西湖论剑2020 Writeup

[Rev] Cellular.exe

唯一一道做出来的题，还是走了狗屎运。

首先是主函数：

int __cdecl main(int argc, const char **argv, const char **envp)
{
  Honeycomb *v3; // ebx
  char *Format; // [esp+0h] [ebp-58h]
  int i; // [esp+28h] [ebp-30h]
  Honeycomb *honeyComb1; // [esp+2Ch] [ebp-2Ch]
  char v8; // [esp+30h] [ebp-28h]

  _alloca((size_t)Format);
  __main();
  memset(&v8, 0, 0x1Au);
  v3 = (Honeycomb *)operator new(8u);
  Honeycomb::Honeycomb(v3);
  honeyComb1 = v3;
  for ( i = 0; i <= 4; ++i )
    Honeycomb::IncDepth(honeyComb1);
  printf("Path:");
  scanf("%25s", &v8);
  if ( (unsigned __int8)Honeycomb::CheckFlag(honeyComb1, &v8) )
  {
    puts("Congrulations!");
    puts("The flag is md5(Path)!");
  }
  else
  {
    puts("Wrong~");
  }
  system("pause");
  return 0;
}

先初始化了一些结构体实例，然后读入用户输入，使用checkFlag进行校验。

checkFlag:

signed int __cdecl Honeycomb::CheckFlag(Honeycomb *this, char *Str)
{
  signed int v3; // [esp+14h] [ebp-14h]
  char direction; // [esp+1Bh] [ebp-Dh]
  size_t i; // [esp+20h] [ebp-8h]
  Hexagon *hexagon; // [esp+24h] [ebp-4h]

  hexagon = this->head;
  for ( i = 0; i < strlen(Str); ++i )
  {
    direction = Str[i];
    if ( direction == 'L' )
    {
      if ( this->head == hexagon )
      {
        if ( !(unsigned __int8)Honeycomb::RotateL(this, &hexagon, 0) )
          return 0;
      }
      else if ( !(unsigned __int8)Honeycomb::Clockwise(this, &hexagon) )
      {
        return 0;
      }
    }
    else if ( direction == 'R' )
    {
      if ( this->head == hexagon )
      {
        if ( !(unsigned __int8)Honeycomb::RotateR(this, &hexagon, 0) )
          return 0;
      }
      else if ( !(unsigned __int8)Honeycomb::Counterclockwise(this, &hexagon) )
      {
        return 0;
      }
    }
  }
  v3 = 0;
  if ( hexagon->data == '#' && Honeycomb::CheckUseCount(this) == 94 )
    v3 = 1;
  return v3;
}

用户的输入只有L，R，然后读完用户的输入，走完整条路径。

根据题目提示，应该是根据用户的输入判断是否可以成功搭建蜂巢。

此时可以根据签名的初始化函数猜测结构体偏移对应的值的意义。

然后进入初始化函数，RotateL/R函数，Clockwise函数，发现太复杂了根本看不下去。

可以使用深度优先搜索算法找到所有走完迷宫的路径，然后依次尝试这些找到的路径。

插桩可以查看是否走完了对应的路径。

这里使用更为简单的复制代码然后修改，因为我不怎么会插桩

#include <string>
#include <iostream>

using namespace std;

