1 re签到题
main函数
#防止图片挂掉
int __cdecl main(int argc, const char **argv, const char **envp)
{
char v3; // ST1E_1@7
char v4; // ST1D_1@7
int result; // eax@7
int v6; // esi@7
signed int i; // [sp+4h] [bp-64h]@1
signed int j; // [sp+4h] [bp-64h]@4
char v9; // [sp+Bh] [bp-5Dh]@2
char v10; // [sp+Ch] [bp-5Ch]@7
char v11[5]; // [sp+16h] [bp-52h]@5
char v12; // [sp+1Bh] [bp-4Dh]@7
char v13; // [sp+23h] [bp-45h]@7
char v14[2]; // [sp+31h] [bp-37h]@5
char v15; // [sp+33h] [bp-35h]@7
char v16; // [sp+35h] [bp-33h]@7
char v17; // [sp+39h] [bp-2Fh]@7
char v18; // [sp+40h] [bp-28h]@7
char v19; // [sp+42h] [bp-26h]@7
char v20; // [sp+43h] [bp-25h]@7
char v21; // [sp+45h] [bp-23h]@7
char v22; // [sp+47h] [bp-21h]@7
char v23; // [sp+48h] [bp-20h]@7
int v24; // [sp+4Ch] [bp-1Ch]@1
int *v25; // [sp+60h] [bp-8h]@1
v25 = &argc;
v24 = *MK_FP(__GS__, 20);
for ( i = 0; i <= 9; ++i )
*(&v9 + i) = i + 48;
for ( j = 0; j <= 25; ++j )
{
v11[j] = j + 65;
v14[j] = j - 94;
}
printf(" \x1B[37m\x1B[47m %c\x1B[0m\n", v22 - 65);
printf(" \x1B[37m\x1B[47m %c%c\x1B[0m\n", v18 - 65, v20 - 65);
printf(" \x1B[37m\x1B[47m %c%c%c\x1B[0m\n", v16 - 65, v15 - 65, 123);
printf(" \x1B[37m\x1B[47m %c%c%c%c\x1B[0m\n", v12, v4, v19 - v3, v10);
printf("\x1B[37m\x1B[47m %c%c%c%c%c\x1B[0m\n", v17 - v3, v13, v21 - v3, v23 - v3, 125);
puts("Flag Cakes, Do You Like It?");
result = 0;
v6 = *MK_FP(__GS__, 20) ^ v24;
return result;
}
方法有两种：
1.直接放到linux中跑一下，然后flag就出来了
2.编写程序跑出来，但是v3 v4不可考(其实是0 1)，放弃
运行结果
2 程序自校验
其实这题也就是160个creakme的第24个，我把它摘过来了
image.png
直接下GetDlgItemInt断点，然后往下翻，就能看到了
程序的流程是……%#￥T&^&@，大家看懂了吗
我介绍一下0x4012dd之后的部分，
读取0x4011EC 到 0x4012E4 共0x3e*4大小的内存，（其实也就是这个函数内部的内存地址），每次取一个DWROD，相互异或，最后将结果与0xAFFCCFFB比较。
分析：
那我们在0x4012e1设置断点，获取从0x4011EC到0x4012d7的异或 A，0x4012E0-0x4012E3的0x81Fa7549，中间有两个DWROD不知道，分别是0x??????04和0xD833AD??
