攻防世界——game 游戏

下载下来是一个exe文件，可以用IDA打开

我们先运行一下

这是属于第二种类型，完成一个操作后给你flag

这种题我更倾向于动调直接得到flag

我们查壳

没有保护壳，直接32打开

进入字符串界面，找到显示的那部分

int __cdecl main_0(int argc, const char **argv, const char **envp)
{int v4; // [esp+0h] [ebp-FCh]int i; // [esp+DCh] [ebp-20h]unsigned int v6; // [esp+F4h] [ebp-8h] BYREFsub_45A7BE(&unk_50B110);sub_45A7BE(&unk_50B158);sub_45A7BE(&unk_50B1A0);sub_45A7BE(&unk_50B1E8);sub_45A7BE(&unk_50B230);sub_45A7BE(&unk_50B278);sub_45A7BE(&unk_50B2C0);sub_45A7BE(&unk_50B308);sub_45A7BE(&unk_50AFD0);sub_45A7BE("|              by 0x61                                 |\n");sub_45A7BE("|                                                      |\n");sub_45A7BE("|------------------------------------------------------|\n");sub_45A7BE("Play a game\n""The n is the serial number of the lamp,and m is the state of the lamp\n""If m of the Nth lamp is 1,it's on ,if not it's off\n""At first all the lights were closed\n");sub_45A7BE("Now you can input n to change its state\n");sub_45A7BE("But you should pay attention to one thing,if you change the state of the Nth lamp,the state of (N-1)th and (N+1)th w""ill be changed too\n");sub_45A7BE("When all lamps are on,flag will appear\n");sub_457AB4("Now,input n \n");while ( 1 ){do{while ( 1 ){sub_457AB4("input n,n(1-8)\n");sub_459418();sub_45A7BE("n=");sub_4596D4("%d", &v6);sub_45A7BE("\n");if ( v6 < 9 )break;sub_457AB4("sorry,n error,try again\n");}if ( v6 ){sub_4576D6(v6 - 1);}else{for ( i = 0; i < 8; ++i ){if ( (unsigned int)i >= 9 )j____report_rangecheckfailure();byte_532E28[i] = 0;}}j__system("CLS");sub_458054();}while ( byte_532E28[0] != 1|| byte_532E28[1] != 1|| byte_532E28[2] != 1|| byte_532E28[3] != 1|| byte_532E28[4] != 1|| byte_532E28[5] != 1|| byte_532E28[6] != 1|| byte_532E28[7] == 1 );sub_457AB4(v4);}
}

我们找，可以找到这个sub457ab4就是flag的函数