测试文件：https://adworld.xctf.org.cn/media/task/attachments/2543a3658d254c30a89e4ea7b8950c27.zip
这道题很坑了，exe文件研究了半天。
1.准备
获得信息
- 32位文件
2.IDA打开
用IDA看了三个文件，都差不多。
1 int __cdecl main(int argc, const char **argv, const char **envp)
2 {
3 void *v3; // esp
4 void *v4; // esp
5 char *v6; // [esp+4h] [ebp-44h]
6 char v7; // [esp+8h] [ebp-40h]
7 char v8; // [esp+1Bh] [ebp-2Dh]
8 char *v9; // [esp+1Ch] [ebp-2Ch]
9 int v10; // [esp+20h] [ebp-28h]
10 char v11; // [esp+25h] [ebp-23h]
11 char v12; // [esp+26h] [ebp-22h]
12 char v13; // [esp+27h] [ebp-21h]
13 char v14; // [esp+28h] [ebp-20h]
14 char v15; // [esp+29h] [ebp-1Fh]
15 char v16; // [esp+2Ah] [ebp-1Eh]
16 char v17; // [esp+2Bh] [ebp-1Dh]
17 char v18; // [esp+2Ch] [ebp-1Ch]
18 char v19; // [esp+2Dh] [ebp-1Bh]
19 char v20; // [esp+2Eh] [ebp-1Ah]
20 char v21; // [esp+2Fh] [ebp-19h]
21 char v22; // [esp+30h] [ebp-18h]
22 char v23; // [esp+31h] [ebp-17h]
23 char v24; // [esp+32h] [ebp-16h]
24 char v25; // [esp+33h] [ebp-15h]
25 char v26; // [esp+34h] [ebp-14h]
26 char v27; // [esp+35h] [ebp-13h]
27 char v28; // [esp+36h] [ebp-12h]
28 char v29; // [esp+37h] [ebp-11h]
29 char v30; // [esp+38h] [ebp-10h]
30 char v31; // [esp+39h] [ebp-Fh]
31 char v32; // [esp+3Ah] [ebp-Eh]
32 char v33; // [esp+3Bh] [ebp-Dh]
33 char v34; // [esp+3Ch] [ebp-Ch]
34 char v35; // [esp+3Dh] [ebp-Bh]
35 char v36; // [esp+3Eh] [ebp-Ah]
36 char v37; // [esp+3Fh] [ebp-9h]
37 int *v38; // [esp+40h] [ebp-8h]
38
39 v38 = &argc;
40 __main();
41 v8 = 'T';
42 v37 = -56;
43 v36 = 126;
44 v35 = -29;
45 v34 = 100;
46 v33 = -57;
47 v32 = 22;
48 v31 = -102;
49 v30 = -51;
50 v29 = 17;
51 v28 = 101;
52 v27 = 50;
53 v26 = 45;
54 v25 = -29;
55 v24 = -45;
56 v23 = 67;
57 v22 = -110;
58 v21 = -87;
59 v20 = -99;
60 v19 = -46;
61 v18 = -26;
62 v17 = 109;
63 v16 = 44;
64 v15 = -45;
65 v14 = -74;
66 v13 = -67;
67 v12 = -2;
68 v11 = 106;
69 v10 = 19;
70 v3 = alloca(32);
71 v4 = alloca(32);
72 v9 = &v7;
73 printf("Key: ");
74 v6 = v9;
75 scanf("%s", v9);
76 if ( check_key((int)v9) )
77 interesting_function((int)&v8);
78 else
79 puts("Wrong");
80 return 0;
81 }
3.代码分析
很明显只要绕过第76行代码，我们就能够获取我们需要的flag，而且v8还是已知的，
3.1 GDB调试
将Linux下的那个文件放入Linux调试。
task9_x86_64_46d01fe312d35ecf69c4ff8ab8ace75d080891dc
命令：
gdb
file task9_x86_64_46d01fe312d35ecf69c4ff8ab8ace75d080891dc
b main
r
然后一直执行命令next，运行到check_key函数处
3.2 跳过check_key
把test eax,eax改为真就行，也就是把eax改为1。
修改eax
set $eax=1
一直执行
4.get flag！
flag_is_you_know_cracking!!!
来源：oschina
链接：https://my.oschina.net/u/4394201/blog/3388982