MAY DASCTF X BUU_wp

MAY DASCTF X BUU两道简单RE-wp

PaperPlease

t = [0x56, 0x05, 0x53, 0x52, 0x04, 0x03, 0x53, 0x54, 0x04, 0x0B, 0x53, 0x51, 0x06, 0x06, 0x0F, 0x55, 0x05, 0x5B, 0x03, 0x56, 0x0E, 0x07, 0x57, 0x0E, 0x01, 0x0D, 0x56, 0x00, 0x04, 0x06, 0x0A, 0x5D]
ch = "5c715207e3abed7dfb7c8ea9c82d0e29"
flag = ''
for i in range(len(ch)):
    flag=flag + chr(ord(ch[i])^int(t[i]))
flag = "DASCTF{"+flag+"}"
print(flag)

DASCTF{cfdc11cca823cb81c9456b67b5dd4c8d}

end

查壳

脱壳

upx -d 1.exe

进ida

switch分支，典型迷宫，列数为7，沿1走，走到#

查看amp变量

把迷宫打印出来和路径

import hashlib
ch=[  chr(94),
  0,
  0,
  0,
  0,
  0,
  0,
  1,
  1,
  0,
  0,
  0,
  0,
  0,
  0,
  1,
  0,
  1,
  1,
  1,
  0,
  0,
  1,
  1,
  1,
  0,
  1,
  0,
  0,
  0,
  0,
  0,
  0,
  1,
  0,
  1,
  0,
  0,
  1,
  1,
  1,
  0,
  1,
  0,
  0,
  1,
  0,
  0,
  0,
  0,
  0,
  0,
  1,
  1,
  1,
  chr(35)]
i=1
k=0
while (k<len(ch)):
    if i<7 :
        print(ch[k],end=' ')
    else:
        i=0
        print(ch[k])
    i=i+1
    k=k+1
    
'''  
迷宫
^ 0 0 0 0 0 0
1 1 0 0 0 0 0
0 1 0 1 1 1 0
0 1 1 1 0 1 0
0 0 0 0 0 1 0
1 0 0 1 1 1 0
1 0 0 1 0 0 0
0 0 0 1 1 1 #
'''
'''
运动规定
左 4
上 8
下 2
右 6
'''
flag='sdssddwddsssaassddd'
f=''
for i in flag:
    if i=='a':
        f=f+'4'
    elif i=='w':
        f=f+'8'
    elif i=='s':
        f=f+'2'
    else:
        f=f+'6'
print(f)
#f=2622668662224422666

dbg调试，输入路径得到flag

flag{f033ab37c30201f73f142449d037028d}