struct Hexagon{
int data;
int is_king;
Hexagon *fd;
Hexagon *bk;
Hexagon *d1;
};
struct Honeycomb{
Hexagon *head;
int head_num;
};
char map[] = "*-----++++--++--------------------------------+++-#-----------++-------------------+++++++++----+++---++++++++---++++---+------+++++++++++++++++++---+";
int g_num=0;
unsigned char pathL[]={0x1,0x1,0x1,0x1,0x1,0x2,0x1,0x1,0x3,0x2,0x1,0x1,0x3,0x2,0x3,0x1,0x3,0x2,0x3,0x2,0x3,0x2,0x3,0x2,0x1,0x2,0x3,0x2,0x1,0x1,0x3,0x2,0x1,0x1,0x3,0x2,0x1,0x3,0x2,0x1,0x1,0x3,0x2,0x1,0x3,0x3,0x2,0x1,0x3,0x2,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0};
signed int RotateL(Honeycomb *hc, Hexagon **a2, int a3)
{
  char v4; // [esp+3h] [ebp-15h]
  signed int i; // [esp+8h] [ebp-10h]
  Hexagon *v7; // [esp+Ch] [ebp-Ch]
  Hexagon *v8; // [esp+10h] [ebp-8h]
  Hexagon *v9; // [esp+14h] [ebp-4h]

  for ( i = 0; i <= 4; ++i )
  {
    v9 = (*a2)->fd;
    v8 = (*a2)->bk;
    v7 = (*a2)->d1;
    v4 = pathL[5 * a3 + i];
    if ( v4 == 2 )
    {
      if ( v8->data == '+' )
        return 0;
      if ( (v8->data != '-' || v8->is_king) && v9->data != 35 )
      {
        if ( v8->is_king == 1 )
          return 1;
      }
      else
      {
        *a2 = v8;
        (*a2)->is_king = 1;
      }
    }
    else if ( v4 > 2 )
    {
      if ( v4 == 3 )
      {
        if ( v7->data == 43 )
          return 0;
        if ( (v7->data != 45 || v7->is_king) && v9->data != 35 )
        {
          if ( v7->is_king == 1 )
            return 1;
        }
        else
        {
          *a2 = v7;
          (*a2)->is_king = 1;
        }
      }
    }
    else if ( v4 == 1 )
    {
      if ( v9->data == 43 )
        return 0;
      if ( (v9->data != 45 || v9->is_king) && v9->data != 35 )
      {
        if ( v9->is_king == 1 )
          return 1;
      }
      else
      {
        *a2 = v9;
        (*a2)->is_king = 1;
      }
    }
  }
  return 1;
}
int __cdecl DirectionL(Honeycomb *hc, Hexagon **a2, int a3, int a4, int a5)
{
  Hexagon *v7; // [esp+10h] [ebp-Ch]
  Hexagon *v8; // [esp+14h] [ebp-8h]
  Hexagon *v9; // [esp+18h] [ebp-4h]

  v9 = (*a2)->fd;
  v8 = (*a2)->bk;
  v7 = (*a2)->d1;
  if ( v9->is_king == 1 && v8->is_king == 1 )
    return (unsigned __int8)RotateL(hc, a2, a3);
  if ( v9->is_king == 1 && v7->is_king == 1 )
    return (unsigned __int8)RotateL(hc, a2, a4);
  if ( v8->is_king != 1 || v7->is_king != 1 )
    return 0;
  return (unsigned __int8)RotateL(hc, a2, a5);
}
int Clockwise(Honeycomb *hc, Hexagon **a2)
{
  Hexagon *v2; // ST20_4
  Hexagon *v5; // [esp+18h] [ebp-14h]
  Hexagon *v6; // [esp+1Ch] [ebp-10h]
  Hexagon *v7; // [esp+24h] [ebp-8h]
  Hexagon *v8; // [esp+28h] [ebp-4h]

  v8 = (*a2)->fd;
  v7 = (*a2)->bk;
  v2 = (*a2)->d1;
  v6 = (*a2)->bk->fd;
  v5 = (*a2)->fd->bk;
  if ( v8->data == 42 || v7->data == 42 )
    return (unsigned __int8)RotateL(hc, a2, 6);
  if ( v6->bk->bk == *a2 && v5->fd->fd == *a2 )
    return (unsigned __int8)DirectionL(hc, a2, 4, 1, 8);
  if ( v8->bk == *a2 && v7->bk == *a2 )
    return (unsigned __int8)DirectionL(hc, a2, 6, 7, 2);
  if ( v7->fd == *a2 && v8->fd == *a2 )
    return (unsigned __int8)DirectionL(hc, a2, 9, 5, 3);
  if ( v6->bk->bk == *a2 )
    return (unsigned __int8)DirectionL(hc, a2, 9, 1, 8);
  if ( v5->fd->fd == *a2 )
    return (unsigned __int8)DirectionL(hc, a2, 4, 7, 8);
  return (unsigned __int8)DirectionL(hc, a2, 9, 7, 8);
}