那么得到一个等式 0x???????? ^ A ^ 0x81FA7549 ^ 0xD833AD04=0xAFFCCFFB，A的话设置断点，很容易得到结果0xA213FCEE，继而得到未知数0x5426eb58，那么D9-DC的值应该是EB 26 54 58，然后结合0x401269和0x4012BB以及0x4012C4，可以得到参与计算的0x4012BB处的eax的值必须为0x580c3ba3
注意：
不要设置断点！！不要设置断点！！不要设置断点！！
设置断点之后断点的地方变成CC，TM的害的我DEBUG半天
只要eax正确了，程序便会跳转到成功
注册机如下：
#include <stdio.h>
#define DWORD unsigned
int main()
{
DWORD eax=0x58455443;//初始值CTEX的ASCII
char name[20]={0};
gets(name);
//name[0]='k';
//name[1]='o';
//name[2]='o';
//name[3]='d';
for(int i=0;i<16;i++)
{
eax+=*(DWORD *)(name+i);
//printf("%d-->%x eax->%x\n",i,*(DWORD *)(name+i),eax);
}
printf("eax->%x-----%x-->%u\n",eax,0x580c3ba3-eax,0x580c3ba3-eax);
return 0;
}
3 某喵的注册机
首先查看文件格式，发现是个压缩包，解压，发现是一个exe程序，直接拖入od，输入Name为wpsec，key随便写了，然后设置MessageBoxA断点，回溯，发现了关键点。
image.png
如果这题你试图用IDA来分析，事实会给你一个深刻的教训，真TM啥玩意啊，代码乱的一批。
其实这题是用E语言写的，2016年刚开始学习E的时候的小玩意。查看一下源码：
image.png
这样的话随便写个注册机都可以了
a=input("Name:")
#a='wpsec'
if len(a)<5:
print("len(Name)>=5 !!!")
exit()
key=0
for i in a:
key+=ord(i)*3803*5*3*3*2
key*=3607
key=str(key)
print(key[0:3]+'_'+key[4:7]+'_'+key[-4:])
4听说你不想学现代？
这题主要考察对线性代数的理解和对windows X64位反编译的掌握了，其实也很简单。
首先，分析程序位win64无壳程序，然后拖入IDA分析，发现main函数存在大量计算
image.png
这里有个知识点，由于编译器优化，本来的unsigned char[20]被优化为两个int64和一个int，所以下面有很多BYTE*(X)，代表的是取多少的位置，(unsigned __int8）相当于（unsigned char)。
我们把所有的数提取出来，之后使用云算子或者是python numpy库来解出所有的值。
得到结果如下
x2 = 95.000
x3 = 65.000
x4 = 95.000
x5 = 52.000
x6 = 114.000
x7 = 101.000
x8 = 95.000
x9 = 115.000
x10 = 48.000
x11 = 95.000
x12 = 105.000
x13 = 109.000
x14 = 112.000
x15 = 111.000
x16 = 114.000
x17 = 116.000
x18 = 97.000
x19 = 110.000
x20 = 116.000
转化为char即可得到flag
另外附程序源码
#include <stdio.h>
int main() {
unsigned char a[20] = {0};
printf("Please input Your Key:");
for (int i = 0; i < 20; i++) {
a[i] = getchar();
}
//消除回车
getchar();
if (1009 * a[0] + 1129 * a[1] + 1289 * a[2] + 1447 * a[3] + 1579 * a[4] + 1723 * a[5] + 1879 * a[6] + 2039 * a[7] + 2207 * a[8] + 2351 * a[9] + 2521 * a[10] + 2683 * a[11] + 2803 * a[12] + 2971 * a[13] + 3169 * a[14] + 3329 * a[15] + 3499 * a[16] + 3637 * a[17] + 3803 * a[18] + 3967 * a[19] == 4961785 && 1151 * a[0] + 1291 * a[1] + 1451 * a[2] + 1583 * a[3] + 1733 * a[4] + 1889 * a[5] + 2053 * a[6] + 2213 * a[7] + 2357 * a[8] + 2531 * a[9] + 2687 * a[10] + 2819 * a[11] + 2999 * a[12] + 3181 * a[13] + 3331 * a[14] + 3511 * a[15] + 3643 * a[16] + 3821 * a[17] + 3989 * a[18] + 1013 * a[19] == 4924355 && 1297 * a[0] + 1453 * a[1] + 1597 * a[2] + 1741 * a[3] + 1901 * a[4] + 2063 * a[5] + 2221 * a[6] + 2371 * a[7] + 2539 * a[8] + 2689 * a[9] + 2833 * a[10] + 3001 * a[11] + 3187 * a[12] + 3343 * a[13] + 3517 * a[14] + 3659 * a[15] + 3823 * a[16] + 4001 * a[17] + 1019 * a[18] + 1153 * a[19] == 4901419 && 1459 * a[0] + 1601 * a[1] + 1747 * a[2] + 1907 * a[3] + 2069 * a[4] + 2237 * a[5] + 2377 * a[6] + 2543 * a[7] + 2693 * a[8] + 2837 * a[9] + 3011 * a[10] + 3191 * a[11] + 3347 * a[12] + 3527 * a[13] + 3671 * a[14] + 3833 * a[15] + 4003 * a[16] + 1021 * a[17] + 1163 * a[18] + 1301 * a[19] == 4915459 && 1607 * a[0] + 1753 * a[1] + 1913 * a[2] + 2081 * a[3] + 2239 * a[4] + 2381 * a[5] + 2549 * a[6] + 2699 * a[7] + 2843 * a[8] + 3019 * a[9] + 3203 * a[10] + 3359 * a[11] + 3529 * a[12] + 3673 * a[13] + 3847 * a[14] + 4007 * a[15] + 1031 * a[16] + 1171 * a[17] + 1303 * a[18] + 1471 * a[19] == 4868261 && 1759 * a[0] + 1931 * a[1] + 2083 * a[2] + 2243 * a[3] + 2383 * a[4] + 2551 * a[5] + 2707 * a[6] + 2851 * a[7] + 3023 * a[8] + 3209 * a[9] + 3361 * a[10] + 3533 * a[11] + 3677 * a[12] + 3851 * a[13] + 4013 * a[14] + 1033 * a[15] + 1181 * a[16] + 1307 * a[17] + 1481 * a[18] + 1609 * a[19] == 4825167 && 1933 * a[0] + 2087 * a[1] + 2251 * a[2] + 2389 * a[3] + 2557 * a[4] + 2711 * a[5] + 2857 * a[6] + 3037 * a[7] + 3217 * a[8] + 3371 * a[9] + 3539 * a[10] + 3691 * a[11] + 3853 * a[12] + 4019 * a[13] + 1039 * a[14] + 1187 * a[15] + 1319 * a[16] + 1483 * a[17] + 1613 * a[18] + 1777 * a[19] == 4794225 && 2089 * a[0] + 2267 * a[1] + 2393 * a[2] + 2579 * a[3] + 2713 * a[4] + 2861 * a[5] + 3041 * a[6] + 3221 * a[7] + 3373 * a[8] + 3541 * a[9] + 3697 * a[10] + 3863 * a[11] + 4021 * a[12] + 1049 * a[13] + 1193 * a[14] + 1321 * a[15] + 1487 * a[16] + 1619 * a[17] + 1783 * a[18] + 1949 * a[19] == 4760281 && 2269 * a[0] + 2399 * a[1] + 2591 * a[2] + 2719 * a[3] + 2879 * a[4] + 3049 * a[5] + 3229 * a[6] + 3389 * a[7] + 3547 * a[8] + 3701 * a[9] + 3877 * a[10] + 4027 * a[11] + 1051 * a[12] + 1201 * a[13] + 1327 * a[14] + 1489 * a[15] + 1621 * a[16] + 1787 * a[17] + 1951 * a[18] + 2099 * a[19] == 4734733 && 2411 * a[0] + 2593 * a[1] + 2729 * a[2] + 2887 * a[3] + 3061 * a[4] + 3251 * a[5] + 3391 * a[6] + 3557 * a[7] + 3709 * a[8] + 3881 * a[9] + 4049 * a[10] + 1061 * a[11] + 1213 * a[12] + 1361 * a[13] + 1493 * a[14] + 1627 * a[15] + 1789 * a[16] + 1973 * a[17] + 2111 * a[18] + 2273 * a[19] == 4730929 && 2609 * a[0] + 2731 * a[1] + 2897 * a[2] + 3067 * a[3] + 3253 * a[4] + 3407 * a[5] + 3559 * a[6] + 3719 * a[7] + 3889 * a[8] + 4051 * a[9] + 1063 * a[10] + 1217 * a[11] + 1367 * a[12] + 1499 * a[13] + 1637 * a[14] + 1801 * a[15] + 1979 * a[16] + 2113 * a[17] + 2281 * a[18] + 2417 * a[19] == 4747889 && 2741 * a[0] + 2903 * a[1] + 3079 * a[2] + 3257 * a[3] + 3413 * a[4] + 3571 * a[5] + 3727 * a[6] + 3907 * a[7] + 4057 * a[8] + 1069 * a[9] + 1223 * a[10] + 1373 * a[11] + 1511 * a[12] + 1657 * a[13] + 1811 * a[14] + 1987 * a[15] + 2129 * a[16] + 2287 * a[17] + 2423 * a[18] + 2617 * a[19] == 4920757 && 2909 * a[0] + 3083 * a[1] + 3259 * a[2] + 3433 * a[3] + 3581 * a[4] + 3733 * a[5] + 3911 * a[6] + 4073 * a[7] + 1087 * a[8] + 1229 * a[9] + 1381 * a[10] + 1523 * a[11] + 1663 * a[12] + 1823 * a[13] + 1993 * a[14] + 2131 * a[15] + 2293 * a[16] + 2437 * a[17] + 2621 * a[18] + 2749 * a[19] == 4879937 && 3089 * a[0] + 3271 * a[1] + 3449 * a[2] + 3583 * a[3] + 3739 * a[4] + 3917 * a[5] + 4079 * a[6] + 1091 * a[7] + 1231 * a[8] + 1399 * a[9] + 1531 * a[10] + 1667 * a[11] + 1831 * a[12] + 1997 * a[13] + 2137 * a[14] + 2297 * a[15] + 2441 * a[16] + 2633 * a[17] + 2753 * a[18] + 2917 * a[19] == 4897933 && 3299 * a[0] + 3457 * a[1] + 3593 * a[2] + 3761 * a[3] + 3919 * a[4] + 4091 * a[5] + 1093 * a[6] + 1237 * a[7] + 1409 * a[8] + 1543 * a[9] + 1669 * a[10] + 1847 * a[11] + 1999 * a[12] + 2141 * a[13] + 2309 * a[14] + 2447 * a[15] + 2647 * a[16] + 2767 * a[17] + 2927 * a[18] + 3109 * a[19] == 4907643 && 3461 * a[0] + 3607 * a[1] + 3767 * a[2] + 3923 * a[3] + 4093 * a[4] + 1097 * a[5] + 1249 * a[6] + 1423 * a[7] + 1549 * a[8] + 1693 * a[9] + 1861 * a[10] + 2003 * a[11] + 2143 * a[12] + 2311 * a[13] + 2459 * a[14] + 2657 * a[15] + 2777 * a[16] + 2939 * a[17] + 3119 * a[18] + 3301 * a[19] == 4870465 && 3613 * a[0] + 3769 * a[1] + 3929 * a[2] + 4099 * a[3] + 1103 * a[4] + 1259 * a[5] + 1427 * a[6] + 1553 * a[7] + 1697 * a[8] + 1867 * a[9] + 2011 * a[10] + 2153 * a[11] + 2333 * a[12] + 2467 * a[13] + 2659 * a[14] + 2789 * a[15] + 2953 * a[16] + 3121 * a[17] + 3307 * a[18] + 3463 * a[19] == 5026317 && 3779 * a[0] + 3931 * a[1] + 4111 * a[2] + 1109 * a[3] + 1277 * a[4] + 1429 * a[5] + 1559 * a[6] + 1699 * a[7] + 1871 * a[8] + 2017 * a[9] + 2161 * a[10] + 2339 * a[11] + 2473 * a[12] + 2663 * a[13] + 2791 * a[14] + 2957 * a[15] + 3137 * a[16] + 3313 * a[17] + 3467 * a[18] + 3617 * a[19] == 5045171 && 3943 * a[0] + 4127 * a[1] + 1117 * a[2] + 1279 * a[3] + 1433 * a[4] + 1567 * a[5] + 1709 * a[6] + 1873 * a[7] + 2027 * a[8] + 2179 * a[9] + 2341 * a[10] + 2477 * a[11] + 2671 * a[12] + 2797 * a[13] + 2963 * a[14] + 3163 * a[15] + 3319 * a[16] + 3469 * a[17] + 3623 * a[18] + 3793 * a[19] == 5163611 && 4129 * a[0] + 1123 * a[1] + 1283 * a[2] + 1439 * a[3] + 1571 * a[4] + 1721 * a[5] + 1877 * a[6] + 2029 * a[7] + 2203 * a[8] + 2347 * a[9] + 2503 * a[10] + 2677 * a[11] + 2801 * a[12] + 2969 * a[13] + 3167 * a[14] + 3323 * a[15] + 3491 * a[16] + 3631 * a[17] + 3797 * a[18] + 3947 * a[19] == 5186559) {
