i Spring Proving Ground game Capture the Flag CTF (the third quarter) RE integer column

i Spring Proving Ground game Capture the Flag CTF (the third quarter) RE integer column

emmmm, this competition is relatively simple, nothing to say ,,,
critical records about this topic Reverse ,,,,,
ida directly open static analysis:

see English is like saying you can automatically run out, take some time ,,,,
kali be run directly on ,,, waited a long time did not come out, you can abandon
start the analysis function, enter the check (), did not find any problems, enter loadQuestion () view, found here is the main function:

it is clear Well, there is a match, there are four functions into view seemingly is Feibolaqi array ,,,,
here I used python transformation, see more clearly:

def func1(x):
	if x <= 2:
		return x
	s = func1(x-1)
	return s + func1(x-2)

def func2(x):
	if x <= 3:
		return x
	s = func2(x-1)
	s1 = s + func2(x-2)
	return s1 + func2(x-3)

def func3(x):
	if x <= 4:
		return x
	s = func3(x-1)
	s1 = s + func3(x-2)
	s2 = s1 + func3(x-3)
	return s2 + func3(x-4)
	
def func4(x):
	if x <= 5:
		return x
	s = func4(x-1)
	s1 = s + func4(x-2)
	s2 = s1 + func4(x-3)
	s3 = s2 + func4(x-4)
	return s3 + func4(x-5)

With four functions are recursive, look at that function equal to v6 found:


eight digits, or large numbers, logic seems to have been clear ,,,,,
is to see the results of this eight count in these functions generated ( the first number (bits) ,,, can be seen as an array) it is
clear that if we run the program directly wait, then we may wait a year ,,,
after all, the fourth multi-layer recursive function calls ,,,,
we can convert ideas directly to initialize the array to save up so much faster ,,,,
use python scripting:

a = [3736710778780434371, 14787220707439219840, 
	10155230078262535612,6284562052556236687, 
	6463547837513153369, 4771310769738115795,
	14436565591186214307, 4379970031970910517]
	
a1 = [0] * 100
a1[0] = 1
a1[1] = 2
for i in range(2,100):
	a1[i] = a1[i-1] + a1[i-2]
	
print(a1)

a2 = [0] * 100
a2[0] = 1
a2[1] = 2
a2[2] = 3
for i in range(3,100):
	a2[i] = a2[i-1] + a2[i-2] + a2[i-3]
		 
print(a2)

a3 = [0] * 100
a3[0] = 1
a3[1] = 2
a3[2] = 3
a3[3] = 4
for i in range(4,100):
	a3[i] = a3[i-1] + a3[i-2] + a3[i-3] +a3[i-4]
		 
print(a3)

a4 = [0] * 100
a4[0] = 1
a4[1] = 2
a4[2] = 3
a4[3] = 4
a4[4] = 5
for i in range(5,100):
	a4[i] = a4[i-1] + a4[i-2] + a4[i-3] +a4[i-4] + a4[i-5]
	
print(a4)


for i in range(0,8):
	for k in range(0,100):
		if(a[i] == a1[k]):
			print(k + 1)
			break

for i in range(0,8):
	for k in range(0,100):
		if(a[i] == a2[k]):
			print(k + 1)
			break
			
for i in range(0,8):
	for k in range(0,100):
		if(a[i] == a3[k]):
			print(k + 1)
			break
			
for i in range(0,8):
	for k in range(0,100):
		if(a[i] == a4[k]):
			print(k + 1)
			break

,,,, no avail run
through that analysis, python and C language is not the same, the maximum number of C language is 2 ^ 64, but python did not have this restriction ,,,,
written in C language script directly solving ,,, ,,
finally solving the script (C language):

#include<stdio.h>
using namespace std;

__int64 a1[100],a2[100],a3[100],a4[100];

int main(){
    __int64 a[8] = {3736710778780434371, 14787220707439219840,10155230078262535612,6284562052556236687,6463547837513153369, 4771310769738115795,14436565591186214307, 4379970031970910517};

    a1[0] = 1;
    a1[1] = 2;
    for(int i=2;i<=99;i++)
        a1[i] = a1[i-1] + a1[i-2];

    a2[0] = 1;
    a2[1] = 2;
    a2[2] = 3;
    for(int i=3;i<=99;i++)
        a2[i] = a2[i-1] + a2[i-2] + a2[i-3];

    a3[0] = 1;
    a3[1] = 2;
    a3[2] = 3;
    a3[3] = 4;
    for(int i=4;i<=99;i++)
        a3[i] = a3[i-1] + a3[i-2] + a3[i-3] +a3[i-4];

    a4[0] = 1;
    a4[1] = 2;
    a4[2] = 3;
    a4[3] = 4;
    a4[4] = 5;
    for(int i=5;i<=99;i++)
        a4[i] = a4[i-1] + a4[i-2] + a4[i-3] +a4[i-4] + a4[i-5];

    printf("flag{");
    for(int i=0;i<8;i++)
        for(int k=10;k<=99;k++)
            if(a[i] == a1[k]){
                printf("%d_",k+1);
                break;
            }
    for(int i=0;i<8;i++)
        for(int k=10;k<=99;k++)
            if(a[i] == a2[k]){
                printf("%d_",k+1);
                break;
            }
    for(int i=0;i<8;i++)
        for(int k=10;k<=99;k++)
            if(a[i] == a3[k]){
                printf("%d_",k+1);
                break;
            }
    int f = 1;
    for(int i=0;i<8;i++)
        for(int k=10;k<=99;k++)
            if(a[i] == a4[k] && f == 1){
                printf("%d_",k+1);
                f = 0;
                break;
            }else if(a[i] == a4[k]){
                printf("%d",k+1);
                break;
            }
    printf("}\n");
    return 0;
}

S results:

This question should combine features of the C language to engage ,,,,
bit difficult to top ~~