unsigned char pathR[]={0x2,0x2,0x2,0x2,0x2,0x1,0x2,0x2,0x3,0x1,0x2,0x2,0x3,0x1,0x3,0x2,0x3,0x1,0x3,0x1,0x3,0x1,0x3,0x1,0x2,0x1,0x3,0x1,0x2,0x2,0x3,0x1,0x2,0x2,0x3,0x1,0x2,0x3,0x1,0x2,0x2,0x3,0x1,0x2,0x3,0x3,0x1,0x2,0x3,0x1,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0};
signed int RotateR(Honeycomb *hc, Hexagon **a2, int a3)
{
  char v4; // [esp+3h] [ebp-15h]
  signed int i; // [esp+8h] [ebp-10h]
  Hexagon *v7; // [esp+Ch] [ebp-Ch]
  Hexagon *v8; // [esp+10h] [ebp-8h]
  Hexagon *v9; // [esp+14h] [ebp-4h]

  for ( i = 0; i <= 4; ++i )
  {
    v9 = (*a2)->fd;
    v8 = (*a2)->bk;
    v7 = (*a2)->d1;
    v4 = pathR[5 * a3 + i];
    if ( v4 == 2 )
    {
      if ( v8->data == 43 )
        return 0;
      if ( (v8->data != '-' || v8->is_king) && v9->data != '#' )
      {
        if ( v8->is_king == 1 )
          return 1;
      }
      else
      {
        *a2 = v8;
        (*a2)->is_king = 1;
      }
    }
    else if ( v4 > 2 )
    {
      if ( v4 == 3 )
      {
        if ( v7->data == 43 )
          return 0;
        if ( (v7->data != 45 || v7->is_king) && v9->data != 35 )
        {
          if ( v7->is_king == 1 )
            return 1;
        }
        else
        {
          *a2 = v7;
          (*a2)->is_king = 1;
        }
      }
    }
    else if ( v4 == 1 )
    {
      if ( v9->data == 43 )
        return 0;
      if ( (v9->data != 45 || v9->is_king) && v9->data != 35 )
      {
        if ( v9->is_king == 1 )
          return 1;
      }
      else
      {
        *a2 = v9;
        (*a2)->is_king = 1;
      }
    }
  }
  return 1;
}
int __cdecl DirectionR(Honeycomb *hc, Hexagon **a2, int a3, int a4, int a5)
{
  Hexagon *v7; // [esp+10h] [ebp-Ch]
  Hexagon *v8; // [esp+14h] [ebp-8h]
  Hexagon *v9; // [esp+18h] [ebp-4h]

  v9 = (*a2)->fd;
  v8 = (*a2)->bk;
  v7 = (*a2)->d1;
  if ( v9->is_king == 1 && v8->is_king == 1 )
    return (unsigned __int8)RotateR(hc, a2, a3);
  if ( v9->is_king == 1 && v7->is_king == 1 )
    return (unsigned __int8)RotateR(hc, a2, a4);
  if ( v8->is_king != 1 || v7->is_king != 1 )
    return 0;
  return (unsigned __int8)RotateR(hc, a2, a5);
}
int Counterclockwise(Honeycomb *hc, Hexagon **a2)
{
  Hexagon *v4; // [esp+18h] [ebp-10h]
  Hexagon *v5; // [esp+1Ch] [ebp-Ch]
  Hexagon *v6; // [esp+20h] [ebp-8h]
  Hexagon *v7; // [esp+24h] [ebp-4h]

