game - wp
分析题目附件:
https://adworld.xctf.org.cn/media/task/attachments/a0f2af9857614c459dd3b9d9232210df.exe
发现是exe文件,打开看看:
文件的大概意思就是,玩一个游戏,n是灯的序列号,m是灯的状态,如果第N盏灯的m为1,则点亮,否则熄灭。起初所有的灯都是灭的,现在你能够输入n来改变它的状态,但是你需要注意一件事,如果你改变了第N盏灯的状态,那么第(N-1)和(N + 1)个灯的状态也会改变。当所有灯都亮着时,flag就会出现。现在现在,输入n;
输入n, n (1 - 8)。游戏规则清楚了。
先拖入Exeinfo PE中:
32位,拖入ida中,Shift+fn+f12查找关键字符串:
发现flag,双击跟进,发现与sub_45E940有关:
找main函数按F5(Fn+F5)查看伪代码:
void __cdecl main_0()
{
signed int i; // [esp+DCh] [ebp-20h]
int v1; // [esp+F4h] [ebp-8h]
sub_45A7BE((int)&unk_50B110);
sub_45A7BE((int)&unk_50B158);
sub_45A7BE((int)&unk_50B1A0);
sub_45A7BE((int)&unk_50B1E8);
sub_45A7BE((int)&unk_50B230);
sub_45A7BE((int)&unk_50B278);
sub_45A7BE((int)&unk_50B2C0);
sub_45A7BE((int)&unk_50B308);
sub_45A7BE((int)"二 |\n");
sub_45A7BE((int)"| by 0x61 |\n");
sub_45A7BE((int)"| |\n");
sub_45A7BE((int)"|------------------------------------------------------|\n");
sub_45A7BE((int)"Play a game\n"
"The n is the serial number of the lamp,and m is the state of the lamp\n"
"If m of the Nth lamp is 1,it's on ,if not it's off\n"
"At first all the lights were closed\n");
sub_45A7BE((int)"Now you can input n to change its state\n");
sub_45A7BE((int)"But you should pay attention to one thing,if you change the state of the Nth lamp,the state of (N-1)th"
" and (N+1)th will be changed too\n");
sub_45A7BE((int)"When all lamps are on,flag will appear\n");
sub_45A7BE((int)"Now,input n \n"); //此行之前都是打印提示语
while ( 1 ) //死循环,让游戏不会结束
{
while ( 1 )
{
sub_45A7BE((int)"input n,n(1-8)\n");
sub_459418();
sub_45A7BE((int)"n=");
sub_4596D4("%d", &v1); //输入数字
sub_45A7BE((int)"\n");
if ( v1 >= 0 && v1 <= 8 ) 判断输入的值是否在1-8的范围内,否则退出
break;
sub_45A7BE((int)"sorry,n error,try again\n");
}
if ( v1 ) //v1=1
{
sub_4576D6(v1 - 1);
}