本文为看雪论坛优秀文章
看雪论坛作者ID：WangONC
R后得到字符串，调换顺序得到最终的flag。
debug
sub_556EC85DF9B4((__int64)&v8, (__int64)&s, v3);
ReadAsm2
input= [0x0, 0x67, 0x6e, 0x62, 0x63, 0x7e, 0x74, 0x62, 0x69, 0x6d,0x55, 0x6a, 0x7f, 0x60, 0x51, 0x66, 0x63, 0x4e, 0x66, 0x7b,0x71, 0x4a, 0x74, 0x76, 0x6b, 0x70, 0x79, 0x66 , 0x1c]for i in range(1,29):print(chr(input[i]^i),end='')
480小时精通c++
py交易
def encode(message):s = ''for i in message:x = ord(i) ^ 32x = x + 16s += chr(x)return base64.b64encode(s)
key1='^SdVkT#S ]`Y\!^)x8fx80ism' #这个字符串是将代码中给出的字符串base64解码后的字符串s=''for i in key1:x=ord(i)-16x=x^32print(chr(x),end='')
Our 16bit wars
Our 16bit Games
maze
result = *(unsigned __int8 *)(a1 + a2 + 8LL * a3);LOBYTE(result) = (_DWORD)result == ' ' || (_DWORD)result == '#';
if ( asc_601060[8 * (signed int)v9 + SHIDWORD(v9)] != '#' )
bt
printf("TQL! TQL! flag: nctf{%s}n", byte_601100);int64 __fastcall sub_400666(signed int a1){int v1; // eax__int64 result; // raxif ( a1 <= 63 ){v1 = dword_601064++;*(&s1 + v1) = byte_601100[a1];sub_400666(2 * a1 + 1);result = sub_400666(2 * (a1 + 1));}return result;}
int64 __fastcall sub_4006BE(signed int a1, __int64 a2){int v2; // eax__int64 result; // raxif ( a1 <= 63 ){sub_4006BE(2 * a1 + 1, a2);v2 = dword_601064++;*(&s1 + v2) = byte_601100[a1];result = sub_4006BE(2 * (a1 + 1), a2);}return result;}
s = []byte_601100 = []dword = 0result = 0for i in range(64):byte_601100.append(i)for i in range(65):s.append(99)def test(a1):global s, result, dwordif (a1 <= 63):=1v1 = dword+ v1] = byte_601100[a1]* a1 + 1)result = test(2 * (a1 + 1))return resulttest(0)print(s)
t=[ 0, 1, 3, 7, 15, 31, 63, 32, 16, 33, 34, 8, 17, 35, 36, 18, 37, 38, 4, 9, 19, 39, 40, 20, 41, 42, 10, 21, 43, 44, 22, 45, 46, 2, 5, 11, 23, 47, 48, 24, 49, 50, 12, 25, 51, 52, 26, 53, 54, 6, 13, 27, 55, 56, 28, 57, 58, 14, 29, 59, 60, 30, 61, 62]q='bcec8d7dcda25d91ed3e0b720cbb6cf202b09fedbc3e017774273ef5d5581794'a=[]for i in range(64):a.append('')for i in range(64):a[t[i]]=q[i]for i in range(64):print(a[i],end='')
WxyVM
if ( *(&byte_604B80 + i) != dword_601060[i] )sub_4005B6();result = byte_6010C0[i + 1];*(&byte_604B80 + result) += v3;
v3 = byte_6010C0[i + 2];
签到题
Single
sub_40070E(&s);sub_40078B(&s, (__int64)&unk_602080);sub_400AD4((__int64)&unk_602080);
size_t __fastcall sub_40070E(const char *a1){size_t result; // raxint i; // [rsp+1Ch] [rbp-14h]if ( strlen(a1) > 0x51 )sub_4006F6(a1);for ( i = 0; ; ++i ){result = strlen(a1);if ( i >= result )break;if ( a1[i] <= 47 || a1[i] > 57 )sub_4006F6(a1);}return result;}
size_t __fastcall sub_40078B(const char *a1, __int64 a2){size_t result; // raxint i; // [rsp+1Ch] [rbp-14h]for ( i = 0; ; ++i ){result = strlen(a1);if ( i >= result )break;if ( a1[i] != 48 ){if ( !a1[i] || *(_BYTE *)(i + a2) )sub_4006F6(a1);*(_BYTE *)(i + a2) = a1[i] - 48;}}return result;}
++s[*(unsigned __int8 *)(9 * i + j + a1)] ++s[*(unsigned __int8 *)(9 * j + k + a1)];for ( l = 1; l <= 9; ++l ){if ( s[l] != 1 )sub_4006F6(s);}
00 03 00 06 00 00 00 00 0006 00 00 00 03 02 04 09 0000 09 00 01 00 07 00 06 0007 04 06 00 00 00 00 00 0000 01 08 00 00 00 06 03 0000 00 00 00 00 00 01 04 0700 08 00 09 00 04 00 07 0000 07 04 02 01 00 00 00 0600 00 00 00 00 03 00 01 00
看雪ID：WangONC
https://bbs.pediy.com/user-home-891116.htm
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”，了解更多！
本文始发于微信公众号（看雪学院）：南航 CG-CTF 题目WP
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论