题解
main
函数如下:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60
| int __cdecl main(int argc, const char **argv, const char **envp) { char v3; int v4; int v5; signed int v6; int i; int v8;
__main(); v4 = 0; v5 = 0; qmemcpy(&v3, _data_start__, 0x19u); while ( 1 ) { puts("you can choose one action to execute"); puts("1 up"); puts("2 down"); puts("3 left"); printf("4 right\n:"); scanf("%d", &v6); if ( v6 == 2 ) { ++v4; } else if ( v6 > 2 ) { if ( v6 == 3 ) { --v5; } else { if ( v6 != 4 ) LABEL_13: exit(1); ++v5; } } else { if ( v6 != 1 ) goto LABEL_13; --v4; } for ( i = 0; i <= 1; ++i ) { if ( *(&v4 + i) < 0 || *(&v4 + i) > 4 ) exit(1); } if ( *((_BYTE *)&v8 + 5 * v4 + v5 - 41) == 49 ) exit(1); if ( *((_BYTE *)&v8 + 5 * v4 + v5 - 41) == 35 ) { puts("\nok, the order you enter is the flag!"); exit(0); } } }
|
简化一下, 可以发现v4
和v5
就和x
, y
差不多, 结合5 * v4 + v5
这种和定位一样的表达式, 差不多知道这是个迷宫题, 迷宫的行长度为5
.
_data_start__
为*11110100001010000101111#
, 每五个一分类:
1 2 3 4 5
| *1111 01000 01010 00010 1111#
|
按着0的路径走一遍就拿到flag了.