{"id":488,"date":"2023-07-16T21:05:17","date_gmt":"2023-07-16T13:05:17","guid":{"rendered":"https:\/\/shangwendada.top\/?p=488"},"modified":"2023-07-16T21:14:59","modified_gmt":"2023-07-16T13:14:59","slug":"488","status":"publish","type":"post","link":"https:\/\/blog.shangwendada.top\/index.php\/2023\/07\/16\/488\/","title":{"rendered":"[HWS]animals"},"content":{"rendered":"

[HWS]animals<\/h1>\n

\u524d\u8a00<\/h2>\n

\u672c\u6765\u90fd\u6253\u7b97\u9000\u5f79\u4e86\uff0c\u770b\u5230\u4e00\u4e2a\u633a\u6709\u610f\u601d\u7684\u9898\u76ee\uff0c\u51fa\u6765\u5199\u4e00\u4e0bwp\uff0c(\u8fd9\u4e2a\u9898\u6211\u53ea\u80fd\u8bf4\u4f5c\u8005\u5f88\u4f1a\u73a9)<\/p>\n

\u5206\u6790<\/h2>\n

\u9996\u5148IDA\u6253\u5f00
\n

\"file\"<\/div>
\n
\"file\"<\/div>
\n\u719f\u6089\u7684\u5473\u9053\u719f\u6089\u7684\u82b1
\n
\"file\"<\/div>
\n\u6574\u6574\u4e24\u6bb5\uff0c\u6ca1\u6709\u529e\u6cd5\uff0c\u632b\u4e00\u4e2aidapython\u811a\u672c\u68ad\u4e00\u4e0b<\/p>\n
start_add = 0x400800\nend_add = 0x406e22\nfor i in range(start_add,end_add):\n    if get_wide_dword(i) == 0x08750a74:\n        patch_dword(i,0x90909090)\n        patch_dword(i+4,0x90909090)\n        patch_dword(i+8,0x90909090)\n    elif get_wide_dword(i) == 0x13751574:\n        patch_dword(i,0x90909090)\n        patch_dword(i+4,0x90909090)\n        patch_dword(i+8,0x90909090)\n        patch_dword(i+12,0x90909090)\n        patch_dword(i+16,0x90909090)\n        patch_word(i+20,0x9090)\n        patch_byte(i+22,0x90)<\/code><\/pre>\n
\"file\"<\/div>
\nmain\u51fd\u6570\u5206\u6790\u9519\u4e86\uff0c\u5e76\u4e14\u4e0b\u9762\u8fd9\u4e00\u6bb5\u4e0d\u80fd\u6309p\u58f0\u660e\u3002
\n\u5f80\u4e0b\u7ffb\u627e\u53d1\u73b0
\n
\"file\"<\/div>
\n\u8fd9\u91cc\u6709\u4e00\u4e2a\u5b57\u8282\u672a\u8bc6\u522b\uff0c\u6309C\u8bc6\u522b\u4e00\u4e0b
\n
\"file\"<\/div>
\n\u8bc6\u522b\u5b8c\u4e86\u4e4b\u540e\u4e00\u5927\u6bb5\u5730\u5740\u5168\u90e8\u7206\u7ea2
\n\u6b64\u65f6\u6211\u4eec\u56de\u5230main\u51fd\u6570\u4e0b\u9762\u7ee7\u7eed\u6309p
\n
\"file\"<\/div>
\n\u53ef\u4ee5\u6309p\u4e86\uff0c\u4f46\u662f\u51famain\u51fd\u6570\u4ecd\u65e7\u662f\u6709\u95ee\u9898\u7684\uff0c\u5e76\u4e14\u6211\u4eectab\u67e5\u770b\u4e00\u4e0b\u51fd\u6570\u5185\u5bb9
\n
\"file\"<\/div>
\n\u5bc4\u5b58\u5668\u4e22\u5931\u7684\u540c\u65f6\u8fd8\u975e\u5e38\u7684\u4e71\uff0c\u6240\u4ee5\u4e0d\u80fd\u76f4\u63a5p
\n\u6211\u4eec\u9700\u8981\u4fee\u6539main\u51fd\u6570\u7684\u8d77\u59cb\u5730\u70b9\u3002
\n
\"file\"<\/div>
\n\u8fd9\u4e2a\u65f6\u5019\u4e3b\u51fd\u6570\u5c31\u6b63\u5e38\u4e86<\/p>\n