//给出4位 '_' 提示，
if (a[1] == a[3]) {
if (a[7] == a[10]) {
if (a[1] == a[7]) {
if (a[10] == '_') {
printf("Yes,The Flag is wpsec{your_Key}\n");
return 0;
}
}
}
}
}
printf("No,Please study linear algebra, then back\n");
getchar();
return 0;
}
#python3.6
flag="L_A_4re_s0_important"
a=[]
for i in flag:
a.append(ord(i))
print(a)
matrix=[
[1009,1013,1019,1021,1031,1033,1039,1049,1051,1061,1063,1069,1087,1091,1093,1097,1103,1109,1117,1123],
[1129,1151,1153,1163,1171,1181,1187,1193,1201,1213,1217,1223,1229,1231,1237,1249,1259,1277,1279,1283],
[1289,1291,1297,1301,1303,1307,1319,1321,1327,1361,1367,1373,1381,1399,1409,1423,1427,1429,1433,1439],
[1447,1451,1453,1459,1471,1481,1483,1487,1489,1493,1499,1511,1523,1531,1543,1549,1553,1559,1567,1571],
[1579,1583,1597,1601,1607,1609,1613,1619,1621,1627,1637,1657,1663,1667,1669,1693,1697,1699,1709,1721],
[1723,1733,1741,1747,1753,1759,1777,1783,1787,1789,1801,1811,1823,1831,1847,1861,1867,1871,1873,1877],
[1879,1889,1901,1907,1913,1931,1933,1949,1951,1973,1979,1987,1993,1997,1999,2003,2011,2017,2027,2029],
[2039,2053,2063,2069,2081,2083,2087,2089,2099,2111,2113,2129,2131,2137,2141,2143,2153,2161,2179,2203],
[2207,2213,2221,2237,2239,2243,2251,2267,2269,2273,2281,2287,2293,2297,2309,2311,2333,2339,2341,2347],
[2351,2357,2371,2377,2381,2383,2389,2393,2399,2411,2417,2423,2437,2441,2447,2459,2467,2473,2477,2503],
[2521,2531,2539,2543,2549,2551,2557,2579,2591,2593,2609,2617,2621,2633,2647,2657,2659,2663,2671,2677],
[2683,2687,2689,2693,2699,2707,2711,2713,2719,2729,2731,2741,2749,2753,2767,2777,2789,2791,2797,2801],
[2803,2819,2833,2837,2843,2851,2857,2861,2879,2887,2897,2903,2909,2917,2927,2939,2953,2957,2963,2969],
[2971,2999,3001,3011,3019,3023,3037,3041,3049,3061,3067,3079,3083,3089,3109,3119,3121,3137,3163,3167],
[3169,3181,3187,3191,3203,3209,3217,3221,3229,3251,3253,3257,3259,3271,3299,3301,3307,3313,3319,3323],
[3329,3331,3343,3347,3359,3361,3371,3373,3389,3391,3407,3413,3433,3449,3457,3461,3463,3467,3469,3491],
[3499,3511,3517,3527,3529,3533,3539,3541,3547,3557,3559,3571,3581,3583,3593,3607,3613,3617,3623,3631],
[3637,3643,3659,3671,3673,3677,3691,3697,3701,3709,3719,3727,3733,3739,3761,3767,3769,3779,3793,3797],
