parallel-comparator-200
居然直接给源代码
直接开始分析
#include <stdlib.h>
#include <stdio.h>
#include <pthread.h>
#define FLAG_LEN 20
void * checking(void *arg) {
char *result = malloc(sizeof(char));
char *argument = (char *)arg;
*result = (argument[0]+argument[1]) ^ argument[2];
return result;
}
int highly_optimized_parallel_comparsion(char *user_string)
{
int initialization_number;
int i;
char generated_string[FLAG_LEN + 1];
generated_string[FLAG_LEN] = '\0';
while ((initialization_number = random()) >= 64);
int first_letter;
first_letter = (initialization_number % 26) + 97;
pthread_t thread[FLAG_LEN];
char differences[FLAG_LEN] = {0, 9, -9, -1, 13, -13, -4, -11, -9, -1, -7, 6, -13, 13, 3, 9, -13, -11, 6, -7};
char *arguments[20];
for (i = 0; i < FLAG_LEN; i++) {
arguments[i] = (char *)malloc(3*sizeof(char));
arguments[i][0] = first_letter;
arguments[i][1] = differences[i];
arguments[i][2] = user_string[i];
pthread_create((pthread_t*)(thread+i), NULL, checking, arguments[i]);
}
void *result;
int just_a_string[FLAG_LEN] = {115, 116, 114, 97, 110, 103, 101, 95, 115, 116, 114, 105, 110, 103, 95, 105, 116, 95, 105, 115};
for (i = 0; i < FLAG_LEN; i++) {
pthread_join(*(thread+i), &result);
generated_string[i] = *(char *)result + just_a_string[i];
free(result);
free(arguments[i]);
}
int is_ok = 1;
for (i = 0; i < FLAG_LEN; i++) {
if (generated_string[i] != just_a_string[i])
return 0;
}
return 1;
}
int main()
{
char *user_string = (char *)calloc(FLAG_LEN+1, sizeof(char));
fgets(user_string, FLAG_LEN+1, stdin);
int is_ok = highly_optimized_parallel_comparsion(user_string);
if (is_ok)
printf("You win!\n");
else
printf("Wrong!\n");
return 0;
}
我们首先可以知道函数 highly_optimized_parallel_comparsion()需要返回1,因此观察这一部分
如果要使generated_string[i] != just_a_string[i],那么必须让result==0,因此接下来看着一部分
由这两部分可知result的值与thread[]有关,进而得出result的值是由checking()函数决定的
简单的异或运算,而前面first_letter的值也可以通过枚举来得到,因此写出脚本得到flag
#include<bits/stdc++.h>
using namespace std;
int num;
char flag[20];
int s[20]={0,9,-9,-1,13,-13,-4,-11,-9,-1,-7,6,-13,13,3,9,-13,-11,6,-7};
int main()
{
for(int i=97;i<123;i++)
{
memset(flag,0,sizeof(flag));
for(int j=0;j<20;j++)
flag[j]=s[j]+i;
cout<<flag<<endl;
}
return 0;
}
运行结果如图
我们只需要将看着比较正常的flag依次提交即可,最后得到flag
lucky_hacker_you_are