bj777的blog

记录学习每一瞬间

0%

蓝帽杯wp

发表于

蓝帽杯

这蓝帽杯太卷了，差点被干到复赛都进不了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
int sub_7FF6308E5890()
{
  const char *v0; // rax
  _QWORD *input; // rax
  __int64 v2; // rdx
  _QWORD *v3; // rsi
  __int64 v4; // rdi
  __int64 v5; // rbx
  _QWORD *v6; // rax
  _QWORD *v7; // rdi
  __int64 v8; // rdx
  _QWORD *v9; // rax
  unsigned __int64 *v11; // rsi
  __int64 v12; // rbx
  __int64 v13; // rcx
  _QWORD *v14; // rbp
  __int64 v15; // rdx
  unsigned __int64 v16; // rdi
  __int64 v17; // rbx
  unsigned __int64 *v18; // rbp
  __int64 v19; // rdx
  _QWORD *v20; // rax
  __int64 v21; // rcx
  __int64 v22; // rdx
  unsigned __int64 v23; // rsi
  __int64 v24; // rdi
  __int64 v25; // rdx
  unsigned __int64 v26; // rcx
  __m128i v27; // xmm4
  __int64 v28; // rdi
  __int64 v29; // rdx
  unsigned __int64 v30; // rcx
  __m128i v31; // [rsp+20h] [rbp-78h] BYREF
  __m128i v32; // [rsp+30h] [rbp-68h] BYREF
  __int64 v33; // [rsp+40h] [rbp-58h] BYREF
  __int64 v34; // [rsp+48h] [rbp-50h]
  __m128i v35; // [rsp+50h] [rbp-48h] BYREF
  __int64 v36; // [rsp+60h] [rbp-38h] BYREF
  __int64 v37; // [rsp+68h] [rbp-30h]