void __fastcall main(__int64 a1, char **a2, char **a3)\n{\n  size_t v3; \/\/ rax\n  size_t v4; \/\/ rax\n  size_t v5; \/\/ rax\n  size_t v6; \/\/ rax\n  size_t v7; \/\/ rax\n  size_t v8; \/\/ rax\n  int v9; \/\/ ecx\n  int v10; \/\/ eax\n  unsigned int v11; \/\/ eax\n  size_t v12; \/\/ rax\n  const char *v13; \/\/ [rsp+1Ch] [rbp-318h]\n  const char *v14; \/\/ [rsp+6Ch] [rbp-2C8h]\n  const char *v15; \/\/ [rsp+84h] [rbp-2B0h]\n  const char *v16; \/\/ [rsp+9Ch] [rbp-298h]\n  const char *v17; \/\/ [rsp+B4h] [rbp-280h]\n  const char *v18; \/\/ [rsp+CCh] [rbp-268h]\n  char *src; \/\/ [rsp+E4h] [rbp-250h]\n  int i; \/\/ [rsp+148h] [rbp-1ECh]\n  char v21[88]; \/\/ [rsp+14Ch] [rbp-1E8h] BYREF\n  char v22[24]; \/\/ [rsp+1A4h] [rbp-190h] BYREF\n  int v23; \/\/ [rsp+1BCh] [rbp-178h] BYREF\n  int v24; \/\/ [rsp+1C0h] [rbp-174h]\n  char v25[256]; \/\/ [rsp+1C4h] [rbp-170h] BYREF\n  char *s; \/\/ [rsp+2C4h] [rbp-70h] BYREF\n  char *v27; \/\/ [rsp+2CCh] [rbp-68h]\n  char *v28; \/\/ [rsp+2D4h] [rbp-60h]\n  char *v29; \/\/ [rsp+2DCh] [rbp-58h]\n  char *v30; \/\/ [rsp+2E4h] [rbp-50h]\n  char *v31; \/\/ [rsp+2ECh] [rbp-48h]\n  pthread_t newthread[2]; \/\/ [rsp+2F4h] [rbp-40h] BYREF\n  int v33; \/\/ [rsp+304h] [rbp-30h]\n  int v34; \/\/ [rsp+308h] [rbp-2Ch]\n\n  v34 = 0;\n  v33 = a1;\n  newthread[1] = (pthread_t)a2;\n  sub_405FF0(a1, a2, a3);\n  memset(&s, 0, 0x30uLL);\n  s = (_BYTE *)("0. cat" + 3);\n  v27 = (_BYTE *)("1. dog" + 3);\n  v28 = (_BYTE *)("2. fox" + 3);\n  v29 = (_BYTE *)("3. panda" + 3);\n  v30 = (_BYTE *)("4. dragon" + 3);\n  v31 = (_BYTE *)("5. monkey" + 3);\n  memset(v25, 0, sizeof(v25));\n  v24 = 0;\n  while ( v24 < 9 )\n  {\n    if ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10\n                                                                                                && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) )\n      goto LABEL_26;\n    while ( 1 )\n    {\n      v23 = 0;\n      puts("Welcome Animal shop");\n      sub_400900();\n      printf("Please input my favorite animal: ");\n      __isoc99_scanf("%d", &v23);\n      if ( (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) )\n        break;\nLABEL_26:\n      v23 = 0;\n      puts("Welcome Animal shop");\n      sub_400900();\n      printf("Please input my favorite animal: ");\n      __isoc99_scanf("%d", &v23);\n    }\n    switch ( v23 )\n    {\n      case 0:\n        src = s;\n        v3 = strlen(s);\n        strncat(v25, src, v3);\n        goto LABEL_16;\n      case 1:\n        v18 = v27;\n        v4 = strlen(v27);\n        strncat(v25, v18, v4);\n        goto LABEL_16;\n      case 2:\n        v17 = v28;\n        v5 = strlen(v28);\n        strncat(v25, v17, v5);\n        goto LABEL_16;\n      case 3:\n        v16 = v29;\n        v6 = strlen(v29);\n        strncat(v25, v16, v6);\n        goto LABEL_16;\n      case 4:\n        v15 = v30;\n        v7 = strlen(v30);\n        strncat(v25, v15, v7);\n        goto LABEL_16;\n      case 5:\n        if ( (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | ((unsigned __int8)~(dword_6080F4 < 10) ^ (unsigned __int8)~(((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) & 1 )\n          goto LABEL_12;\n        do\n        {\n          v13 = v31;\n          v12 = strlen(v31);\n          strncat(v25, v13, v12);\nLABEL_12:\n          v14 = v31;\n          v8 = strlen(v31);\n          strncat(v25, v14, v8);\n          v9 = (((_BYTE)dword_608138 - 44 + 43) * (_BYTE)dword_608138) & 1;\n        }\n        while ( !