Roar CTF 2019 坦克大战 Writeup

下载压缩包 解压看到

可知该游戏由Unity3D编写,由于没有相关逆向经验,上网查阅得知游戏代码部分都在Assembly-CSharp.dll文件中,通过dnspy可以打开此类型的dll.

直接查看跟题目相关的函数,在MapManager下有名为WinGame的函数.源码如下

// MapManager
// Token: 0x06000029 RID: 41 RVA: 0x00003050 File Offset: 0x00001250
public static void WinGame()
{
   
	if (!MapManager.winGame && (MapManager.nDestroyNum == 4 || MapManager.nDestroyNum == 5))
	{
   
		string text = "clearlove9";
		for (int i = 0; i < 21; i++)
		{
   
			for (int j = 0; j < 17; j++)
			{
   
				text += MapManager.MapState[i, j].ToString();
			}
		}
		string a = MapManager.Sha1(text);
		if (a == "3F649F708AAFA7A0A94138DC3022F6EA611E8D01")
		{
   
			FlagText._instance.gameObject.SetActive(true);
			FlagText.str = "RoarCTF{wm-" + MapManager.Md5(text) + "}";
			MapManager.winGame = true;
		}
	}
}

具体就是对数组进行字符化累加后,判断Hash值是否与给定值相等.
其中nDestroyNum和MapManager.MapState是关键所在.
先看MapManager.MapState(在MapManager.init()中定义.

// MapManager
// Token: 0x06000028 RID: 40 RVA: 0x000027AC File Offset: 0x000009AC
public static void Init()
{
   
	MapManager.MapState = new int[,]
	{
   
		{
   
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8,
			8
		},
		{
   
			8,
			8,
			4,
			5,
			8,
			1,
			1,
			1,
			1,
			1,
			1,
			8,
			8,
			8,
			8,
			4,
			8
		},
		{
   
			8,
			2,
			8,
			1,
			8,
			8,
			5,
			1,
			8,
			8,
			8,
			1,
			8,
			1,
			8,
			4,
			8
		},
		{
   
			8,
			5,
			8,
			2,
			8,
			8,
			8,
			8,
			1,
			8,
			8,
			4,
			8,
			1,
			1,
			5,
			8
		},
		{
   
			8,