  v7 = (*a2)->fd;
  v6 = (*a2)->bk;
  v5 = (*a2)->bk->fd;
  v4 = (*a2)->fd->bk;
  if ( v7->data == 42 || v6->data == 42 )
    return (unsigned __int8)RotateR(hc, a2, 6);
  if ( v5->bk->bk == *a2 && v4->fd->fd == *a2 )
    return (unsigned __int8)DirectionR(hc, a2, 4, 8, 1);
  if ( v7->bk == *a2 && v6->bk == *a2 )
    return (unsigned __int8)DirectionR(hc, a2, 9, 3, 5);
  if ( v6->fd == *a2 && v7->fd == *a2 )
    return (unsigned __int8)DirectionR(hc, a2, 6, 2, 7);
  if ( v5->bk->bk == *a2 )
    return (unsigned __int8)DirectionR(hc, a2, 4, 8, 7);
  if ( v4->fd->fd == *a2 )
    return (unsigned __int8)DirectionR(hc, a2, 9, 8, 1);
  return (unsigned __int8)DirectionR(hc, a2, 9, 8, 7);
}
int __cdecl CheckUseCount(Honeycomb *hc)
{
  Hexagon *v1; // ST10_4
  int l; // [esp+0h] [ebp-18h]
  int j; // [esp+4h] [ebp-14h]
  signed int k; // [esp+4h] [ebp-14h]
  int i; // [esp+8h] [ebp-10h]
  Hexagon *v7; // [esp+Ch] [ebp-Ch]
  Hexagon *v8; // [esp+10h] [ebp-8h]
  int v9; // [esp+14h] [ebp-4h]

  v9 = 0;
  v1 = hc->head;
  for ( i = 0; hc->head_num > i; ++i )
  {
    v8 = hc->head;
    for ( j = 0; j < i; ++j )
      v8 = v8->d1->fd;
    if ( hc->head != v8 && v8->fd->is_king == 1 )
      ++v9;
    v7 = v8;
    for ( k = 0; k <= 5; ++k )
    {
      if ( v8->is_king == 1 )
        ++v9;
      v8 = v8->bk;
      for ( l = 0; l < i; ++l )
      {
        if ( v8->is_king == 1 )
          ++v9;
        v8 = v8->bk;
        if ( v8->fd == v7 )
          break;
        if ( v8->is_king == 1 )
          ++v9;
        v8 = v8->fd;
      }
    }
  }
  return v9;
}
signed int CheckFlag(Honeycomb *hc, char *Str)
{
  signed int v3; // [esp+14h] [ebp-14h]
  char direction; // [esp+1Bh] [ebp-Dh]
  size_t i; // [esp+20h] [ebp-8h]
  Hexagon *hexagon; // [esp+24h] [ebp-4h]

  hexagon = hc->head;
  for ( i = 0; i < strlen(Str); ++i )
  {
    direction = Str[i];
    if ( direction == 'L' )
    {
      if ( hc->head == hexagon )
      {
        if ( !(unsigned __int8)RotateL(hc, &hexagon, 0) )
          return 0;
      }
      else if ( !(unsigned __int8)Clockwise(hc, &hexagon) )
      {
        return 0;
      }
    }
    else if ( direction == 'R' )
    {
      if ( hc->head == hexagon )
      {
        if ( !(unsigned __int8)RotateR(hc, &hexagon, 0) )
          return 0;
      }
      else if ( !(unsigned __int8)Counterclockwise(hc, &hexagon) )
      {
        return 0;
      }
    }
  }
  v3 = 0;
  if ( hexagon->data == '#' && CheckUseCount(hc) == 94 )
    v3 = 1;
  return v3;
}
Honeycomb *InsertHexagon(Honeycomb *hc, Hexagon *a2)
{
  int v2; // esi
  Hexagon *v3; // ebx
  int v4; // esi
  Hexagon *v5; // ebx
  int v6; // esi
  Hexagon *v7; // ebx
  int v8; // esi
  Hexagon *v9; // ebx
  int v10; // esi
  Hexagon *v11; // ebx
  Honeycomb *result; // eax
  int j; // [esp+8h] [ebp-20h]
  signed int i; // [esp+Ch] [ebp-1Ch]
  Hexagon *v15; // [esp+18h] [ebp-10h]
  Hexagon *v16; // [esp+1Ch] [ebp-Ch]
  Hexagon *v17; // [esp+34h] [ebp+Ch]
  Hexagon *v18; // [esp+34h] [ebp+Ch]
  Hexagon *v19; // [esp+34h] [ebp+Ch]
  Hexagon *v20; // [esp+34h] [ebp+Ch]
  Hexagon *v21; // [esp+34h] [ebp+Ch]