((dword_6080F4 < 10) ^ (v9 == 0) | (dword_6080F4 < 10 && v9 == 0)) );\nLABEL_16:\n        ++v24;\n        break;\n      default:\n        v10 = (((_BYTE)dword_608138 - 14 + 13) * (_BYTE)dword_608138) & 1;\n        if ( (dword_6080F4 < 10) ^ (v10 == 0) | (dword_6080F4 < 10 && v10 == 0) )\n        {\n          puts("Input Err.");\n          exit(0);\n        }\n        puts("Input Err.");\n        exit(0);\n    }\n  }\n  pthread_create(newthread, 0LL, start_routine, 0LL);\n  pthread_join(newthread[0], 0LL);\n  puts("done.");\n  sub_4009A0(v21);\n  v11 = strlen(v25);\n  sub_400B30(v21, v25, v11);\n  sub_4059A0(v21, v22);\n  for ( i = 0; ; ++i )\n  {\n    while ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) )\n      ;\n    if ( i >= 16 )\n      break;\n    if ( byte_608090[i] != v22[i] )\n    {\n      puts("Wrong.");\n      exit(0);\n    }\n  }\n  if ( !((dword_6080F4 < 10 && ((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0)) )\nLABEL_30:\n    puts("Win! , flag is flag{md5(input)}");\n  puts("Win! , flag is flag{md5(input)}");\n  if ( !((dword_6080F4 < 10) ^ (((((_BYTE)dword_608138 - 1) * (_BYTE)dword_608138) & 1) == 0) | (dword_6080F4 < 10\n                                                                                              && ((((_BYTE)dword_608138\n                                                                                                  - 1)\n                                                                                                 * (_BYTE)dword_608138) & 1) == 0)) )\n    goto LABEL_30;\n}<\/code><\/pre>\n
\u5927\u81f4\u5c31\u662f\u4e2a\u731c\u52a8\u7269\u6e38\u620f\uff0c\u9009\u62e9\u7684\u52a8\u7269\u5e8f\u53f7md5\u52a0\u5bc6\u5c31\u662fflag\u3002
\n\u53ef\u4ee5\u53d1\u73b0\u9700\u8981\u9009\u62e99\u6b21
\n\u6bcf\u6b21\u90096\u4e2a\u4e5f\u5c31\u662f6^9\u7684\u9009\u62e9\u6b21\u6570\uff0c\u90a3\u4e48\u6211\u4eec\u67e5\u770b\u4e4b\u540e\u53d1\u73b0\u53ea\u6709\u4e00\u5343\u591a\u4e07\u6b21\uff0c\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528pwntools\u8fdb\u884c\u4e00\u4e2a\u7206\u7834\u6765\u89e3\u51b3\u95ee\u9898\uff0c\u4f46\u662f\u8fd9\u91cc\u4ecb\u7ecd\u7684\u65b9\u6cd5\u5c31\u662f\u76f4\u63a5\u5206\u6790\u9898\u76ee<\/p>\n
\u89e3\u9898<\/h2>\n
\u7a0b\u5e8f\u6709\u53cd\u8c03\u8bd5
\n\u5206\u6790\u7a0b\u5e8f\u4e4b\u540e\u53ef\u4ee5\u53d1\u73b0\u7a0b\u5e8f\u662f\u5c06\u4f60\u9009\u62e9\u7684\u52a8\u7269\u5168\u79f0\u8fdb\u884c\u4e00\u4e2a\u53d8\u5f02\u7684md5\u52a0\u5bc6\u53bb\u6bd4\u8f83\u7684<\/p>\n
\u53d8\u5f02md5<\/h3>\n
\"file\"<\/div>
\n\u770b\u5230\u4e00\u4e2a\u6bd4\u8f83\u5904\uff0c\u6211\u4eec\u67e5\u770b\u6bd4\u8f83\u5185\u5bb9
\n
\"file\"<\/div>
\n\u53ef\u4ee5\u53d1\u73b0\u662f\u4e00\u4e32md5\u6570\u5b57
\n
\"file\"<\/div>
\n\u6211\u4eec\u5206\u6790\u51fd\u6570\u53ef\u4ee5\u67e5\u627e\u5230\u8be5\u51fd\u6570
