攻防世界--open-source
2024-10-07 12:23:00
1.打开源码
打开源码
#include <stdio.h>
#include <string.h> int main(int argc, char *argv[]) {
if (argc != ) {
printf("what?\n");
exit();
} unsigned int first = atoi(argv[]);
if (first != 0xcafe) {
printf("you are wrong, sorry.\n");
exit();
} unsigned int second = atoi(argv[]);
if (second % == || second % != ) {
printf("ha, you won't get it!\n");
exit();
} if (strcmp("h4cky0u", argv[])) {
printf("so close, dude!\n");
exit();
} printf("Brr wrrr grr\n"); unsigned int hash = first * + (second % ) * + strlen(argv[]) - ; printf("Get your key: ");
printf("%x\n", hash); return ;
}
2. 分析
很明显,第29行计算flag,第32行代码输出十六进制形式。第29行代码就是利用argv[1]~argv[3]的数据进行计算。
2.1 argv[1]
if (first != 0xcafe) {
printf("you are wrong, sorry.\n");
exit();
}
不等于0xcafe就退出,那first=0xcafe
2.2 argv[2]
if (second % == || second % != ) {
printf("ha, you won't get it!\n");
exit();
}
满足if条件就退出,我想到第一个不满足的数就是25,second = 25
2.3 argv[3]
if (strcmp("h4cky0u", argv[])) {
printf("so close, dude!\n");
exit();
}
相等strcmp返回0,退出if条件,那argv[3]=“h4cky0u”
3.get flag!
综上,写出解flag代码
#include <stdio.h>
#include <string.h> int main(int argc, char* argv[]) { int first = 0xcafe;
int second = ;
argv[] = "h4cky0u"; printf("Brr wrrr grr\n"); unsigned int hash = first * + (second % ) * + strlen(argv[]) - ; printf("Get your key: ");
printf("%x\n", hash); system("PAUSE");
return ;
}
最新文章
- getRequestDispatcher()与sendRedirect()的区别
- HttpStatusCodeResult
- comparison of floating point numbers with equality operator. possible loss of precision while rounding values
- List<;T>;取交集、差集、并集
- C++内存分配的五种方法
- HDOJ1166 敌兵布阵
- Kubernetes(k8s)容器运行时(CRI)
- w7如何安装配置多个tomcat
- PHP – AJAX 与 PHP
- JAVA基础复习与总结<;八>; 缓冲流_数据流_对象流_IO总结
- 3分钟学会如何调度运营海量Redis系统
- Docker桥接宿主机网络与配置固定IP地址
- PKUWC2019 凉凉记
- python接口自动化测试二:常用操作
- TV Show Game 【2-SAT】
- linux权限管理之基本权限
- DHCP服务配置
- Python做web开发,推荐几个能立马上手的小项目
- MySQL抓包工具:MySQL Sniffer 和性能优化
- HDU 4068