[GUET-CTF2019]number

[GUET-CTF2019]number

由于flag可能的数量为 5 10 < 1 0 7 5^{10}<10^7 510<107 且单次判断复杂度很小，因此可以直接爆破flag。

#include

using namespace std;
char a14[26] = "14#2330#1#0#23##3##042##1";
int dword_601080;
#define pr(x) cout<<#x<<": "< '4' || a1[i] <= '/')
                goto LABEL_2;
        }
        return 1LL;
    } else {
        LABEL_2:
        puts("Wrong!");
        return 0LL;
    }
}

ull *sub_400758(char *a1, signed int a2, signed int a3) {
    char v5; // [rsp+1Fh] [rbp-11h]
    // [rsp+28h] [rbp-8h]
    if (a2 >= a3)return 0LL;
    v5 = a1[a2];
    if (v5 == ' ' || v5 == 'n')
        return 0LL;
    ull *v6 = (ull *) malloc(0x18uLL);
    v6[0] = v5;
    v6[1] = ull(sub_400758(a1, 2 * a2 + 1, a3));
    v6[2] = ull(sub_400758(a1, 2 * (a2 + 1), a3));
    return v6;
}

void sub_400807(char *a1, char *a2) {
    if (a1) {
        sub_400807(*((char **) a1 + 1), a2);
        a2[dword_601080++] = *a1;
        return sub_400807(*((char **) a1 + 2), a2);
    }
}

__int64 __fastcall sub_400881(char *a1) {
    __int64 result; // rax

    a14[2] = *a1;
    a14[7] = a1[1];
    a14[9] = a1[2];
    a14[11] = a1[3];
    a14[14] = a1[4];
    a14[15] = a1[5];
    a14[17] = a1[6];
    a14[18] = a1[7];
    a14[22] = a1[8];
    result = (unsigned __int8) a1[9];
    a14[23] = a1[9];
    return result;
}

__int64 sub_400917() {
    unsigned int v1; // [rsp+0h] [rbp-10h]
    int i; // [rsp+4h] [rbp-Ch]
    int j; // [rsp+8h] [rbp-8h]
    int k; // [rsp+Ch] [rbp-4h]

    v1 = 1;
    for (i = 0; i <= 4; ++i) {
        for (j = 0; j <= 4; ++j) {
            for (k = j + 1; k <= 4; ++k) {
                if (a14[5 * i + j] == a14[5 * i + k])
                    v1 = 0;
                if (a14[5 * j + i] == a14[5 * k + i])
                    v1 = 0;
            }
        }
    }
    return v1;
}

bool check(char v5[]) {
    dword_601080 = 0;
    memcpy(a14, "14#2330#1#0#23##3##042##1", sizeof(char) * 26);
    char *v4; // [rsp+8h] [rbp-38h]
    // [rsp+10h] [rbp-30h] BYREF
    char v6[11]; // [rsp+20h] [rbp-20h] BYREF

    memset(v6, 0, sizeof(v6));
    if ((unsigned int) sub_4006D6(v5)) {
        v4 = (char *) sub_400758(v5, 0, 10);
        sub_400807(v4, v6);
        v6[10] = 0;
        sub_400881(v6);
        if ((unsigned int) sub_400917()) {
            puts("TQL!");
            printf("flag{");
            printf("%s", v5);
            puts("}");
            return true;
        } else {
//            puts("your are cxk!!");
            return false;
        }
    }
    return false;
}

char v5[11];

void dfs(int u) {
    if (u == 10) {
        check(v5);
        return;
    }
    for (int i = 0; i <= 4; i++)
        v5[u] = '0' + i, dfs(u + 1);
}

int main() {
    dfs(0);
    return 0;
}

运行结果

TQL!
flag{1134240024}