  v15 = 0;
  while ( a2->d1 )
    a2 = a2->d1->fd;
  for ( i = 0; i <= 5; ++i )
  {
    v16 = a2->bk;
    v2 = map[g_num++];
    v3 = new Hexagon;
    v3->data=v2;
    v3->data=v2;
    a2->d1 = v3;
    v3->d1 = a2;
    v17 = v3;
    if ( v15 )
    {
      v3->bk = v15;
      v15->bk = v3;
    }
    v4 = map[g_num++];
    v5 = new Hexagon;
    v5->data=v4;
    v17->fd = v5;
    v5->fd = v17;
    v18 = v5;
    v6 = map[g_num++];
    v7 = new Hexagon;
    v7->data=v6;
    v18->bk = v7;
    v7->fd = v18;
    v15 = v7;
    for ( j = 0; hc->head_num > 1 && hc->head_num - 1 > j; ++j )
    {
      v19 = v16;
      v16 = v16->bk->fd;
      v8 = map[g_num++];
      v9 = (Hexagon *)operator new(0x14u);
      Hexagon::Hexagon(v9, v8);
      v19->d1 = v9;
      v9->d1 = v19;
      v20 = v9;
      if ( v15 )
      {
        v9->bk = v15;
        v15->bk = v9;
      }
      v10 = map[g_num++];
      v11 = (Hexagon *)operator new(0x14u);
      Hexagon::Hexagon(v11, v10);
      v20->fd = v11;
      v11->fd = v20;
      v15 = v11;
    }
    if ( v16->d1 )
    {
      v21 = v16->d1;
      v21->bk = v15;
      v15->bk = v21;
      break;
    }
    a2 = v16;
  }
  result = hc;
  ++result->head_num;
  return result;
}

signed int IncDepth(Honeycomb *hc)
{
  int a2; // esi
  Hexagon *v2; // ebx
  int data; // esi
  Hexagon *nextHexagon; // ebx
  signed int i; // [esp+10h] [ebp-18h]
  Hexagon *curHexagon; // [esp+14h] [ebp-14h]

  if ( hc->head )
    return (unsigned __int8)InsertHexagon(hc, hc->head);
  a2 = map[g_num++];
  v2 = new Hexagon;
  v2->data=a2;
  hc->head = v2;
  hc->head->is_king = 1;
  curHexagon = hc->head;
  for ( i = 0; i <= 4; ++i )
  {
    data = map[g_num++];
    nextHexagon = new Hexagon;
    nextHexagon->data=data;
    curHexagon->bk = nextHexagon;
    nextHexagon->fd = curHexagon;
    curHexagon = nextHexagon;
  }
  hc->head->fd = curHexagon;
  curHexagon->bk = hc->head;
  ++hc->head_num;
  return 1;
}
void check(){

}
Honeycomb *mHoneycomb;
void init(){
  mHoneycomb = new Honeycomb;

  for(size_t i=0;i<=4;i++){
    IncDepth(mHoneycomb);
  }
}
int main(){
    init();
    check();
}c