直接看伪代码
GetDlgItemTextA(hWnd, 1002, &String, 260);
strlen(&String);
if ( strlen(&String) > 6 )
ExitProcess(0);
v10 = atoi(&String) + 1;
if ( v10 == 123 && v12 == 120 && v14 == 122 && v13 == 121 )
{
strcpy(Text, "flag");
memset(&v7, 0, 0xFCu);
v8 = 0;
v9 = 0;
_itoa(v10, &v5, 10);
strcat(Text, "{");
strcat(Text, &v5);
strcat(Text, "_");
strcat(Text, "Buff3r_0v3rf|0w");
strcat(Text, "}");
MessageBoxA(0, Text, "well done", 0);
以为很简单(其实也很简单),但是最开始弄错了,把itoa
和atoi
这两个函数弄错了,以为是int和ascii之间的转换,实际上是数字和字符串之间的转换。看c++官方文档。
itoa
itoa
char * itoa ( int value, char * str, int base );
Convert integer to string (non-standard function) Converts an integer
value to a null-terminated string using the specified base and stores
the result in the array given by str parameter.If base is 10 and value is negative, the resulting string is preceded
with a minus sign (-). With any other base, value is always considered
unsigned.str should be an array long enough to contain any possible value:
(sizeof(int)*8+1) for radix=2, i.e. 17 bytes in 16-bits platforms and
33 in 32-bits platforms.
所以flag
就是flag{123_Buff3r_0v3rf|0w}