googleCTF RE-CPP解题思路

__INCLUDE_LEVEL__表示包含深度，和#include"cpp.c"构成递归，这个递归用处不大，只是在一次次根据S的值执行不同代码，可以不管他
通过对每个#if分析可得知每个块的功能
S相当于loc，然后对R、Z、X等等做运算，根据结果进行跳转到不同S
得到主要逻辑：

I = 0;
M = 0;
N = 1;
P = 0;
Q = 0;
while (1)
{
	B = 0xE5;//1110 0101
	B = B + I;
	if (B == 0) break;//if(Q==0) success
	B = 0x80;//1000 0000
	B = B + I;
	L = B;
	A = RAM[B];
	L = I; B = RAM[I];
	R = 1;
	X = 1;
	Y = 0;
	while (1)
	{
		if (X == 0)
			break;
		Z = X;
		Z = Z & B;
		if (Z != 0)
			Y = Y + A;
		X = X + X;
		A = A + A;
	}
	A = Y;

	R = ~R;
	Z = 1;
	R += Z;
	R += Z;

	O = M;
	O += N;
	M = N;
	N = O;
	A += M;
	B = 0x20;//0010 0000
	B += I;
	L = B; C = RAM[L];
	A = A ^ C;
	P = P + A;
	B = 0x40;//0100 0000
	B = B + I;
	L = B; A = RAM[L];
	A = A ^ P;
	Q |= A;
	I += 1;
}