\n
\"file\"<\/div>
\n\u8be5\u51fd\u6570\u5bf9\u53d8\u5f02md5\u540e\u7684\u503c\u8fdb\u884c\u4e86\u4e00\u4e2a\u5904\u7406
\n\u7136\u540e\u770b\u5230md5\u51fd\u6570
\n
\"file\"<\/div>
\n\u53d1\u73b0md5\u51fd\u6570\u7684\u7f16\u7801\u8868\u88ab\u66ff\u6362\u4e86\uff0c1\uff0c2\u4ea4\u63623\uff0c4\u4ea4\u6362\u56e0\u6b64\u6211\u4eec\u53ef\u4ee5\u81ea\u5df1\u5b9e\u73b0\u811a\u672c\u6765\u8fdb\u884c\u4e00\u4e2amd5\u7206\u7834\u4e86<\/p>\n
exp<\/h3>\n
#include <stdio.h>\n#include <stdlib.h>\n#include <stdbool.h>\n#include <time.h>\n#include <windows.h>\n#include<stdio.h>\n#include <stdio.h>\n#include <stdbool.h>\n#include <stdint.h>\n#include <stdio.h>\n#include <windows.h>\n#include <string.h>\n#include <stdio.h>\n#include <stdbool.h>\n#include <windows.h>\n#define MD5_H\n\ntypedef struct\n{\n    unsigned int count[2];\n    unsigned int state[4];\n    unsigned char buffer[64];   \n}MD5_CTX;\n\n#define F(x,y,z) ((x & y) | (~x & z))\n#define G(x,y,z) ((x & z) | (y & ~z))\n#define H(x,y,z) (x^y^z)\n#define I(x,y,z) (y ^ (x | ~z))\n#define ROTATE_LEFT(x,n) ((x << n) | (x >> (32-n)))\n#define FF(a,b,c,d,x,s,ac) \\\n          { \\\n          a += F(b,c,d) + x + ac; \\\n          a = ROTATE_LEFT(a,s); \\\n          a += b; \\\n          }\n#define GG(a,b,c,d,x,s,ac) \\\n          { \\\n          a += G(b,c,d) + x + ac; \\\n          a = ROTATE_LEFT(a,s); \\\n          a += b; \\\n          }\n#define HH(a,b,c,d,x,s,ac) \\\n          { \\\n          a += H(b,c,d) + x + ac; \\\n          a = ROTATE_LEFT(a,s); \\\n          a += b; \\\n          }\n#define II(a,b,c,d,x,s,ac) \\\n          { \\\n          a += I(b,c,d) + x + ac; \\\n          a = ROTATE_LEFT(a,s); \\\n          a += b; \\\n          }                                            \nvoid MD5Init(MD5_CTX *context);\nvoid MD5Update(MD5_CTX *context,unsigned char *input,unsigned int inputlen);\nvoid MD5Final(MD5_CTX *context,unsigned char digest[16]);\nvoid MD5Transform(unsigned int state[4],unsigned char block[64]);\nvoid MD5Encode(unsigned char *output,unsigned int *input,unsigned int len);\nvoid MD5Decode(unsigned int *output,unsigned char *input,unsigned int len);\nusing namespace std;\ntypedef int status;\ntypedef int selemtype;\n\nunsigned char PADDING[]={0x80,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,\n                         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,\n                         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,\n                         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};\n\nvoid MD5Init(MD5_CTX *context)\n{\n     context->count[0] = 0;\n     context->count[1] = 0;\n     context->state[0] = 0xEFCDAB89;\n     context->state[1] = 0x67452301;\n     context->state[2] = 0x10325476;\n     context->state[3] = 0x98BADCFE;\n}\nvoid MD5Update(MD5_CTX *context,unsigned char *input,unsigned int inputlen)\n{\n    unsigned int i = 0,index = 0,partlen = 