思路
先查壳,发现是无壳的64位的一个可执行文件。
放入ida中,发现有main函数,这道题看来是难度不大
int __cdecl main(int argc, const char **argv, const char **envp)
{
FILE *stream; // ST08_8
signed int i; // [rsp+4h] [rbp-2Ch]
char ptr[24]; // [rsp+10h] [rbp-20h]
unsigned __int64 v7; // [rsp+28h] [rbp-8h]
v7 = __readfsqword(0x28u);
stream = fopen("flag", "r");
fread(ptr, 1uLL, 0x14uLL, stream);
fclose(stream);
for ( i = 1; i <= 19; ++i )
{
if ( i & 1 )
printf("%ld\n", (unsigned int)(ptr[i] << i));
else
printf("%ld\n", (unsigned int)(i * ptr[i]));
}
return 0;
}
之后附件中还有一个txt文件,打开发现是一堆数字,之后利用这个逻辑进行运算即可,那么脚本就写出来。
脚本
#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<stdint.h>
int main() {
int output[20] = {0,198,232,816,200,1536,300,6144,984,51200,570,92160,1200,565248,756,1474560,800,6291456,1782,65536000};
for (int i = 1; i <= 19; ++i)
{
if (i & 1)
printf("%c", (unsigned int)(output[i] >> i));
else
printf("%c", (unsigned int)( output[i]/i ));
}
}
最后获得flag是ctf2020{d9-dE6-20c}
之后用flag包裹flag{d9-dE6-20c}