进去一看发现main有花指令,左上角EDIT -> Path program ->Change byte ,把第一个字节(E9)改为90 ,(改成nop),然后重复4次,然后点击main创建函数(右键main函数,然后有个“创建函数”),然后反编译。
然后先看到一大串给v3赋值的,有49个。
然后看到最下面,判断成功的,这个值刚好是v3【48】的值,还有如果*v3是偶数的话就退出。
然后再看到中间,发现给基地址自加自减的,判断出是迷宫,h,j,k,l是 左上下右,还有迷宫大小是7*7。
然后根据v3的所有值,画出迷宫。
然后逆向编写出代码,代码如下:
#include<stdio.h>
#include<string.h>
#define LL ;
int a=0,b=0,map[7][7];
void getflag(){
if(a==6&&b==6){printf("}");return;}
if(a+1<7&&map[a+1][b]){map[a++][b]=0;printf("k");getflag();}
else if(b+1<7&&map[a][b+1]){map[a][b++]=0;printf("l");getflag();}
else if(a-1>=0&&map[a-1][b]){map[a--][b]=0;printf("j");getflag();}
else if(b-1>=0&&map[a][b-1]){map[a][b--]=0;printf("h");getflag();}
return;
}
int main(void)
{
int v3[49] ;
*v3 = 234545231LL;v3[1] = 344556530LL;v3[7] = 1423431LL;v3[2] = 0x69981A413ELL;v3[8] = 54535240LL;v3[3] = 0xAD765F22BLL;v3[9] = 234242550LL;v3[4] = 0x1F6653572295LL;v3[12] = 123422421LL;v3[5] = 0x1F687239D88BLL;v3[13] = 2342420LL;v3[6] = 0x85354B6E0E0B4LL;v3[14] = 23414141LL;v3[10] = 0x574319309LL;v3[15] = 23424420LL;v3[11] = 0x22212127E16LL;v3[16] = 13535231LL;v3[18] = 0x57424EFE0LL;v3[17] = 2341LL;v3[20] = 0xC6CE7E906LL;v3[19] = 1234422441LL;v3[27] = 3453326640LL;v3[21] = 253244531LL;v3[28] = 0x36798A41BECAC6DLL;v3[22] = 45463320LL;v3[29] = 0x6E230828110LL;v3[23] = 24532661LL;v3[30] = 0x575771C1BLL;v3[24] = 23433430LL;v3[25] = 23453660LL;v3[26] = 3453661LL;v3[31] = 234534460LL;v3[33] = 0x805B2D5A7LL;v3[35] = 0x2243C897C6BLL;v3[32] = 234364561LL;v3[36] = 0x5769A5D6ELL;v3[34] = 2345670LL;v3[39] = 0x1580F6F64FA1LL;v3[37] = 245646441LL;v3[40] = 2346463450LL;v3[38] = 234644640LL;v3[41] = 2343345620LL;v3[42] = 3444651LL;v3[43] = 23451LL;v3[44] = 67541LL;v3[45] = 34575860LL;v3[46] = 67856741LL;v3[47] = 567678671LL;v3[48] = 567565671LL;
// for(int i=0;i<49;i++){ //打印迷宫
// if(v3[i]&1) printf("1 ");
// else printf("0 ");
// if(i%7==6) printf("\n");
// }
for(int i=0;i<7;i++)for(int j=0;j<7;j++)
if(v3[i*7+j]&1) map[i][j]=1;
else map[i][j]=0;
printf("flag{");
getflag();
return 0;
}
最终得到flag{kkkkkklljjjjljjllkkkkhkkll}