Newbie_calculations

拿到这道题是个应用程序，经过上次的经验就跟程序交互了一下，结果根本交互不了，输入什么东西都没有反应

然后打开ida分析发现有几个函数还有一堆的操作数，看到这一堆东西就没心思分析了，后面才知道原来就是要简化函数

别人的wp

一共有sub_291000、sub_291100和sub_291220三个函数 ，导致程序执行不下去的代码就在这三个函数中，简化函数，重新编写main函数即可得到flag

在这里我就没有那么细心去重新观察函数了，在这里参考了wp的解释

另外，我也学到1）while（）括号里面是可以存在负数的而且是可以运行的

也就意味着最后ans=ans+cnt，以后遇到这种情况可以自己再本地ide模拟一下

sub_291000：

sub_291100：

sub_291220：

通过分析了解了三个函数的具体作用，重新写整体的main函数的脚本即可：

  1 def add(a,b):
  2     return a+b
  3 def mul(a,b):
  4     return a*b
  5 def sub(a,b):
  6     return a-b
  7 flag = [1 for i in range(32)]
  8 v121 = 0
  9 print("Your flag is:")
 10 v3 = mul(flag[0], 1000000000)
 11 v4 = sub(v3, 999999950)
 12 flag[0] =mul(v4, 2)
 13 v5 = add(flag[1], 5000000)
 14 v6 = sub(v5, 6666666)
 15 v7 = add(v6, 1666666)
 16 v8 = add(v7, 45)
 17 v9 = mul(v8, 2)
 18 flag[1] = add(v9, 5)
 19 v10 = mul(flag[2], 1000000000)
 20 v11 = sub(v10, 999999950)
 21 v12 = mul(v11, 2)
 22 flag[2] =add(v12, 2)
 23 v13 = add(flag[3], 55)
 24 v14 = sub(v13, 3)
 25 v15 = add(v14, 4)
 26 flag[3] =sub(v15, 1)
 27 v16 = mul(flag[4], 100000000)
 28 v17 = sub(v16, 99999950)
 29 v18 = mul(v17, 2)
 30 flag[4] =add(v18, 2)
 31 v19 = sub(flag[5], 1)
 32 v20 = mul(v19, 1000000000)
 33 v21 = add(v20, 55)
 34 flag[5] =sub(v21, 3)
 35 v22 = mul(flag[6], 1000000)
 36 v23 = sub(v22, 999975)
 37 flag[6] =mul(v23, 4)
 38 v24 = add(flag[7], 55)
 39 v25 = sub(v24, 33)
 40 v26 = add(v25, 44)
 41 flag[7] =sub(v26, 11)
 42 v27 = mul(flag[8], 10)
 43 v28 = sub(v27, 5)
 44 v29 = mul(v28, 8)
 45 flag[8] =add(v29, 9)
 46 v30 = add(flag[9], 0)
 47 v31 = sub(v30, 0)
 48 v32 = add(v31, 11)
 49 v33 = sub(v32, 11)
 50 flag[9] =add(v33, 53)
 51 v34 = add(flag[10], 49)
 52 v35 = sub(v34, 2)
 53 v36 = add(v35, 4)
 54 flag[10] =sub(v36, 2)
 55 v37 = mul(flag[11], 1000000)
 56 v38 = sub(v37, 999999)
 57 v39 = mul(v38, 4)
 58 flag[11] =add(v39, 50)
 59 v40 = add(flag[12], 1)
 60 v41 = add(v40, 1)
 61 v42 = add(v41, 1)
 62 v43 = add(v42, 1)
 63 v44 = add(v43, 1)
 64 v45 = add(v44, 1)
 65 v46 = add(v45, 10)
 66 flag[12] =add(v46, 32)
 67 v47 = mul(flag[13], 10)
 68 v48 = sub(v47, 5)
 69 v49 = mul(v48, 8)
 70 v50 = add(v49, 9)
 71 flag[13] =add(v50, 48)
 72 v51 = sub(flag[14], 1)
 73 v52 = mul(v51, -294967296)
 74 v53 = add(v52, 55)
 75 flag[14] =sub(v53, 3)
 76 v54 = add(flag[15], 1)
 77 v55 = add(v54, 2)
 78 v56 = add(v55, 3)
 79 v57 = add(v56, 4)
 80 v58 = add(v57, 5)
 81 v59 = add(v58, 6)
 82 v60 = add(v59, 7)
 83 flag[15] =add(v60, 20)
 84 v61 = mul(flag[16], 10)
 85 v62 = sub(v61, 5)
 86 v63 = mul(v62, 8)
 87 v64 = add(v63, 9)
 88 flag[16] =add(v64, 48)
 89 v65 = add(flag[17], 7)
 90 v66 = add(v65, 6)
 91 v67 = add(v66, 5)
 92 v68 = add(v67, 4)
 93 v69 = add(v68, 3)
 94 v70 = add(v69, 2)
 95 v71 = add(v70, 1)
 96 flag[17] =add(v71, 20)
 97 v72 = add(flag[18], 7)
 98 v73 = add(v72, 2)
 99 v74 = add(v73, 4)
100 v75 = add(v74, 3)
101 v76 = add(v75, 6)
102 v77 = add(v76, 5)
103 v78 = add(v77, 1)
104 flag[18] =add(v78, 20)
105 v79 = mul(flag[19], 1000000)
106 v80 = sub(v79, 999999)
107 v81 = mul(v80, 4)
108 v82 = add(v81, 50)
109 flag[19] =sub(v82, 1)
110 v83 = sub(flag[20], 1)
111 v84 = mul(v83, -294967296)
112 v85 = add(v84, 49)
113 flag[20] =sub(v85, 1)
114 v86 = sub(flag[21], 1)
115 v87 = mul(v86, 1000000000)
116 v88 = add(v87, 54)
117 v89 = sub(v88, 1)
118 v90 = add(v89, 1000000000)
119 flag[21] =sub(v90, 1000000000)
120 v91 = add(flag[22], 49)
121 v92 = sub(v91, 1)
122 v93 = add(v92, 2)
123 flag[22] =sub(v93, 1)
124 v94 = mul(flag[23], 10)
125 v95 = sub(v94, 5)
126 v96 = mul(v95, 8)
127 v97 = add(v96, 9)
128 flag[23] =add(v97, 48)
129 v98 = add(flag[24], 1)
130 v99 = add(v98, 3)
131 v100 = add(v99, 3)
132 v101 = add(v100, 3)
133 v102 = add(v101, 6)
134 v103 = add(v102, 6)
135 v104 = add(v103, 6)
136 flag[24] =add(v104, 20)
137 v105 = add(flag[25], 55)
138 v106 = sub(v105, 33)
139 v107 = add(v106, 44)
140 v108 = sub(v107, 11)
141 flag[25] =add(v108, 42)
142 flag[26] =add(flag[26], flag[25])
143 flag[27] =add(flag[27], flag[12])
144 v115 = flag[27]
145 v109 = sub(flag[28], 1)
146 v110 = add(v109, v115)
147 flag[28] =sub(v110, 1)
148 v116 = flag[23]
149 v111 = sub(flag[29], 1)
150 v112 = mul(v111, 1000000)
151 flag[29] =add(v112, v116)
152 v117 = flag[27]
153 v113 = add(flag[30], 1)
154 flag[30] =mul(v113, v117)
155 flag[31] =add(flag[31], flag[30])
156 print("CTF{"+"".join(map(chr,flag))+"}")