# KCTF
## 南冥神功
.data:004B7040 a0123456789abcd db '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ',0
map1 = [0x0, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00]
for y in range(9):
line = ''
for x in range(10):
if theMap[y * 10 + x] == 0:
line = line + "."
else:
line = line + "#"
print(line)
..#..#..##
##..#..#..
..#.#####.
.##.#..#..
..#..#..##
##.###.#.#
..####.#.#
.##..#.#.#
...#..##..
loc_4B3DC5: ; what is ecx
mov eax, ecx
0 => 0
1 => 1
2 => 2
9 => 9
'A' => 0xA
'F' => 0xF
alpha = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
i_1 => alpha.index(flag[flagPos])
v8 = i_1 + flagPos;
v10 = 5 - v8 % 6;
switch ( v10 )
case 1
x = x + 1
case 4
x = x - 1
case 2:
当 y 为偶数， x = x + 1
y = y + 1
default
如果 y 为偶数, x = x + 1
y = y - 1
case 3:
如果 y 为奇数, x = x - 1
y = y + 1
case 5
如果 y 为奇数, x = x - 1
y = y - 1
一位flag字符决定两个方向指令
v2 = (flagPos + flagIdx / 6) % 6;
v1 = cur = 5 - (flagPos + flagIdx ) % 6;
爆破 flagIdx 即可
```python
map1 = [0x1, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00]
def checkValid(theMap, x, y):
if x < 0 or y < 0:
return False
if x > 9 or y > 8:
return False
return theMap[y * 10 + x] == 0
def isAllClear(theMap):
return sum(theMap) == 90
def genNextValid(theMap, x, y):
insList = []
# case1
if checkValid(theMap, x + 1, y):
insList.append((1, x + 1, y))
# case4
if checkValid(theMap, x - 1, y):
insList.append((4, x - 1, y))
if y % 2 == 0:
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
