攻防世界--open-source

1.打开源码

打开源码

 #include <stdio.h>
 #include <string.h>

 int main(int argc, char *argv[]) {
     if (argc != ) {
         printf("what?\n");
         exit();
     }

     unsigned int first = atoi(argv[]);
     if (first != 0xcafe) {
         printf("you are wrong, sorry.\n");
         exit();
     }

     unsigned int second = atoi(argv[]);
     if (second %  ==  || second %  != ) {
         printf("ha, you won't get it!\n");
         exit();
     }

     if (strcmp("h4cky0u", argv[])) {
         printf("so close, dude!\n");
         exit();
     }

     printf("Brr wrrr grr\n");

     unsigned int hash = first *  + (second % ) *  + strlen(argv[]) - ;

     printf("Get your key: ");
     printf("%x\n", hash);

     return ;
 }

2. 分析

很明显，第29行计算flag，第32行代码输出十六进制形式。第29行代码就是利用argv[1]~argv[3]的数据进行计算。

2.1 argv[1]

    if (first != 0xcafe) {
        printf("you are wrong, sorry.\n");
        exit();
    }

不等于0xcafe就退出，那first=0xcafe

2.2 argv[2]

    if (second %  ==  || second %  != ) {
        printf("ha, you won't get it!\n");
        exit();
    }

满足if条件就退出，我想到第一个不满足的数就是25，second = 25

2.3 argv[3]

    if (strcmp("h4cky0u", argv[])) {
        printf("so close, dude!\n");
        exit();
    }

相等strcmp返回0，退出if条件，那argv[3]=“h4cky0u”

3.get flag!

综上，写出解flag代码

#include <stdio.h>
#include <string.h>

int main(int argc, char* argv[]) {

    int first = 0xcafe;
    int second = ;
    argv[] = "h4cky0u";

    printf("Brr wrrr grr\n");

    unsigned int hash = first *  + (second % ) *  + strlen(argv[]) - ;

    printf("Get your key: ");
    printf("%x\n", hash);

    system("PAUSE");
    return ;
}