[ACTF新生赛2020]Oruga

下载题目

国际惯例，先查壳

64位无壳elf文件

用IDA打开

F5看反编译

发现加密函数sub_78A

点进去看加密算法

发现是一道迷宫题目，JMEW控制上下左右

查看末尾的byte_201020，是迷宫本体

上exp把迷宫打印出来

map=[0x00,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x23,0x23,0x23,0x23,0x00,0x00,0x00,0x23,0x23,0x00,0x00,0x00,0x4f,0x4f,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4f,0x4f,0x00,0x50,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x4c,0x00,0x4f,0x4f,0x00,0x4f,0x4f,0x00,0x50,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x4c,0x00,0x4f,0x4f,0x00,0x4f,0x4f,0x00,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x4c,0x4c,0x00,0x4f,0x4f,0x00,0x00,0x00,0x00,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4f,0x4f,0x00,0x00,0x00,0x00,0x50,0x00,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4d,0x4d,0x4d,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4d,0x4d,0x4d,0x00,0x00,0x00,0x00,0x45,0x45,0x00,0x00,0x00,0x30,0x00,0x4d,0x00,0x4d,0x00,0x4d,0x00,0x00,0x00,0x00,0x45,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x45,0x45,0x54,0x54,0x54,0x49,0x00,0x4d,0x00,0x4d,0x00,0x4d,0x00,0x00,0x00,0x00,0x45,0x00,0x00,0x54,0x00,0x49,0x00,0x4d,0x00,0x4d,0x00,0x4d,0x00,0x00,0x00,0x00,0x45,0x00,0x00,0x54,0x00,0x49,0x00,0x4d,0x00,0x4d,0x00,0x4d,0x21,0x00,0x00,0x00,0x45,0x45]
for i in range(0,16):
    for j in range(0,16):
        if(map[i*16+j]==0):
            print('0',end='')
        elif(map[i*16+j]==33):
            print('!', end='')
        else:
            print('#', end='')
    print()

运行可以得到迷宫本体

0000#0000000####
000##000##000000
00000000##0##000
000#0##0##0##000
000#0##0##0#0000
00##0##0000#0000
00000##0000#0000
#000000000000000
000000000000#000
000000###000#000
0000000###0000##
000#0#0#0#0000#0
00000000000000##
####0#0#0#0000#0
0#0#0#0#0#0000#0
0#0#0#0#0#!000##

手动走一下迷宫就可以得到flag： flag{MEWEMEWJMEWJM}

提交

得分