[3803,3821,3823,3833,3847,3851,3853,3863,3877,3881,3889,3907,3911,3917,3919,3923,3929,3931,3943,3947],
[3967,3989,4001,4003,4007,4013,4019,4021,4027,4049,4051,4057,4073,4079,4091,4093,4099,4111,4127,4129]]
##颠倒矩阵a
for i in range(0,20):
b=i
for j in range(0,20):
print(matrix[b][i],end=',')
#print('*matrix[%d]'%j,end='+')
b=b+1
if b >=20:
b-=20
print()
print(1009*a[0]+1129*a[1]+1289*a[2]+1447*a[3]+1579*a[4]+1723*a[5]+1879*a[6]+2039*a[7]+2207*a[8]+2351*a[9]+2521*a[10]+2683*a[11]+2803*a[12]+2971*a[13]+3169*a[14]+3329*a[15]+3499*a[16]+3637*a[17]+3803*a[18]+3967*a[19]==4961785)
print(1151*a[0]+1291*a[1]+1451*a[2]+1583*a[3]+1733*a[4]+1889*a[5]+2053*a[6]+2213*a[7]+2357*a[8]+2531*a[9]+2687*a[10]+2819*a[11]+2999*a[12]+3181*a[13]+3331*a[14]+3511*a[15]+3643*a[16]+3821*a[17]+3989*a[18]+1013*a[19]==4924355)
print(1297*a[0]+1453*a[1]+1597*a[2]+1741*a[3]+1901*a[4]+2063*a[5]+2221*a[6]+2371*a[7]+2539*a[8]+2689*a[9]+2833*a[10]+3001*a[11]+3187*a[12]+3343*a[13]+3517*a[14]+3659*a[15]+3823*a[16]+4001*a[17]+1019*a[18]+1153*a[19]==4901419)
print(1459*a[0]+1601*a[1]+1747*a[2]+1907*a[3]+2069*a[4]+2237*a[5]+2377*a[6]+2543*a[7]+2693*a[8]+2837*a[9]+3011*a[10]+3191*a[11]+3347*a[12]+3527*a[13]+3671*a[14]+3833*a[15]+4003*a[16]+1021*a[17]+1163*a[18]+1301*a[19]==4915459)
print(1607*a[0]+1753*a[1]+1913*a[2]+2081*a[3]+2239*a[4]+2381*a[5]+2549*a[6]+2699*a[7]+2843*a[8]+3019*a[9]+3203*a[10]+3359*a[11]+3529*a[12]+3673*a[13]+3847*a[14]+4007*a[15]+1031*a[16]+1171*a[17]+1303*a[18]+1471*a[19]==4868261)
print(1759*a[0]+1931*a[1]+2083*a[2]+2243*a[3]+2383*a[4]+2551*a[5]+2707*a[6]+2851*a[7]+3023*a[8]+3209*a[9]+3361*a[10]+3533*a[11]+3677*a[12]+3851*a[13]+4013*a[14]+1033*a[15]+1181*a[16]+1307*a[17]+1481*a[18]+1609*a[19]==4825167)
print(1933*a[0]+2087*a[1]+2251*a[2]+2389*a[3]+2557*a[4]+2711*a[5]+2857*a[6]+3037*a[7]+3217*a[8]+3371*a[9]+3539*a[10]+3691*a[11]+3853*a[12]+4019*a[13]+1039*a[14]+1187*a[15]+1319*a[16]+1483*a[17]+1613*a[18]+1777*a[19]==4794225)
print(2089*a[0]+2267*a[1]+2393*a[2]+2579*a[3]+2713*a[4]+2861*a[5]+3041*a[6]+3221*a[7]+3373*a[8]+3541*a[9]+3697*a[10]+3863*a[11]+4021*a[12]+1049*a[13]+1193*a[14]+1321*a[15]+1487*a[16]+1619*a[17]+1783*a[18]+1949*a[19]==4760281)
print(2269*a[0]+2399*a[1]+2591*a[2]+2719*a[3]+2879*a[4]+3049*a[5]+3229*a[6]+3389*a[7]+3547*a[8]+3701*a[9]+3877*a[10]+4027*a[11]+1051*a[12]+1201*a[13]+1327*a[14]+1489*a[15]+1621*a[16]+1787*a[17]+1951*a[18]+2099*a[19]==4734733)
print(2411*a[0]+2593*a[1]+2729*a[2]+2887*a[3]+3061*a[4]+3251*a[5]+3391*a[6]+3557*a[7]+3709*a[8]+3881*a[9]+4049*a[10]+1061*a[11]+1213*a[12]+1361*a[13]+1493*a[14]+1627*a[15]+1789*a[16]+1973*a[17]+2111*a[18]+2273*a[19]==4730929)