0;\n    index = (context->count[0] >> 3) & 0x3F;\n    partlen = 64 - index;\n    context->count[0] += inputlen << 3;\n    if(context->count[0] < (inputlen << 3))\n       context->count[1]++;\n    context->count[1] += inputlen >> 29;\n\n    if(inputlen >= partlen)\n    {\n       memcpy(&context->buffer[index],input,partlen);\n       MD5Transform(context->state,context->buffer);\n       for(i = partlen;i+64 <= inputlen;i+=64)\n           MD5Transform(context->state,&input[i]);\n       index = 0;        \n    }  \n    else\n    {\n        i = 0;\n    }\n    memcpy(&context->buffer[index],&input[i],inputlen-i);\n}\nvoid MD5Final(MD5_CTX *context,unsigned char digest[16])\n{\n    unsigned int index = 0,padlen = 0;\n    unsigned char bits[8];\n    index = (context->count[0] >> 3) & 0x3F;\n    padlen = (index < 56)?(56-index):(120-index);\n    MD5Encode(bits,context->count,8);\n    MD5Update(context,PADDING,padlen);\n    MD5Update(context,bits,8);\n    MD5Encode(digest,context->state,16);\n}\nvoid MD5Encode(unsigned char *output,unsigned int *input,unsigned int len)\n{\n    unsigned int i = 0,j = 0;\n    while(j < len)\n    {\n         output[j] = input[i] & 0xFF;  \n         output[j+1] = (input[i] >> 8) & 0xFF;\n         output[j+2] = (input[i] >> 16) & 0xFF;\n         output[j+3] = (input[i] >> 24) & 0xFF;\n         i++;\n         j+=4;\n    }\n}\nvoid MD5Decode(unsigned int *output,unsigned char *input,unsigned int len)\n{\n     unsigned int i = 0,j = 0;\n     while(j < len)\n     {\n           output[i] = (input[j]) |\n                       (input[j+1] << 8) |\n                       (input[j+2] << 16) |\n                       (input[j+3] << 24);\n           i++;\n           j+=4; \n     }\n}\nvoid MD5Transform(unsigned int state[4],unsigned char block[64])\n{\n     unsigned int a = state[0];\n     unsigned int b = state[1];\n     unsigned int c = state[2];\n     unsigned int d = state[3];\n     unsigned int x[64];\n     MD5Decode(x,block,64);\n     FF(a, b, c, d, x[ 0], 7, 0xd76aa478); \/* 1 *\/\n FF(d, a, b, c, x[ 1], 12, 0xe8c7b756); \/* 2 *\/\n FF(c, d, a, b, x[ 2], 17, 0x242070db); \/* 3 *\/\n FF(b, c, d, a, x[ 3], 22, 0xc1bdceee); \/* 4 *\/\n FF(a, b, c, d, x[ 4], 7, 0xf57c0faf); \/* 5 *\/\n FF(d, a, b, c, x[ 5], 12, 0x4787c62a); \/* 6 *\/\n FF(c, d, a, b, x[ 6], 17, 0xa8304613); \/* 7 *\/\n FF(b, c, d, a, x[ 7], 22, 0xfd469501); \/* 8 *\/\n FF(a, b, c, d, x[ 8], 7, 0x698098d8); \/* 9 *\/\n FF(d, a, b, c, x[ 9], 12, 0x8b44f7af); \/* 10 *\/\n FF(c, d, a, b, x[10], 17, 0xffff5bb1); \/* 11 *\/\n FF(b, c, d, a, x[11], 22, 0x895cd7be); \/* 12 *\/\n FF(a, b, c, d, x[12], 7, 0x6b901122); \/* 13 *\/\n FF(d, a, b, c, x[13], 12, 0xfd987193); \/* 14 *\/\n FF(c, d, a, b, x[14], 17, 0xa679438e); \/* 15 *\/\n FF(b, c, d, a, x[15], 22, 0x49b40821); \/* 16 *\/\n\n \/* Round 2 *\/\n GG(a, b, c, d, x[ 1], 5, 0xf61e2562); \/* 17 *\/\n GG(d, a, b, c, x[ 6], 9, 0xc040b340); \/* 18 *\/\n GG(c, d, a, b, x[11], 