攻防世界 Newbie_calculations

程序在运行的时候不能输入值，本来以为是程序故意设置成这样的，分析之后在知道原来是程序正在加载，而且没有获取输入的函数，程序执行完就可以输出flag，但是程序中的while循环太多了，导致程序一直执行不下去，先看一下main函数：

通过观察不难看出，主函数中一共有sub_291000、sub_291100和sub_291220这三个函数 ，而且导致程序执行不下去的代码也在这三个函数中，我们只需分析这三个函数的具体作用，从而简化函数，重新编写main函数即可得到flag。

sub_291000：

 sub_291100：

 sub_291220：

 通过分析了解了三个函数的具体作用，重新写整体的main函数的脚本即可：

def add(a,b):
    return a+b
def mul(a,b):
    return a*b
def sub(a,b):
    return a-b
flag = [1 for i in range(32)]
v121 = 0
print("Your flag is:")
v3 = mul(flag[0], 1000000000)
v4 = sub(v3, 999999950)
flag[0] =mul(v4, 2)
v5 = add(flag[1], 5000000)
v6 = sub(v5, 6666666)
v7 = add(v6, 1666666)
v8 = add(v7, 45)
v9 = mul(v8, 2)
flag[1] = add(v9, 5)
v10 = mul(flag[2], 1000000000)
v11 = sub(v10, 999999950)
v12 = mul(v11, 2)
flag[2] =add(v12, 2)
v13 = add(flag[3], 55)
v14 = sub(v13, 3)
v15 = add(v14, 4)
flag[3] =sub(v15, 1)
v16 = mul(flag[4], 100000000)
v17 = sub(v16, 99999950)
v18 = mul(v17, 2)
flag[4] =add(v18, 2)
v19 = sub(flag[5], 1)
v20 = mul(v19, 1000000000)
v21 = add(v20, 55)
flag[5] =sub(v21, 3)
v22 = mul(flag[6], 1000000)
v23 = sub(v22, 999975)
flag[6] =mul(v23, 4)
v24 = add(flag[7], 55)
v25 = sub(v24, 33)
v26 = add(v25, 44)
flag[7] =sub(v26, 11)
v27 = mul(flag[8], 10)
v28 = sub(v27, 5)
v29 = mul(v28, 8)
flag[8] =add(v29, 9)
v30 = add(flag[9], 0)
v31 = sub(v30, 0)
v32 = add(v31, 11)
v33 = sub(v32, 11)
flag[9] =add(v33, 53)
v34 = add(flag[10], 49)
v35 = sub(v34, 2)
v36 = add(v35, 4)
flag[10] =sub(v36, 2)
v37 = mul(flag[11], 1000000)
v38 = sub(v37, 999999)
v39 = mul(v38, 4)
flag[11] =add(v39, 50)
v40 = add(flag[12], 1)
v41 = add(v40, 1)
v42 = add(v41, 1)
v43 = add(v42, 1)
v44 = add(v43, 1)
v45 = add(v44, 1)
v46 = add(v45, 10)
flag[12] =add(v46, 32)
v47 = mul(flag[13], 10)
v48 = sub(v47, 5)
v49 = mul(v48, 8)
v50 = add(v49, 9)
flag[13] =add(v50, 48)
v51 = sub(flag[14], 1)
v52 = mul(v51, -294967296)
v53 = add(v52, 55)
flag[14] =sub(v53, 3)
v54 = add(flag[15], 1)
v55 = add(v54, 2)
v56 = add(v55, 3)
v57 = add(v56, 4)
v58 = add(v57, 5)
v59 = add(v58, 6)
v60 = add(v59, 7)
flag[15] =add(v60, 20)
v61 = mul(flag[16], 10)
v62 = sub(v61, 5)
v63 = mul(v62, 8)
v64 = add(v63, 9)
flag[16] =add(v64, 48)
v65 = add(flag[17], 7)
v66 = add(v65, 6)
v67 = add(v66, 5)
v68 = add(v67, 4)
v69 = add(v68, 3)
v70 = add(v69, 2)
v71 = add(v70, 1)
flag[17] =add(v71, 20)
v72 = add(flag[18], 7)
v73 = add(v72, 2)
v74 = add(v73, 4)
v75 = add(v74, 3)
v76 = add(v75, 6)
v77 = add(v76, 5)
v78 = add(v77, 1)
flag[18] =add(v78, 20)
v79 = mul(flag[19], 1000000)
v80 = sub(v79, 999999)
v81 = mul(v80, 4)
v82 = add(v81, 50)
flag[19] =sub(v82, 1)
v83 = sub(flag[20], 1)
v84 = mul(v83, -294967296)
v85 = add(v84, 49)
flag[20] =sub(v85, 1)
v86 = sub(flag[21], 1)
v87 = mul(v86, 1000000000)
v88 = add(v87, 54)
v89 = sub(v88, 1)
v90 = add(v89, 1000000000)
flag[21] =sub(v90, 1000000000)
v91 = add(flag[22], 49)
v92 = sub(v91, 1)
v93 = add(v92, 2)
flag[22] =sub(v93, 1)
v94 = mul(flag[23], 10)
v95 = sub(v94, 5)
v96 = mul(v95, 8)
v97 = add(v96, 9)
flag[23] =add(v97, 48)
v98 = add(flag[24], 1)
v99 = add(v98, 3)
v100 = add(v99, 3)
v101 = add(v100, 3)
v102 = add(v101, 6)
v103 = add(v102, 6)
v104 = add(v103, 6)
flag[24] =add(v104, 20)
v105 = add(flag[25], 55)
v106 = sub(v105, 33)
v107 = add(v106, 44)
v108 = sub(v107, 11)
flag[25] =add(v108, 42)
flag[26] =add(flag[26], flag[25])
flag[27] =add(flag[27], flag[12])
v115 = flag[27]
v109 = sub(flag[28], 1)
v110 = add(v109, v115)
flag[28] =sub(v110, 1)
v116 = flag[23]
v111 = sub(flag[29], 1)
v112 = mul(v111, 1000000)
flag[29] =add(v112, v116)
v117 = flag[27]
v113 = add(flag[30], 1)
flag[30] =mul(v113, v117)
flag[31] =add(flag[31], flag[30])
print("CTF{"+"".join(map(chr,flag))+"}")

得到flag:

CTF{daf8f4d816261a41a115052a1bc21ade}