知道你很急但是你先别急之西湖论剑babycalc wp
先看看开了什么保护
64位程序,没开pie
审计一下代码先
前面两个函数没什么特别的,简单的初始化,主要的还是在sub_400789()函数中,这里我们给他改成code函数
int code()
{
char v0; // al
char buf[208]; // [rsp+0h] [rbp-100h] BYREF
unsigned __int8 v3; // [rsp+D0h] [rbp-30h]
unsigned __int8 v4; // [rsp+D1h] [rbp-2Fh]
unsigned __int8 v5; // [rsp+D2h] [rbp-2Eh]
unsigned __int8 v6; // [rsp+D3h] [rbp-2Dh]
unsigned __int8 v7; // [rsp+D4h] [rbp-2Ch]
unsigned __int8 v8; // [rsp+D5h] [rbp-2Bh]
unsigned __int8 v9; // [rsp+D6h] [rbp-2Ah]
unsigned __int8 v10; // [rsp+D7h] [rbp-29h]
unsigned __int8 v11; // [rsp+D8h] [rbp-28h]
unsigned __int8 v12; // [rsp+D9h] [rbp-27h]
unsigned __int8 v13; // [rsp+DAh] [rbp-26h]
unsigned __int8 v14; // [rsp+DBh] [rbp-25h]
unsigned __int8 v15; // [rsp+DCh] [rbp-24h]
unsigned __int8 v16; // [rsp+DDh] [rbp-23h]
unsigned __int8 v17; // [rsp+DEh] [rbp-22h]
unsigned __int8 v18; // [rsp+DFh] [rbp-21h]
int i; // [rsp+FCh] [rbp-4h]
for ( i = 0; i <= 15; ++i )
{
printf("number-%d:", (unsigned int)(i + 1));
buf[(int)read(0, buf, 0x100uLL)] = 0;
v0 = strtol(buf, 0LL, 10);
*(&v3 + i) = v0;
}
if ( v5 * v4 * v3 - v6