GFSJ0121-【secret-galaxy-300】

签到

题目简介

They say there is an inhabited galaxy next to ours.We've got a strange program that gives information about nearby galaxies. At the first glance one would think it says nothing about the secret one...

这一题給了三个附件然后运行一下exe文件給了5个地标然后ida打开看了看没啥东西再看第一个elf文件也是一样的然后看第二个elf 发现有不一样的

不一样的点是他出现了第六个星系那么我们的题目简介也说了秘密的星系

查看调用发现了flag格式因为有下划线哈哈哈哈

int __libc_csu_gala()
{
  int result; // eax

  sc = off_409014;
  unk_40DAA4 = &byte_40DAC0;
  unk_40DA9C = 31337;
  unk_40DAA0 = 1;
  byte_40DAC0 = off_409004[0][8];
  byte_40DAC1 = off_409010[0][7];
  byte_40DAC2 = off_409008[0][4];
  byte_40DAC3 = off_409004[0][6];
  byte_40DAC4 = off_409004[0][1];
  byte_40DAC5 = off_409008[0][2];
  byte_40DAC6 = 95;
  byte_40DAC7 = off_409004[0][8];
  byte_40DAC8 = off_409004[0][3];
  byte_40DAC9 = off_40900C[0][5];
  byte_40DACA = 95;
  byte_40DACB = off_409004[0][8];
  byte_40DACC = off_409004[0][3];
  byte_40DACD = off_409004[0][4];
  byte_40DACE = off_409010[0][6];
  byte_40DACF = off_409010[0][4];
  byte_40DAD0 = off_409004[0][2];
  byte_40DAD1 = 95;
  byte_40DAD2 = off_409010[0][6];
  result = *((unsigned __int8 *)off_409008[0] + 3);
  byte_40DAD3 = off_409008[0][3];
  byte_40DAD4 = 0;
  return result;
}

我们提取数据也可以在下面下一个断点直接获取flag

off_409004 = "Andromeda"
off_409008 = "Messier"
off_40900C = "Sombrero"
off_409010 = "Triangulum"
off_409014 = "DARK SECRET GALAXY"

exp

off_409004 = [b"Andromeda"]
off_409008 = [b"Messier"]
off_40900C = [b"Sombrero"]
off_409010 = [b"Triangulum"]
off_409014 = [b"DARK SECRET GALAXY"]

byte_40DAC0 = [
    off_409004[0][8],
    off_409010[0][7],
    off_409008[0][4],
    off_409004[0][6],
    off_409004[0][1],
    off_409008[0][2],
    95,
    off_409004[0][8],
    off_409004[0][3],
    off_40900C[0][5],
    95,
    off_409004[0][8],
    off_409004[0][3],
    off_409004[0][4],
    off_409010[0][6],
    off_409010[0][4],
    off_409004[0][2],
    95,
    off_409010[0][6],
    off_409008[0][3],
]

print(bytes(byte_40DAC0).decode())

flag

aliens_are_around_us

GFSJ0121-【secret-galaxy-300】

评论