拿到这道题是个应用程序，经过上次的经验就跟程序交互了一下，结果根本交互不了，输入什么东西都没有反应
然后打开ida分析发现有几个函数还有一堆的操作数，看到这一堆东西就没心思分析了，后面才知道原来就是要简化函数
别人的wp
一共有sub_291000、sub_291100和sub_291220三个函数 ，导致程序执行不下去的代码就在这三个函数中，简化函数，重新编写main函数即可得到flag
在这里我就没有那么细心去重新观察函数了，在这里参考了wp的解释
另外，我也学到1）while（）括号里面是可以存在负数的而且是可以运行的
也就意味着最后ans=ans+cnt，以后遇到这种情况可以自己再本地ide模拟一下
sub_291000：
sub_291100：
sub_291220：
通过分析了解了三个函数的具体作用，重新写整体的main函数的脚本即可：
1 def add(a,b):
2 return a+b
3 def mul(a,b):
4 return a*b
5 def sub(a,b):
6 return a-b
7 flag = [1 for i in range(32)]
8 v121 = 0
9 print("Your flag is:")
10 v3 = mul(flag[0], 1000000000)
11 v4 = sub(v3, 999999950)
12 flag[0] =mul(v4, 2)
13 v5 = add(flag[1], 5000000)
14 v6 = sub(v5, 6666666)
15 v7 = add(v6, 1666666)
16 v8 = add(v7, 45)
17 v9 = mul(v8, 2)
18 flag[1] = add(v9, 5)
19 v10 = mul(flag[2], 1000000000)
20 v11 = sub(v10, 999999950)
21 v12 = mul(v11, 2)
22 flag[2] =add(v12, 2)
23 v13 = add(flag[3], 55)
24 v14 = sub(v13, 3)
25 v15 = add(v14, 4)
26 flag[3] =sub(v15, 1)
27 v16 = mul(flag[4], 100000000)
28 v17 = sub(v16, 99999950)
29 v18 = mul(v17, 2)
30 flag[4] =add(v18, 2)
31 v19 = sub(flag[5], 1)
32 v20 = mul(v19, 1000000000)
33 v21 = add(v20, 55)
34 flag[5] =sub(v21, 3)
35 v22 = mul(flag[6], 1000000)
36 v23 = sub(v22, 999975)
37 flag[6] =mul(v23, 4)
38 v24 = add(flag[7], 55)
39 v25 = sub(v24, 33)
40 v26 = add(v25, 44)
41 flag[7] =sub(v26, 11)
42 v27 = mul(flag[8], 10)
43 v28 = sub(v27, 5)
44 v29 = mul(v28, 8)
45 flag[8] =add(v29, 9)
46 v30 = add(flag[9], 0)
47 v31 = sub(v30, 0)
48 v32 = add(v31, 11)
49 v33 = sub(v32, 11)
50 flag[9] =add(v33, 53)
51 v34 = add(flag[10], 49)
52 v35 = sub(v34, 2)
53 v36 = add(v35, 4)
54 flag[10] =sub(v36, 2)
55 v37 = mul(flag[11], 1000000)
56 v38 = sub(v37, 999999)
57 v39 = mul(v38, 4)
58 flag[11] =add(v39, 50)
59 v40 = add(flag[12], 1)
60 v41 = add(v40, 1)
61 v42 = add(v41, 1)
62 v43 = add(v42, 1)
63 v44 = add(v43, 1)
64 v45 = add(v44, 1)
65 v46 = add(v45, 10)
66 flag[12] =add(v46, 32)
67 v47 = mul(flag[13], 10)
68 v48 = sub(v47, 5)
69 v49 = mul(v48, 8)
70 v50 = add(v49, 9)
71 flag[13] =add(v50, 48)
72 v51 = sub(flag[14], 1)
73 v52 = mul(v51, -294967296)
74 v53 = add(v52, 55)
75 flag[14] =sub(v53, 3)
76 v54 = add(flag[15], 1)
77 v55 = add(v54, 2)
78 v56 = add(v55, 3)
79 v57 = add(v56, 4)
80 v58 = add(v57, 5)
81 v59 = add(v58, 6)
82 v60 = add(v59, 7)
83 flag[15] =add(v60, 20)
84 v61 = mul(flag[16], 10)
85 v62 = sub(v61, 5)
86 v63 = mul(v62, 8)
87 v64 = add(v63, 9)
88 flag[16] =add(v64, 48)
89 v65 = add(flag[17], 7)
90 v66 = add(v65, 6)
91 v67 = add(v66, 5)
92 v68 = add(v67, 4)
93 v69 = add(v68, 3)
94 v70 = add(v69, 2)
95 v71 = add(v70, 1)
96 flag[17] =add(v71, 20)
97 v72 = add(flag[18], 7)
98 v73 = add(v72, 2)
99 v74 = add(v73, 4)
100 v75 = add(v74, 3)
101 v76 = add(v75, 6)
102 v77 = add(v76, 5)
103 v78 = add(v77, 1)
104 flag[18] =add(v78, 20)
105 v79 = mul(flag[19], 1000000)
106 v80 = sub(v79, 999999)
107 v81 = mul(v80, 4)
108 v82 = add(v81, 50)
109 flag[19] =sub(v82, 1)
110 v83 = sub(flag[20], 1)
111 v84 = mul(v83, -294967296)
112 v85 = add(v84, 49)
113 flag[20] =sub(v85, 1)
114 v86 = sub(flag[21], 1)
115 v87 = mul(v86, 1000000000)
116 v88 = add(v87, 54)
117 v89 = sub(v88, 1)
118 v90 = add(v89, 1000000000)
119 flag[21] =sub(v90, 1000000000)
120 v91 = add(flag[22], 49)
121 v92 = sub(v91, 1)
122 v93 = add(v92, 2)
123 flag[22] =sub(v93, 1)
124 v94 = mul(flag[23], 10)
125 v95 = sub(v94, 5)
126 v96 = mul(v95, 8)
127 v97 = add(v96, 9)
128 flag[23] =add(v97, 48)
129 v98 = add(flag[24], 1)
130 v99 = add(v98, 3)
131 v100 = add(v99, 3)
132 v101 = add(v100, 3)
133 v102 = add(v101, 6)
134 v103 = add(v102, 6)
135 v104 = add(v103, 6)
136 flag[24] =add(v104, 20)
137 v105 = add(flag[25], 55)
138 v106 = sub(v105, 33)
139 v107 = add(v106, 44)
140 v108 = sub(v107, 11)
141 flag[25] =add(v108, 42)
142 flag[26] =add(flag[26], flag[25])
143 flag[27] =add(flag[27], flag[12])
144 v115 = flag[27]
145 v109 = sub(flag[28], 1)
146 v110 = add(v109, v115)
147 flag[28] =sub(v110, 1)
148 v116 = flag[23]
149 v111 = sub(flag[29], 1)
150 v112 = mul(v111, 1000000)
151 flag[29] =add(v112, v116)
152 v117 = flag[27]
153 v113 = add(flag[30], 1)
154 flag[30] =mul(v113, v117)
155 flag[31] =add(flag[31], flag[30])
156 print("CTF{"+"".join(map(chr,flag))+"}")
View Code
标签：10,Newbie,sub,flag,20,add,calculations,mul From： https://www.cnblogs.com/lhqrusht0p/p/17661374.html