ezam - 1ens's blog

题目打开

标准的ollvm混肴，用脚本两次去除

得到正常的程序

初步分析是以为多项式相加，疏忽了v17以及前面一大段数据的初始化。想着用z3硬解失败了。
主要逻辑为读取输入，判断是否为数字，然后转换成四进制，走迷宫。
前面的一大段加密是初始化迷宫地图v17，我们可以动调得到一个16*28的迷宫：（做题多尝试

1,0,0,0,0,0,1,1,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,0,
1,1,0,0,0,1,1,0,1,0,0,0,1,0,0,1,0,0,0,0,0,0,0,0,
0,1,0,0,0,1,0,0,1,0,0,0,1,1,1,1,0,0,0,0,0,0,0,0,
0,1,0,0,0,1,0,0,1,0,0,0,0,0,1,0,0,0,0,1,0,0,0,0,
0,1,0,0,0,1,0,0,1,1,1,1,1,1,1,1,0,0,0,1,0,0,0,0,
0,1,1,0,1,1,0,0,1,0,0,0,1,0,0,1,0,0,1,1,0,0,0,0,
0,0,1,0,1,0,0,0,1,0,0,1,1,0,0,1,0,0,1,0,0,0,1,0,
0,0,1,1,1,0,0,0,1,0,1,1,0,0,0,1,0,0,1,0,0,0,1,0,
0,0,0,1,0,0,0,0,1,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,
0,0,0,1,0,0,1,0,1,0,0,0,1,1,0,1,0,0,0,0,1,0,0,0,
0,0,0,1,0,1,1,0,1,0,0,0,1,0,0,1,0,0,0,1,1,0,0,0,
0,1,0,1,1,1,0,0,1,1,1,1,1,1,1,1,0,0,1,1,0,0,0,0,
0,1,1,1,0,0,0,0,0,0,1,0,0,0,1,0,0,0,0,1,0,0,0,0,
0,0,0,1,0,0,0,1,1,1,1,0,0,0,1,1,0,0,0,1,1,0,0,0,
0,0,0,1,0,0,0,1,0,1,0,0,0,0,0,1,1,0,0,0,0,0,0,0,
0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0

下面看一下 sub_400670 函数，结合动调，是十进制转四进制算法。

下面就是迷宫出走方式

得到两条路径，根据函数判断路径长度是45，所以是上面那条
232222322330030000303322223333333222233333333
232222322330030000303322222222222333333300033333333
然后四进制转十进制得到flag

def anyToDecimal(num,n):
   baseStr = {"0":0,"1":1,"2":2,"3":3,"4":4,"5":5,"6":6,"7":7,"8":8,"9":9,
              "a":10,"b":11,"c":12,"d":13,"e":14,"f":15,"g":16,"h":17,"i":18,"j":19}
   new_num = 0
   nNum = len(num) - 1
   for i in num:
       new_num = new_num  + baseStr[i]*pow(n,nNum)
       nNum = nNum -1
   print(new_num)

anyToDecimal('232222322330030000303322223333333222233333333', 4)

flag{902741462666576198076399615}