  sub_7FF6308E0500(&unk_7FF6308E57E0);
  sub_7FF6308E0500(&unk_7FF6308E57D0);
  sub_7FF6308E0500(&unk_7FF6308E57C0);
  sub_7FF6308E0500(&unk_7FF6308E57B0);
  sub_7FF6308E0500(&unk_7FF6308E57A0);
  sub_7FF6308E0500(&unk_7FF6308E5790);
  sub_7FF6308E0500(&unk_7FF6308E5780);
  sub_7FF6308E0500(&unk_7FF6308E5770);
  sub_7FF6308E0500(&unk_7FF6308E5760);
  printf(Format, 1i64);
  v0 = (const char *)off_7FF6308E8100(0i64);
  LODWORD(input) = scanf(v0);
  v3 = input;
  if ( input )
    *(input - 2) += 8i64;
  if ( qword_7FF6308FF200 )
  {
    v4 = *(_QWORD *)(qword_7FF6308FF200 - 16);
    v2 = qword_7FF6308FF200 - 16;
    *(_QWORD *)(qword_7FF6308FF200 - 16) = v4 - 8;
    if ( (unsigned __int64)(v4 - 8) <= 7 )
      sub_7FF6308D9580(off_7FF6308EA350 + 3, v2);
  }
  qword_7FF6308FF200 = (__int64)v3;
  v5 = 0i64;
  v6 = (_QWORD *)sub_7FF6308DC000(5i64, v2);
  v7 = v6;
  if ( !v6 )
  {
    if ( v3 )
      sub_7FF6308DF460(0i64, -1i64);
    sub_7FF6308DF460(0i64, -1i64);
  }
  if ( !v3 )
  {
    if ( !*v6 )
      sub_7FF6308DF460(0i64, -1i64);
    sub_7FF6308DF460(0i64, -1i64);
  }
  do
  {
    if ( *v6 <= (unsigned __int64)v5 )
      sub_7FF6308DF460(v5, *v6 - 1i64);
    v8 = *v3;
    if ( *v3 <= (unsigned __int64)v5 )
      sub_7FF6308DF460(v5, v8 - 1);
    *((_BYTE *)v6 + v5 + 16) = *((_BYTE *)v3 + v5 + 16);
    ++v5;
  }
  while ( v5 <= 4 );
  if ( *v6 != 5i64 )
    goto LABEL_15;
  v9 = v6 + 2;
  if ( *((_DWORD *)v7 + 4) != dword_7FF6308E9E00 )// 判断前五个是不是flag{
    goto LABEL_15;
  if ( *((_BYTE *)v9 + 4) != byte_7FF6308E9E04 )
    goto LABEL_15;
  v11 = (unsigned __int64 *)qword_7FF6308FF200;
  if ( !qword_7FF6308FF200 || *(_QWORD *)qword_7FF6308FF200 != '*' || *(_BYTE *)(qword_7FF6308FF200 + 57) != '}' )// 判断位数是否是42，并且最后一位是否是}
    goto LABEL_15;
  v12 = 0i64;
  v14 = (_QWORD *)sub_7FF6308DC000(18i64, v8);
  if ( !v14 )
    sub_7FF6308DF460(0i64, -1i64);
  do
  {
    v15 = *v14;
    if ( *v14 <= (unsigned __int64)v12 )
      sub_7FF6308DF460(v12, v15 - 1);
    v16 = v12 + 5;
    if ( v12 + 5 < 0 || v16 < v12 )
      sub_7FF6308DAFB0(v13, v15);
    if ( *v11 <= v16 )
      sub_7FF6308DF460(v12 + 5, *v11 - 1);
    *((_BYTE *)v14 + v12++ + 16) = *((_BYTE *)v11 + v16 + 16);// 提取前18位
  }
  while ( v12 <= 17 );
  v17 = 0i64;
  sub_7FF6308E4380((__int64)v14, 10i64, &xmmword_7FF6308FF1B0);// 能看到取了前18位并且检验是否有-
  v18 = (unsigned __int64 *)qword_7FF6308FF200;
  v20 = (_QWORD *)sub_7FF6308DC000(18i64, v19);
  if ( !v20 )
  {
    if ( v18 )
      sub_7FF6308DF460(0i64, -1i64);
    sub_7FF6308DF460(0i64, -1i64);
  }
  if ( !v18 )
  {
    if ( !*v20 )
      sub_7FF6308DF460(0i64, -1i64);
    sub_7FF6308DF460(23i64, -1i64);
  }
  do
  {
    v22 = *v20;
    if ( *v20 <= (unsigned __int64)v17 )
      sub_7FF6308DF460(v17, v22 - 1);
    v23 = v17 + 23;
    if ( v17 + 23 < 0 || v23 < v17 )
      sub_7FF6308DAFB0(v21, v22);
    if ( *v18 <= v23 )
      sub_7FF6308DF460(v17 + 23, *v18 - 1);
    *((_BYTE *)v20 + v17++ + 16) = *((_BYTE *)v18 + v23 + 16);// 后18位
  }
  while ( v17 <= 17 );
  sub_7FF6308E4380((__int64)v20, 10i64, &xmmword_7FF6308FF170);
  sub_7FF6308E4380((__int64)&unk_7FF6308E9DC0, 10i64, &xmmword_7FF6308FF190);
  sub_7FF6308E4380((__int64)&unk_7FF6308E9D80, 10i64, &xmmword_7FF6308FF1A0);
  v32 = _mm_loadu_si128((const __m128i *)&xmmword_7FF6308FF190);
  v31 = _mm_loadu_si128((const __m128i *)&xmmword_7FF6308FF1B0);
  if ( !(unsigned __int8)sub_7FF6308E50C0(&v32, &v31) )//判断范围
    goto LABEL_15;
  v32 = _mm_loadu_si128((const __m128i *)&xmmword_7FF6308FF1B0);
  v31 = _mm_loadu_si128((const __m128i *)&xmmword_7FF6308FF1A0);
  if ( !(unsigned __int8)sub_7FF6308E50C0(&v32, &v31) )
    goto LABEL_15;
  v33 = 0i64;
  v34 = 0i64;
  v32 = (__m128i)xmmword_7FF6308FF1B0;
  v31 = (__m128i)xmmword_7FF6308FF1B0;
  math(&v32, &v31, (__int64)&v33);              // 前两个参数存着前18位
  v24 = v33;
  if ( v33 )
    *(_QWORD *)(v33 - 16) += 8i64;
  if ( (_QWORD)xmmword_7FF6308FF1D0 )
  {
    v25 = xmmword_7FF6308FF1D0 - 16;
    v26 = *(_QWORD *)(xmmword_7FF6308FF1D0 - 16) - 8i64;
    *(_QWORD *)(xmmword_7FF6308FF1D0 - 16) = v26;
    if ( v26 <= 7 )
      sub_7FF6308D9580(off_7FF6308EA350 + 3, v25);
  }
  *(_QWORD *)&xmmword_7FF6308FF1D0 = v24;
  v35 = 0ui64;
  BYTE8(xmmword_7FF6308FF1D0) = v34;
  v32 = (__m128i)xmmword_7FF6308FF170;
  v31 = (__m128i)xmmword_7FF6308FF170;
  math(&v32, &v31, (__int64)&v35);              // 相乘得到
  v27 = _mm_load_si128(&v35);
  v36 = 0i64;
  v37 = 0i64;
  v32 = v27;
  multiply(&v32, 11i64, &v36);                  // 也就是后18位相乘之后在乘11
  v28 = v36;
  if ( v36 )
    *(_QWORD *)(v36 - 16) += 8i64;
  if ( (_QWORD)xmmword_7FF6308FF160 )
  {
    v29 = xmmword_7FF6308FF160 - 16;
    v30 = *(_QWORD *)(xmmword_7FF6308FF160 - 16) - 8i64;
    *(_QWORD *)(xmmword_7FF6308FF160 - 16) = v30;
    if ( v30 <= 7 )
      sub_7FF6308D9580(off_7FF6308EA350 + 3, v29);
  }
  *(_QWORD *)&xmmword_7FF6308FF160 = v28;
  v32 = _mm_loadu_si128((const __m128i *)&xmmword_7FF6308FF1D0);
  BYTE8(xmmword_7FF6308FF160) = v37;
  v31 = _mm_loadu_si128((const __m128i *)&xmmword_7FF6308FF160);
  jian(v32.m128i_i64, v31.m128i_i64, (__int64)&xmmword_7FF6308FF1E0);// 进行减法
  sub_7FF6308E4380((__int64)&unk_7FF6308E9D50, 10i64, &xmmword_7FF6308FF1C0);
  v32 = _mm_loadu_si128((const __m128i *)&xmmword_7FF6308FF1E0);
  v31 = _mm_loadu_si128((const __m128i *)&xmmword_7FF6308FF1C0);
  if ( (unsigned __int8)cmp(&v32, &v31) )       // 对比数据
  {
    qword_7FF6308ED6A0 = 1i64;
  }
  else
  {
LABEL_15:
    if ( qword_7FF6308ED6A0 != 1 )
      return printf(&byte_7FF6308E9D00, 1i64);
  }
  return printf(a0, 1i64);
}

这题dump出来是不对的，直接调试程序找到主要逻辑，但这个逻辑很难看懂啊。最后发现是个简单的运算，算的就是x^2 - 11 *y^2 = 9,当x的范围在

100000000000000000<x<999999999999999999时的情况，解一下方程得到flag，注意要加一个-才对