虽然不知道是什么写的程序,但看起来确实很乱,不过程序很简单,一上来就scanf输入然后开始一步步运算
v21 = runtime_newobject((__int64)&RTYPE_string);
for ( i = 0LL; ; i = v3 )
{
v20 = i;
v19 = runtime_convT64(i);
v25[0] = (__int64)&RTYPE_string;
v25[1] = (__int64)&main_statictmp_2;
v26 = &RTYPE_int;
v27 = v19;
fmt_Fprintln((__int64)&go_itab__ptr_os_File_comma_io_Writer, os_Stdout, (__int64)v25, 2LL, 2LL);
v24[0] = (__int64)&RTYPE_string;
v24[1] = (__int64)&main_statictmp_3;
fmt_Fprintln((__int64)&go_itab__ptr_os_File_comma_io_Writer, os_Stdout, (__int64)v24, 1LL, 1LL);
v23[0] = (__int64)&RTYPE__ptr_string;
v23[1] = v21;
fmt_Fscan((__int64)&go_itab__ptr_os_File_comma_io_Reader, os_Stdin, (__int64)v23, 1LL, 1LL);
v1 = *(_QWORD *)(v21 + 8);
v2 = *(_BYTE **)v21;
if ( v1 <= 2 )
break;
if ( v2[2] != 116 )
goto LABEL_5;
if ( v1 <= 9 )
break;
if ( v2[9] != 99 )
goto LABEL_5;
if ( v1 <= 0x10 )
break;
if ( v2[16] != 110 )
goto LABEL_5;
if ( v1 <= 0x15 )
break;
if ( v2[21] != 122 )
goto LABEL_5;
if ( v1 <= 0x16 )
break;
if ( v2[22] != 125 )
goto LABEL_5;
v4 = v2[5];
if ( v4 != 115 )
goto LABEL_5;
if ( (v2[3] ^ 0x74) != 18 )
goto LABEL_5;
v5 = v2[1];
if ( v5 != 99 )
goto LABEL_5;
v6 = v2[7];
if ( v6 != 100 )
goto LABEL_5;
v7 = v2[13];
if ( v2[12] != v7 )
goto LABEL_5;
if ( v2[19] != 0x7A )
goto LABEL_5;
v8 = v2[14];
v9 = v2[6];
if ( v9 + v8 != 104 )
goto LABEL_5;
v10 = v2[4];
if ( v10 != 123 )
goto LABEL_5;
v11 = v2[8];
if ( v2[15] != v11 )
goto LABEL_5;
if ( v11 + 4 == v5
&& (v12 = v2[17], v13 = v2[11], 125 - v12 + 40 == v13)
&& (v14 = v2[18], v15 = v12 + v13 - v4 - v14, v16 = v14 - v12, v15 == v16)
&& (v17 = v9 - v12, *v2 == v16 * (v17 >> 1) + 110)
&& (v18 = v2[10], v7 + 1 == v18)
&& v17 + 2 * v17 + 4 * (v10 - v6) == v18
&& v2[20] - v5 == 2 * v16
&& (v4 ^ 0x6E) == 29
&& v17 == 4 * v16
&& v2[6] == v8 )
{
main_win();
v3 = v20;
}
else
{
LABEL_5:
v22[0] = (__int64)&RTYPE_string;
v22[1] = (__int64)&main_statictmp_4;
fmt_Fprintln((__int64)&go_itab__ptr_os_File_comma_io_Writer, os_Stdout, (__int64)v22, 1LL, 1LL);
v3 = v20 + 1;
}
}
runtime_panicindex();
这运算非常多,手工看来是算不了了,没办法只能用z3,在z3里可以直接用赋值语句,这可太强了。后边比较乱的公式几乎是直接搬过来。
from z3 import *
v = [BitVec(f'v{i}', 7) for i in range(23)]
s = Solver()
s.add(v[2]==116, v[9]==99, v[16]==110, v[21]==122, v[22]==125, v[5]==115, v[3]==18^0x74, v[1]==99, v[7]==100, v[19]==0x7a, v[4]== 123 )
v4 = v[5];
v5 = v[1];
v6 = v[7];
v7 = v[13];
v8 = v[14];
v9 = v[6];
v10 = v[4];
v11 = v[8];
s.add(v[12] == v[13])
s.add(v8 + v9 == 104)
s.add(v[15] == v11)
s.add(v11 + 4 == v5)
v12 = v[17]
v13 = v[11]
s.add(125 - v12 + 40 == v13)
v14 = v[18]
v15 = v12 + v13 - v4 - v14
v16 = v14 - v12
s.add(v15 == v16)
v17 = v9 - v12
s.add(v[0] == v16 * (v17 >> 1) + 110)
v18 = v[10]
s.add(v7 + 1 == v18)
s.add(v17 + 2 * v17 + 4 * (v10 - v6) == v18 )
s.add(v[20] - v5 == 2 * v16)
s.add(v17 == 4 * v16)
s.add(v[6] == v8 )
s.check()
d = s.model()
print(bytes([d[i].as_long() for i in v]))
#pctf{s4d_chugg4_n01zez}
#flag{s4d_chugg4_n01zez}