v16; // [rsp+38h] [rbp-108h]
  int v17[8]; // [rsp+40h] [rbp-100h]
  char s[5]; // [rsp+60h] [rbp-E0h] BYREF
  char v19[107]; // [rsp+65h] [rbp-DBh] BYREF
  char dest[104]; // [rsp+D0h] [rbp-70h] BYREF
  unsigned __int64 v21; // [rsp+138h] [rbp-8h]

  v21 = __readfsqword(0x28u);
  v7 = 80;
  v8 = 64227;
  v9 = 226312059;
  v10 = -1540056586;
  v11 = 5;
  v12 = 16;
  v13 = 3833;
  v5 = 0;
  puts("plz input the key:");
  __isoc99_scanf("%s", s);	// 输入key
  v3 = strlen(s);	// 计算输入长度
  strncpy(dest, v19, v3 - 6);	// 将s的6~strlen(s)-1位复制到dest，输入s的长度不小于6
  dest[strlen(s) - 6] = 0;	// 最后1位置0
  __isoc99_sscanf(dest, "%x", &v5);	 // 读取dest中16进制数到v5
  v17[0] = v7;
  v17[1] = v8;
  v17[2] = v9;
  v17[3] = v10;
  v17[4] = (v11 << 12) + v12;
  v17[5] = v13;
  v17[6] = v5;
  v16 = 0LL;
  for ( i = 0; i <= 6; ++i )
  {
    for ( v16 += (unsigned int)v17[i]; v16 > 0xFFFF; v16 = v15 + (unsigned int)(unsigned __int16)v16 )// unsigned __int16只保留后4位
    {
      v14 = (unsigned __int16)v16;	// 没用到v14，这行可以忽略
      v15 = v16 >> 16;
    }
  }
  if ( v16 == 0xFFFF )
    puts("OK");
  else
    puts("Error");
  return 0;
}

C语言中for循环执行流程

将主体代码稍微修改一下

#include<stdio.h>
int main() {
	int v15 = 0;
	unsigned __int64 v16 = 0LL;
	int v17[7] = {80, 64227, 226312059, -1540056586, 20496, 3833, 888};

	for (int i = 0 ; i <= 6; ++i ) {
		for ( v16 += (unsigned int)v17[i]; v16 > 0xFFFF; v16 = v15 + (unsigned int)(unsigned __int16)v16 )
			v15 = v16 >> 16;
	}

	if ( v16 == 0xFFFF )
		puts("OK");
	else
		puts("Error");

	return 0;
}

然后调试一下（根据题意，v17[6]就是要求的flag，随便赋个888）
这里调试最好选择Debug模式

调试到即将与v17[6]相加的地方

v16先加上v17[6]，然后判断是否大于0xffff，小于等于0xffff即退出循环
由提示最小解，4位值，直接相减就行

验证下
输入的1a9f前5位和最后1位任意，1A9F也是OK的