企业官网建设流程全解析

通过搜索算法解出最优路径的题目

平台：MoeCTF
方向：逆向
知识点：BFS、DFS
难度：入门

一、信息获取

题目意图就是让输入字符串，走迷宫

二、分析

从下面分析发现：
n0x37为行数（我更名为row）
n32为列数（我更名为column）
终点为（15，32）
flag的内容为走出迷宫的路径

这里可以直观的看出W、A、S、D对应的行和列的变化

下面是找地图

这里被打了问号是因为要在程序运行的时候这个数组才被赋值而现在是静态分析就没有初始值
但是在左边可得知其被sub_1400010E0这个函数引用了，因此地图就在这个函数里面

打开就有地图了，复制下来就行

三、EXP

fromcollectionsimportdequemap=["11111111111111111111111111111111111111111111111111111111","10100000000000000010000011011101011111111101011100000111","10111010111111111010111011000001000001000001000101110111","10000010000010000010001011011111111101110111011101110111","10111111111011101110111011010000000000010100010001110111","10100000001000101000100011010101111111011101110101110111","10101011111110111011101011010101000001000000010101110111","10101010000010100000101011110101110101111101111111110111","10111010111010101111101011100101000100000101000101110111","10000010001010001000001011001111011111010101011101110111","11111011101011111011111111101000100000101100101001110111","10001010001000100010000010001010011000100010010011000001","10111010111110101010111011011001011111010101011101011101","10001010001000001010001011000101000100000101000101011101","11101011101111111011101011110101110111111101110101011101","10001000101000001010001011000100010100000101000101011101","10111111101011101110111011011111110101110111011101011101","10001000001000100000001011000100000100010000000101011001","11101011111011111111101011110101111101111111110101011011","10101000000010001000101011010100000001000100010101011011","10101111111110101010101011010111111111010101010101011011","10100000000000100010101011010000000000010001010101011011","10111111111111111110111011011111111111111111011101011011","10000000001111000000000011110111010000111100011111011011","11101111100000011011011111111010110111011101100001011011","11101111111111111011011111111101110111101101100001011011","10001000111111000010000011111010110111011101100001011011","10111010111111111010111011110111010000111101100001010011","10000010000010000010001011111111111111111101100001010111","10111111111011101110111011110001000110001101100001010001","10100000001000101000100011110111011101111101100001011101","10101011111110111011101011110001000101111101100001011101","10101010000010100000101011111101011101111101100001011101","10111010111010101111101011110001000110001101100001011101","10000010001010101000001011111111111111111101100001011101","11111011101011111011111110000000000000001101100001011101","10001010001000100010000011111111111111111100110011011101","10111010111110101010111010010000000011111110001111011101","10001010001000001010001010110111000001111110100101011101","11101011101111111011101000110011001111111100110111011101","10001000101000001010001011111111111111111111110111010001","10111111101011101110111010100001001100000000000011011011","10001000001000100000001011111111111101011101111001011011","10101011111011111111101011000000000001000100010111011011","10101000000010001000101010010111111111111111111111011011","10101111111110101010101010110111111111111111111101011011","10100000000000100010101011100000000000000000000011011011","10111111111111111110011011111111111111111111111011011011","10000011111111111111000010000000000000000000000000011001","11111011111111111111111111111111111111111111111111111101","11111011100001100110110111000000000000000000000111111101","11111011101111011010000111011111111111111111110111111101","11111011100001000010110110000111111111111111110000000001","11111011101111011010110111101111111111111111111111111111","11110000000000011000110000000000000000000000000000000011","11111111111111111111111111111111111111111111111111111111",]start=(1,1)#行，列goal=(15,32)moves=[("W",-1,0),("S",1,0),("A",0,-1),("D",0,1)]q=deque([(start[0],start[1],"")])seen={start}whileq:r,c,cur=q.popleft()if(r,c)==goal:path=curbreakforch,dr,dcinmoves:nr,nc=r+dr,c+dcifnot(0<=nr<=55and0<=nc<=55):continueifmap[nr][nc]=="1"or(nr,nc)inseen:continueseen.add((nr,nc))q.append((nr,nc,cur+ch))print(path)print(f"moectf{{{path}}}")

使用广度优先搜索寻找flag

四、总结

1.我觉得要注意ida给的十六进制数，这个可能是数字也可能是对应的ASCII，如果判断错误会给使代码理解出现错误

看到 32 到 126 之间的立即数，先想一下 ASCII。常见的就这几个：0x30–0x39 是 ‘0’–‘9’，0x41–0x5A 是 ‘A’–‘Z’，0x61–0x7A 是 ‘a’–‘z’。在 IDA 里对这个数按 R，可以直接切成字符看。

2.不重要的变量可以直接忽略