14, 0x265e5a51); \/* 19 *\/\n GG(b, c, d, a, x[ 0], 20, 0xe9b6c7aa); \/* 20 *\/\n GG(a, b, c, d, x[ 5], 5, 0xd62f105d); \/* 21 *\/\n GG(d, a, b, c, x[10], 9,  0x2441453); \/* 22 *\/\n GG(c, d, a, b, x[15], 14, 0xd8a1e681); \/* 23 *\/\n GG(b, c, d, a, x[ 4], 20, 0xe7d3fbc8); \/* 24 *\/\n GG(a, b, c, d, x[ 9], 5, 0x21e1cde6); \/* 25 *\/\n GG(d, a, b, c, x[14], 9, 0xc33707d6); \/* 26 *\/\n GG(c, d, a, b, x[ 3], 14, 0xf4d50d87); \/* 27 *\/\n GG(b, c, d, a, x[ 8], 20, 0x455a14ed); \/* 28 *\/\n GG(a, b, c, d, x[13], 5, 0xa9e3e905); \/* 29 *\/\n GG(d, a, b, c, x[ 2], 9, 0xfcefa3f8); \/* 30 *\/\n GG(c, d, a, b, x[ 7], 14, 0x676f02d9); \/* 31 *\/\n GG(b, c, d, a, x[12], 20, 0x8d2a4c8a); \/* 32 *\/\n\n \/* Round 3 *\/\n HH(a, b, c, d, x[ 5], 4, 0xfffa3942); \/* 33 *\/\n HH(d, a, b, c, x[ 8], 11, 0x8771f681); \/* 34 *\/\n HH(c, d, a, b, x[11], 16, 0x6d9d6122); \/* 35 *\/\n HH(b, c, d, a, x[14], 23, 0xfde5380c); \/* 36 *\/\n HH(a, b, c, d, x[ 1], 4, 0xa4beea44); \/* 37 *\/\n HH(d, a, b, c, x[ 4], 11, 0x4bdecfa9); \/* 38 *\/\n HH(c, d, a, b, x[ 7], 16, 0xf6bb4b60); \/* 39 *\/\n HH(b, c, d, a, x[10], 23, 0xbebfbc70); \/* 40 *\/\n HH(a, b, c, d, x[13], 4, 0x289b7ec6); \/* 41 *\/\n HH(d, a, b, c, x[ 0], 11, 0xeaa127fa); \/* 42 *\/\n HH(c, d, a, b, x[ 3], 16, 0xd4ef3085); \/* 43 *\/\n HH(b, c, d, a, x[ 6], 23,  0x4881d05); \/* 44 *\/\n HH(a, b, c, d, x[ 9], 4, 0xd9d4d039); \/* 45 *\/\n HH(d, a, b, c, x[12], 11, 0xe6db99e5); \/* 46 *\/\n HH(c, d, a, b, x[15], 16, 0x1fa27cf8); \/* 47 *\/\n HH(b, c, d, a, x[ 2], 23, 0xc4ac5665); \/* 48 *\/\n\n \/* Round 4 *\/\n II(a, b, c, d, x[ 0], 6, 0xf4292244); \/* 49 *\/\n II(d, a, b, c, x[ 7], 10, 0x432aff97); \/* 50 *\/\n II(c, d, a, b, x[14], 15, 0xab9423a7); \/* 51 *\/\n II(b, c, d, a, x[ 5], 21, 0xfc93a039); \/* 52 *\/\n II(a, b, c, d, x[12], 6, 0x655b59c3); \/* 53 *\/\n II(d, a, b, c, x[ 3], 10, 0x8f0ccc92); \/* 54 *\/\n II(c, d, a, b, x[10], 15, 0xffeff47d); \/* 55 *\/\n II(b, c, d, a, x[ 1], 21, 0x85845dd1); \/* 56 *\/\n II(a, b, c, d, x[ 8], 6, 0x6fa87e4f); \/* 57 *\/\n II(d, a, b, c, x[15], 10, 0xfe2ce6e0); \/* 58 *\/\n II(c, d, a, b, x[ 6], 15, 0xa3014314); \/* 59 *\/\n II(b, c, d, a, x[13], 21, 0x4e0811a1); \/* 60 *\/\n II(a, b, c, d, x[ 4], 6, 0xf7537e82); \/* 61 *\/\n II(d, a, b, c, x[11], 10, 0xbd3af235); \/* 62 *\/\n II(c, d, a, b, x[ 2], 15, 0x2ad7d2bb); \/* 63 *\/\n II(b, c, d, a, x[ 9], 21, 0xeb86d391); \/* 64 *\/\n     state[0] += a;\n     state[1] += b;\n     state[2] += c;\n     state[3] += d;\n}\nchar choices[][10] = {\n    "cat",\n    "dog",\n    "fox",\n    "panda",\n    "dragon",\n    "monkey"\n};\nunsigned char answer[] = {\n    0xCB, 0xA4, 0x7B, 0xE5, 0xF0, 0x1C, 0xD1, 0x95, 0x5C, 0x85,\n    0x46, 0xA2, 0xB2, 0x4F, 0xBD, 0x18\n};\nint main () {\n    \/\/051410233\n    MD5_CTX md5;\n    unsigned char md5_str[32]={0};\n    int length = 9;  \/\/ \u603b\u5171\u9009\u62e9\u7684\u6b21\u6570\n\n    int choice[length];  \/\/ \u7528\u4e8e\u4fdd\u5b58\u6bcf\u4e2a\u9009\u62e9\u7684\u7d22\u5f15\n\n    \/\/ \u521d\u59cb\u5316\u9009\u62e9\u7d22\u5f15\n    for (int i = 0; i < length; i++) {\n        choice[i] = 0;\n    }\n\n    while (1) {\n        \/\/ \u62fc\u63a5\u52a8\u7269\u540d\u79f0\n        char animalName[length * 10 + 1];  \/\/ \u5047\u8bbe\u6bcf\u4e2a\u52a8\u7269\u540d\u79f0\u4e0d\u8d85\u8fc710\u4e2a\u5b57\u7b26\n        int index = 0;\n        for (int i = 0; i < length; i++) {\n            int choiceIndex = choice[i];\n            char *animal = choices[choiceIndex];\n            while (*animal != '\\0') {\n                animalName[index] = *animal;\n                animal++;\n                index++;\n            }\n        }\n        animalName[index] = '\\0';\n        for(int i = 0 ; i < 16 ; i ++ )\n        {\n            md5_str[i]=0;\n        }\n        MD5Init(&md5);\n        MD5Update(&md5, (unsigned char *)animalName, strlen((char *)animalName));\n        MD5Final(&md5, (unsigned char *)md5_str);\n        for (int i = 0 ; i < 16 ; i ++ ) {\n            md5_str[i] = (md5_str[i] & 0xE9 | ~md5_str[i] & 0x16);\n        }\n        for(int i = 0 ; i < 16 ; i ++ )\n        {\n            if(md5_str[i]!=answer[i])\n            {\n                break;\n            }\n            if(i>5)\n            {\n                printf("%s",animalName);\n                return 0;\n            }\n        }\n\n        \/\/ \u66f4\u65b0\u9009\u62e9\u7d22\u5f15\n        int i = length - 1;\n        while (i >= 0 && choice[i] == 5) {\n            choice[i] = 0;\n            i--;\n        }\n        if (i < 0) {\n            break;\n        }\n        choice[i]++;\n    }\n\n    return 0;\n}\n<\/code><\/pre>\n
\u5f97\u5230\u9009\u62e9\u7684\u52a8\u7269\uff0c\u7136\u540e\u627e\u5230\u4ed6\u4eec\u7684\u7f16\u7801\u4e3a051410233
\nmd5\u52a0\u5bc6\u540e\u5373\u4e3aflag<\/p>\n","protected":false},"excerpt":{"rendered":"
[HWS]animals \u524d\u8a00 \u672c\u6765\u90fd\u6253\u7b97\u9000\u5f79\u4e86\uff0c\u770b\u5230\u4e00\u4e2a\u633a\u6709\u610f\u601d\u7684\u9898\u76ee\uff0c\u51fa\u6765\u5199\u4e00\u4e0bwp\uff0c(\u8fd9\u4e2a\u9898\u6211\u53ea\u80fd\u8bf4\u4f5c\u8005 […]<\/p>\n","protected":false},"author":1,"featured_media":7,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-488","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/comments?post=488"}],"version-history":[{"count":4,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/488\/revisions"}],"predecessor-version":[{"id":511,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/posts\/488\/revisions\/511"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media\/7"}],"wp:attachment":[{"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/media?parent=488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/categories?post=488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.shangwendada.top\/index.php\/wp-json\/wp\/v2\/tags?post=488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}