[XCTF-Reverse] 73 hctf2018_seven

迷宫题

先随便看看，一共没几个函数，发现入口在12F0

__int64 __fastcall check_1400012f0(__int64 a1, __int64 a2)
{
  __int64 v2; // rbx
  __int64 v3; // rsi
  unsigned __int64 v4; // rdx
  int v5; // ecx
  __int16 *v6; // rdi
  __int64 v7; // rbp
  __int16 v8; // dx
  char v9; // dl
  CHAR *v10; // rcx

  v2 = a2;
  if ( *(_DWORD *)(a2 + 48) >= 0 )              // (qword *)(a2+12)
  {
    v3 = *(_QWORD *)(a2 + 24);
    v4 = (unsigned __int64)(*(unsigned __int64 *)(a2 + 56) * (unsigned __int128)0xAAAAAAAAAAAAAAABui64 >> 64) >> 3;
    if ( (_DWORD)v4 )
    {
      v5 = dword_1400030E4;                     // 起点
      v6 = (__int16 *)(v3 + 2);
      v7 = (unsigned int)v4;
      while ( *(_WORD *)(v3 + 4) )
      {
LABEL_30:
        v6 += 6;
        if ( !--v7 )
          goto LABEL_31;
      }
      aO[v5] = 46;
      v8 = *v6;
      if ( *v6 == 17 )                          // up
      {
        if ( v5 & 0xFFFFFFF0 )
        {
          v5 -= 16;
          goto LABEL_13;
        }
        v5 += 208;
        dword_1400030E4 = v5;
      }
      if ( v8 != 31 )
        goto LABEL_14;                          // down
      if ( (v5 & 0xFFFFFFF0) == 208 )
        v5 -= 208;
      else
        v5 += 16;
LABEL_13:
      dword_1400030E4 = v5;
LABEL_14:
      if ( v8 == 30 )                           // left
      {
        if ( v5 & 0xF )
          --v5;
        else
          v5 += 15;
        dword_1400030E4 = v5;
      }
      if ( v8 == 32 )                           // right
      {
        if ( (v5 & 0xF) == 15 )
          v5 -= 15;
        else
          ++v5;
        dword_1400030E4 = v5;
      }
      v9 = aO[v5];
      if ( v9 == 42 )                           // *失败
      {
        v10 = "-1s\n";
      }
      else
      {
        if ( v9 != 55 )                         // 7结束
        {
LABEL_29:
          aO[v5] = 111;                         // 走过置o
          goto LABEL_30;
        }
        v10 = "The input is the flag!\n";
      }
      dword_1400030E4 = 16;
      DbgPrint(v10);
      v5 = dword_1400030E4;
      goto LABEL_29;
    }
  }
LABEL_31:
  if ( *(_BYTE *)(v2 + 65) )
    *(_BYTE *)(*(_QWORD *)(v2 + 184) + 3i64) |= 1u;
  return *(unsigned int *)(v2 + 48);
}

用17，30，31，32分别表示上左下右走一个迷宫

'''
****************
o..............*
**************.*
************...*
***********..***
**********..****
*********..*****
********..******
*******..*******
******..********
*****..*********
****..**********
****7***********
****************
'''

从o开始到7结束，手工先走出来。只是不知道这个17,30是啥

#键盘扫描码 17w 30a 31s 32d
#ddddddddddddddssaasasasasasasasasas
#hctf{ddddddddddddddssaasasasasasasasasas}

搜了一下是键盘扫描码。不过这里不算坑人，游戏里上下左右基本都是wasd