1.把它拖入到ida中,在main函数,以下代码:
v9 = *(unsigned __int8 *)sub_400D9A((__int64)&i);
if ( (_BYTE)v9 != s[dw_a[v15]] )
sub_400B56((__int64)&i, (__int64)&v14, v9);
++v15;
2.点击进入s数组和dw_a数组可以看到,他们的的值,显然这是关键部分。
3.仔细观察第一步的代码,可以得知计算flag的代码如下:
在这里插入代码片
s='L3t_ME_T3ll_Y0u_S0m3th1ng_1mp0rtant_A_{FL4G}_W0nt_b3_3X4ctly_th4t_345y_t0_c4ptur3_H0wev3r_1T_w1ll_b3_C00l_1F_Y0u_g0t_1t'
a=[0x24,0x0,0x5,0x36,0x65,0x7,0x27,0x26,0x2d,0x1,0x3,0x0,0xd,0x56,0x1, 0x3,0x65,0x3,0x2d,0x16,0x2,0x15,0x3,0x65,0x0,0x29,0x44,0x44,0x1,0x44,0x2b]
t=''
for i in a:
x=int(str(i))
t+=s[x]
print t
flag为:ALEXCTF{W3_L0v3_C_W1th_CL45535}
来源:CSDN
作者:buzhifou01
链接:https://blog.csdn.net/qq_33526144/article/details/103638199