2018/12/02-南京郵電大學網路攻防訓練平臺-WxyVM
阿新 • • 發佈:2018-12-02
題目連結:https://pan.baidu.com/s/1ihUShawo9-21IwSYhq7NiA 密碼:jrou
題目邏輯很簡單,將輸入在函式sub_4005B6()進行處理,然後和dword_601060陣列中的資料比較。
看一下,sub_4005B6函式,邏輯也很簡單。
我們把byte_6010C0處存放的15000個數據dump下來,然後寫指令碼即可得到flag。
arr = open("E://data","rb").read() flag = [0xc4,0x34,0x22,0xb1,0xd3,0x11, 0x97,0x07,0xdb,0x37,0xc4,0x06,0x1d,0xfc,0x5b,0xed,0x98,0xdf, 0x94,0xd8,0xb3,0x84,0xcc,0x08] for i in range(14997,-1,-3): a = arr[i] b = arr[i+1] c = arr[i+2] if(a == 1): flag[b] -= c flag[b] = flag[b]&0xff if(a == 2): flag[b] += c flag[b] = flag[b] & 0xff if(a == 3): flag[b]^= c flag[b] = flag[b] & 0xff if(a == 4): flag[b] /= c flag[b] = flag[b] & 0xff if(a == 5): flag[b] ^= flag[c] flag[b] = flag[b] & 0xff print(''.join(map(chr,flag)))