[BUUCTF]REVERSE解题记录 [BJDCTF2020]JustRE

1.ida32位打开，直接看main函数

int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
  int result; // eax@1
  HACCEL v5; // esi@2
  struct tagMSG Msg; // [sp+8h] [bp-1Ch]@2

  LoadStringA(hInstance, 0x67u, WindowName, 100);
  LoadStringA(hInstance, 0x6Du, ClassName, 100);
  sub_4010C0(hInstance);
  result = (int)sub_401150(hInstance, nShowCmd);
  if ( result )
  {
    v5 = LoadAcceleratorsA(hInstance, (LPCSTR)0x6D);
    while ( GetMessageA(&Msg, 0, 0, 0) )
    {
      if ( !TranslateAcceleratorA(Msg.hwnd, v5, &Msg) )
      {
        TranslateMessage(&Msg);
        DispatchMessageA(&Msg);
      }
    }
    result = Msg.wParam;
  }
  return result;
}

 尝试查看几个函数以后可以看到DialogFunc这个函数在最后的位置。

2. 

BOOL __stdcall DialogFunc(HWND hWnd, UINT a2, WPARAM a3, LPARAM a4)
{
  CHAR String; // [sp+0h] [bp-64h]@5

  if ( a2 != 272 )
  {
    if ( a2