思路

先查壳，发现是无壳的64位的一个可执行文件。

放入ida中，发现有main函数，这道题看来是难度不大

int __cdecl main(int argc, const char **argv, const char **envp)
{
  FILE *stream; // ST08_8
  signed int i; // [rsp+4h] [rbp-2Ch]
  char ptr[24]; // [rsp+10h] [rbp-20h]
  unsigned __int64 v7; // [rsp+28h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  stream = fopen("flag", "r");
  fread(ptr, 1uLL, 0x14uLL, stream);
  fclose(stream);
  for ( i = 1; i <= 19; ++i )
  {
    if ( i & 1 )
      printf("%ld\n", (unsigned int)(ptr[i] << i));
    else
      printf("%ld\n", (unsigned int)(i * ptr[i]));
  }
  return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

之后附件中还有一个txt文件，打开发现是一堆数字，之后利用这个逻辑进行运算即可，那么脚本就写出来。

脚本

#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<stdint.h>
int main() {
	int output[20] = {0,198,232,816,200,1536,300,6144,984,51200,570,92160,1200,565248,756,1474560,800,6291456,1782,65536000};
    for (int i = 1; i <= 19; ++i)
    {
        if (i & 1)
            printf("%c", (unsigned int)(output[i] >> i));
        else
            printf("%c", (unsigned int)( output[i]/i  ));
    }
}


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

最后获得flag是ctf2020{d9-dE6-20c}
之后用flag包裹flag{d9-dE6-20c}