老样子连上去看看
cat 一下源码也可以用IDA反编译一下原程序
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>unsigned char submit[6];void play(){int i;printf("Submit your 6 lotto bytes : ");fflush(stdout);int r;r = read(0, submit, 6);printf("Lotto Start!\n");//sleep(1);// generate lotto numbersint fd = open("/dev/urandom", O_RDONLY);if(fd==-1){printf("error. tell admin\n");exit(-1);}unsigned char lotto[6];if(read(fd, lotto, 6) != 6){printf("error2. tell admin\n");exit(-1);}for(i=0; i<6; i++){lotto[i] = (lotto[i] % 45) + 1; // 1 ~ 45}close(fd);// calculate lotto scoreint match = 0, j = 0;for(i=0; i<6; i++){for(j=0; j<6; j++){if(lotto[i] == submit[j]){match++;}}}// win!if(match == 6){system("/bin/cat flag");}else{printf("bad luck...\n");}}void help(){printf("- nLotto Rule -\n");printf("nlotto is consisted with 6 random natural numbers less than 46\n");printf("your goal is to match lotto numbers as many as you can\n");printf("if you win lottery for *1st place*, you will get reward\n");printf("for more details, follow the link below\n");printf("http://www.nlotto.co.kr/counsel.do?method=playerGuide#buying_guide01\n\n");printf("mathematical chance to win this game is known to be 1/8145060.\n");
}int main(int argc, char* argv[]){// menuunsigned int menu;while(1){printf("- Select Menu -\n");printf("1. Play Lotto\n");printf("2. Help\n");printf("3. Exit\n");scanf("%d", &menu);switch(menu){case 1:play();break;case 2:help();break;case 3:printf("bye\n");return 0;default:printf("invalid menu\n");break;}}return 0;
}审一下题关键函数在play();里直接分析一下流程,大概是输入6个字符，然后与随机生成的字符匹配，然后获得flag，好像是不可能，但是这个程序有些小问题可以让我们做到。
陌生语法open("/dev/urandom", O_RDONLY);是打开文件用来获取随机数的
首先
unsigned char lotto[6];if (read(fd, lotto, 6) != 6) {printf("error2. tell admin\n");exit(-1);}for (i = 0; i < 6; i++) {lotto[i] = (lotto[i] % 45) + 1; // 1 ~ 45}
这里储存随机数的变量是unsigned char lotto[6];也就是范围等于0~255，(lotto[i] % 45) + 1也就是((0-255)% 45)+1所以lotto[i]范围也就是1 ~ 45，而在ASCII 码表中只有 DEC 33 开始才是可见字符，所以需要输入的字符为 ASCII DEC 33 到 45
其次
for(i=0; i<6; i++){for(j=0; j<6; j++){if(lotto[i] == submit[j]){match++;}}}
这里套了两个循环其实是不对的，因为我输入的六个数中只要有一个数等于lotto[i]那么match就会等于6了
所以我们每次都输入6个一样的字符理论上说最坏情况我们输入45次是可以猜中一次的
但我却非常幸运的输入一次就对了:)