BUUCTF [ACTF新生赛2020]Oruga （迷宫题）

打开文件 无壳 拖入ida

shift+F12查看可疑字符串

继续根进

这段伪C代码的主要目的是检查用户输入的字符串是否以特定的前缀开始（在这个例子中是"actf{"），并且如果满足这个条件，它会进一步调用一个名为sub_78A的函数来验证字符串的剩余部分是否符合某个未明确给出的条件。

如果用户输入的前缀正确，代码将调用sub_78A函数，并传入用户输入的整个字符串s作为参数。sub_78A函数的返回值被用来决定输出"That's True Flag!"（如果返回非零值）或"don't stop trying..."（如果返回0）。

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  int i; // [rsp+0h] [rbp-40h]
  char s1[6]; // [rsp+4h] [rbp-3Ch] BYREF
  char s2[6]; // [rsp+Ah] [rbp-36h] BYREF
  char s[40]; // [rsp+10h] [rbp-30h] BYREF
  unsigned __int64 v8; // [rsp+38h] [rbp-8h]

  v8 = __readfsqword(0x28u);
  memset(s, 0, 0x19uLL);
  printf("Tell me the flag:");
  scanf("%s", s);
  strcpy(s2, "actf{");
  for ( i = 0; i <= 4; ++i )
    s1[i] = s[i];
  s1[5] = 0;
  if ( !strcmp(s1, s2) )
  {
    if ( (unsigned __int8)sub_78A(s) )
      printf("That's True Flag!");
    else
      printf("don't stop trying...");
    return 0LL;
  }
  else
  {
    printf("Format false!");
    return 0LL;
  }
}

跟进sub_78A函数 其实我看到这段代码并没有什么反应 题目还是写少了 我是看了其他师傅的wp才知道这个是迷宫题 而byte_201020是迷宫的内容

JMEW控制上下左右

迷宫中的内容

将迷宫中的内容打印出来

代码是借鉴这位师傅的

http://t.csdnimg.cn/dQOIS

map=[0x00,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x23,0x23,0x23,0x23,0x00,0x00,0x00,0x23,0x23,0x00,0x00,0x00,0x4f,0x4f,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4f,0x4f,0x00,0x50,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x4c,0x00,0x4f,0x4f,0x00,0x4f,0x4f,0x00,0x50,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x4c,0x00,0x4f,0x4f,0x00,0x4f,0x4f,0x00,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x4c,0x4c,0x00,0x4f,0x4f,0x00,0x00,0x00,0x00,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4f,0x4f,0x00,0x00,0x00,0x00,0x50,0x00,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4d,0x4d,0x4d,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4d,0x4d,0x4d,0x00,0x00,0x00,0x00,0x45,0x45,0x00,0x00,0x00,0x30,0x00,0x4d,0x00,0x4d,0x00,0x4d,0x00,0x00,0x00,0x00,0x45,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x45,0x45,0x54,0x54,0x54,0x49,0x00,0x4d,0x00,0x4d,0x00,0x4d,0x00,0x00,0x00,0x00,0x45,0x00,0x00,0x54,0x00,0x49,0x00,0x4d,0x00,0x4d,0x00,0x4d,0x00,0x00,0x00,0x00,0x45,0x00,0x00,0x54,0x00,0x49,0x00,0x4d,0x00,0x4d,0x00,0x4d,0x21,0x00,0x00,0x00,0x45,0x45]
for i in range(0,16):
    for j in range(0,16):
        if(map[i*16+j]==0):
            print('0',end='')
        elif(map[i*16+j]==33):
            print('!', end='')
        else:
            print('#', end='')
    print()

0可以移动，到达#位置停止，返回上一位置。

手动解出flag

 flag{MEWEMEWJMEWJM}