编辑“︁迷宫问题”︁（章节）

== Volga Quals CTF 2014: Reverse 100 ==

接下来我们以这道题进行示例, 这是一道简单的迷宫题. 该题对地图按行乱序布置, 使用的字符是<code>#</code>和<code>*</code>.

对应的<code>crackme</code>可以点击此处下载: [https://github.com/ctf-wiki/ctf-challenges/blob/master/reverse/maze/2014_volga_quals/rev100 rev100]

对应的<code>idb</code>可以点击此处下载: [https://github.com/ctf-wiki/ctf-challenges/blob/master/reverse/maze/2014_volga_quals/rev100.i64 rev100.i64]

[[File:./figure/setmaze.png|setmaze.png]]

我们可以到<code>.rodata</code>段用光标选择所有的地图字符串, 按下<code>shift+E</code>提取所有的地图数据.

[[File:./figure/extract_maze.png|extract_maze.png]]

但是目前提取到的地图字符串, 从上往下并非是按顺序的, 因此我们需要回到IDA生成的伪C代码, 获取行号并重新排序组合起来.

最后得到的完整地图如下:

对应的<code>迷宫地图文件</code>可以点击此处下载: [https://github.com/ctf-wiki/ctf-challenges/blob/master/reverse/maze/2014_volga_quals/maze_array.txt maze_array.txt]

[[File:./figure/maze_origin.png|maze_origin.png]]

再来看迷宫移动所需要的字符:

[[File:./figure/choice.png|choice.png]]

这里我们知道, 可以使用的字符有<code>L/R/U/D</code>, 分别对应于<code>左/右/上/下</code>.

再往下看

[[File:./figure/check.png|check.png]]

通过调试是可以知道, 这里其实是每次在用户输入<code>L/R/U/D</code>后, 先打印一次你的输入, 然后打印对应的<code>X/Y坐标</code>. 而最后的判定成功的条件, 就是当<code>pos_x == 89 &amp;&amp; pos_y == 28</code>. 那么我们就可以根据上述信息, 获得走出迷宫的路径.

[[File:./figure/maze.jpg|maze.jpg]]

最后得到的迷宫路径就是

<pre>RDDRRRRRRRRRRRRRRRRRRDDDDDDDDDDRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRUUUUUULLLLLLLLLDDRRRRRRDDLLLLLLLLLLLLLUURRRUUUUURRRRRRRRRRRRRRRRRRRRRRRRRRDDDDDDDDDDDDDDDRRRRRRRRRRRRRRRRUUUUUUUUUUUUULLLLLLLUUUURRRRRRRRRRRRDDDDDDDDDDDDDDDDDDDLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLUUUURRRRRRRRRRRRRRRRRRRRRDRRRRRRRRRRRRRRUUULLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLDDDDDRRRRRUUURRRRDDDDDLLLLLLLLLDDDDRRRRRRRRRRUUURRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRDDDDDDRRRRRRRRRRRRRRRRRRRRRRRRRRRR</pre>