print(2609*a[0]+2731*a[1]+2897*a[2]+3067*a[3]+3253*a[4]+3407*a[5]+3559*a[6]+3719*a[7]+3889*a[8]+4051*a[9]+1063*a[10]+1217*a[11]+1367*a[12]+1499*a[13]+1637*a[14]+1801*a[15]+1979*a[16]+2113*a[17]+2281*a[18]+2417*a[19]==4747889)
print(2741*a[0]+2903*a[1]+3079*a[2]+3257*a[3]+3413*a[4]+3571*a[5]+3727*a[6]+3907*a[7]+4057*a[8]+1069*a[9]+1223*a[10]+1373*a[11]+1511*a[12]+1657*a[13]+1811*a[14]+1987*a[15]+2129*a[16]+2287*a[17]+2423*a[18]+2617*a[19]==4920757)
print(2909*a[0]+3083*a[1]+3259*a[2]+3433*a[3]+3581*a[4]+3733*a[5]+3911*a[6]+4073*a[7]+1087*a[8]+1229*a[9]+1381*a[10]+1523*a[11]+1663*a[12]+1823*a[13]+1993*a[14]+2131*a[15]+2293*a[16]+2437*a[17]+2621*a[18]+2749*a[19]==4879937)
print(3089*a[0]+3271*a[1]+3449*a[2]+3583*a[3]+3739*a[4]+3917*a[5]+4079*a[6]+1091*a[7]+1231*a[8]+1399*a[9]+1531*a[10]+1667*a[11]+1831*a[12]+1997*a[13]+2137*a[14]+2297*a[15]+2441*a[16]+2633*a[17]+2753*a[18]+2917*a[19]==4897933)
print(3299*a[0]+3457*a[1]+3593*a[2]+3761*a[3]+3919*a[4]+4091*a[5]+1093*a[6]+1237*a[7]+1409*a[8]+1543*a[9]+1669*a[10]+1847*a[11]+1999*a[12]+2141*a[13]+2309*a[14]+2447*a[15]+2647*a[16]+2767*a[17]+2927*a[18]+3109*a[19]==4907643)
print(3461*a[0]+3607*a[1]+3767*a[2]+3923*a[3]+4093*a[4]+1097*a[5]+1249*a[6]+1423*a[7]+1549*a[8]+1693*a[9]+1861*a[10]+2003*a[11]+2143*a[12]+2311*a[13]+2459*a[14]+2657*a[15]+2777*a[16]+2939*a[17]+3119*a[18]+3301*a[19]==4870465)
print(3613*a[0]+3769*a[1]+3929*a[2]+4099*a[3]+1103*a[4]+1259*a[5]+1427*a[6]+1553*a[7]+1697*a[8]+1867*a[9]+2011*a[10]+2153*a[11]+2333*a[12]+2467*a[13]+2659*a[14]+2789*a[15]+2953*a[16]+3121*a[17]+3307*a[18]+3463*a[19]==5026317)
print(3779*a[0]+3931*a[1]+4111*a[2]+1109*a[3]+1277*a[4]+1429*a[5]+1559*a[6]+1699*a[7]+1871*a[8]+2017*a[9]+2161*a[10]+2339*a[11]+2473*a[12]+2663*a[13]+2791*a[14]+2957*a[15]+3137*a[16]+3313*a[17]+3467*a[18]+3617*a[19]==5045171)
print(3943*a[0]+4127*a[1]+1117*a[2]+1279*a[3]+1433*a[4]+1567*a[5]+1709*a[6]+1873*a[7]+2027*a[8]+2179*a[9]+2341*a[10]+2477*a[11]+2671*a[12]+2797*a[13]+2963*a[14]+3163*a[15]+3319*a[16]+3469*a[17]+3623*a[18]+3793*a[19]==5163611)
print(4129*a[0]+1123*a[1]+1283*a[2]+1439*a[3]+1571*a[4]+1721*a[5]+1877*a[6]+2029*a[7]+2203*a[8]+2347*a[9]+2503*a[10]+2677*a[11]+2801*a[12]+2969*a[13]+3167*a[14]+3323*a[15]+3491*a[16]+3631*a[17]+3797*a[18]+3947*a[19]==5186559)
5 奇怪的文件
分析是elf文件，但是拖入IDA中发现成片的db区域，继续分析发现是upx加壳文件，使用upx工具拖壳http://linux.softpedia.com/get/System/Boot/UPX-10558.shtml，但是发现始终无法
之后IDA可以分析了，F5主函数，发现flag字符串，双击，得到flag
网友评论