GFSJ1095-【toddler_regs】

签到

打开查找字符串有三段还少两端

int stage_2_real()
{
  int i; // [rsp+24h] [rbp+4h]

  Sleep(0x5DCu);
  j_printf("[+] Task 2 checking ");
  for ( i = 0; i < 10; ++i )
  {
    Sleep(0x64u);
    j_printf(".");
  }
  puts(byte_14001AC26);
  g_teamjnu_idx = 184;
  j_strcpy_0(flag, "flag{");
  j_strcat_0(flag, team[g_team_idx]);
  j_strcat_0(flag, "_1s_n1c3_but_");
  j_strcat_0(flag, teamjnu[g_teamjnu_idx]);
  j_strcat_0(flag, "_is_we1rd}");
  return puts("[+] Success: Task 2 finished!");
}

从此处能看到三段flag 还有两个任务

第一个任务

void __fastcall stage_1(int rcx)
{
  int i; // [rsp+24h] [rbp+4h]

  Sleep(0x5DCu);
  j_printf("[+] Task 1 checking ");
  for ( i = 0; i < 10; ++i )
  {
    Sleep(0x64u);
    j_printf(".");
  }
  puts(byte_14001AC26);
  Sleep(0x3E8u);
  if ( rcx == 23 )
  {
    puts("[+] Success: Task 1 finished!");
    g_team_idx = 23;
  }
  else
  {
    puts("[+] Warning: Task 1 failed!");
    j_printf("[+] The argument of this function called is %d, not 23", rcx);
  }
}

g_team_idx = 23
g_teamjnu_idx = 184

两个我们都知道了

然后拼接一下

flag{Xp0int_1s_n1c3_but_Xp0intJNU_is_we1rd}

GFSJ1095-【toddler_regs】

评论