由前面的宏定义知flag长度为26，并且在上面的主要逻辑中可以看到flag是一位一位验证的，因此可以直接暴力跑。

#include<stdio.h>
unsigned char RAM0[][8] = { {1,1,0,1,1,1,0,1},
{1,0,1,0,1,0,1,0},
{1,1,0,1,0,1,0,1},
{1,0,1,0,0,0,1,1},
{1,0,0,1,1,1,0,1},
{1,0,1,1,1,0,0,1},
{1,0,0,1,0,0,1,1},
{1,0,0,1,0,1,1,0},
{1,1,0,1,1,1,0,1},
{1,1,1,0,1,1,0,0},
{1,0,0,1,1,0,1,1},
{1,0,1,1,0,0,1,1},
{1,0,0,0,0,1,0,0},
{1,1,0,0,1,1,0,1},
{1,1,1,1,0,0,1,1},
{1,1,1,1,0,0,1,1},
{1,1,1,1,1,0,0,1},
{1,0,0,1,0,0,0,0},
{1,0,1,0,1,1,0,1},
{1,0,1,1,1,1,0,0},
{1,1,0,1,0,1,1,1},
{1,1,1,1,1,1,1,0},
{1,1,1,0,1,0,1,0},
{1,0,0,0,0,1,0,1},
{1,1,0,1,0,1,1,1},
{1,1,1,0,0,0,0,1},
{1,1,1,0,0,1,1,0},
{1,1,0,0,0,1,0,0},
{1,1,1,0,1,0,0,0},
{1,0,1,0,0,1,0,0},
{1,0,0,0,1,0,1,1},
{1,1,0,1,1,0,0,0},
{0,0,0,1,0,0,0,0},
{0,0,1,0,0,1,1,0},
{0,0,1,0,0,1,1,0},
{1,0,1,0,1,1,0,0},
{1,0,0,0,1,0,0,1},
{0,0,1,0,0,1,1,0},
{1,1,1,0,0,1,1,1},
{0,0,0,0,0,1,0,1},
{0,1,1,0,0,0,0,0},
{0,1,0,1,0,1,0,1},
{1,0,1,1,1,0,1,1},
{1,0,1,0,1,1,1,0},
{1,1,1,0,1,0,0,0},
{1,0,1,1,1,0,0,1},
{1,0,1,1,0,1,1,0},
{0,0,1,1,1,0,1,0},
{0,1,1,1,1,0,1,0},
{1,0,0,1,1,0,0,0},
{1,0,1,1,1,1,1,1},
{1,0,0,1,0,1,1,1},
{0,0,1,1,0,0,0,0},
{1,0,0,1,1,1,1,1},
{0,0,1,0,1,1,0,1},
{1,1,0,0,0,0,0,1},
{0,1,1,0,0,0,0,1},
{0,1,0,0,0,1,0,0},
{0,1,0,0,0,0,1,0},
{0,1,1,1,1,0,0,0},
{1,1,1,0,1,0,1,0},
{1,0,0,0,0,1,0,1},
{0,0,0,1,0,1,0,0},
{0,1,0,0,0,1,1,0},
{0,1,0,1,1,1,1,1},
{1,1,0,1,1,1,1,0},
{1,1,0,1,1,0,0,0},
{0,1,0,1,1,1,0,1},
{0,1,1,1,1,0,0,0},
{0,0,1,0,1,1,0,1},
{1,1,0,0,1,1,0,1},
{0,0,0,1,1,0,1,0},
{0,1,1,0,0,0,1,1},
{1,1,0,0,1,1,1,1},
{0,0,1,1,0,0,0,1},
{0,0,0,0,1,0,0,1},
{1,1,0,1,1,1,0,0},
{0,1,0,1,1,1,0,1},
{1,0,0,1,1,0,0,0},
{0,1,1,1,0,1,1,0},
{0,1,1,1,0,0,1,1},
{1,1,1,1,1,0,1,1},
{1,0,0,0,1,1,1,1},
{1,0,1,0,0,1,0,0},
{1,0,1,1,0,0,0,1},
{0,0,0,0,0,0,1,0},
{0,0,0,0,0,0,0,1},
{0,0,0,0,1,1,1,0},
{0,0,0,0,0,1,1,1},
{1,0,1,1,0,0,1,0},
{0,0,1,1,1,0,0,0} };
unsigned char RAM[0xFF] = {0};
void change()
{
	for (int i = 0; i < 91; i++)
	{
		RAM[i] = RAM0[i][7] * 128 + RAM0[i][6] * 64 + RAM0[i][5] * 32 + RAM0[i][4] * 16 + RAM0[i][3] * 8 + RAM0[i][2] * 4 + RAM0[i][1] * 2 + RAM0[i][0] * 1;
	}
}
unsigned char A, B, C, I, L, M, N, O, P, X, Y, Z, Q, R;
unsigned char a, b, c, i, l, m, n, o, p, x, y, z, q, r;
void push()
{
	a = A;
	b = B;
	c = C;
	i = I;
	l = L;
	m = M;
	n = N;
	o = O;
	p = P;
	x = X;
	y = Y;
	z = Z;
	q = Q;
	r = R;
}
void pop()
{
	A = a;
	B = b;
	C = c;
	I = i;
	L = l;
	M = m;
	N = n;
	O = o;
	P = p;
	X = x;
	Y = y;
	Z = z;
	Q = q;
	R = r;
}
int main()
{
	change();	
	I = 0;
	M = 0;
	N = 1;
	P = 0;
	Q = 0;
	while (1)
	{
		B = 0xE5;//1110 0101
		B = B + I;
		if (B == 0) break;//if(Q==0) success
		B = 0x80;//1000 0000
		B = B + I;
		for (int j = 48; j < 127; j++)
		{
			push();
			L = B; 
			A = j;
			L = I; B = RAM[I];
			R = 1;
			X = 1;
			Y = 0;
			while (1)
			{
				if (X == 0)
					break;
				Z = X;
				Z = Z & B;
				if (Z != 0)
					Y = Y + A;
				X = X + X;
				A = A + A;
			}
			A = Y;

			R = ~R;
			Z = 1;
			R += Z;
			R += Z;

			O = M;
			O += N;
			M = N;
			N = O;
			A += M;
			B = 0x20;//0010 0000
			B += I;
			L = B; C = RAM[L];
			A = A ^ C;
			P = P + A;
			B = 0x40;//0100 0000
			B = B + I;
			L = B; A = RAM[L];
			A = A ^ P;
			Q |= A;
			if (Q == 0)
			{
				putchar(j);
				break;
			}
			pop();
		}
			I += 1;
	}
}

即可得flag：CTF{pr3pr0cess0r_pr0fe5sor}