关键点在这
循环输出dword_6020C0每个值作为off_6020A0的key来对比,wp如下:
s = [0x24,0x00,0x05,0x36,0x65,0x07,0x27,0x26,0x2D,0x01,0x03,0x00,0x0D,0x56,0x01,0x03,0x65,0x03,0x2D,0x16,0x02,0x15,0x03,0x65,0x00,0x29,0x44,0x44,0x01,0x44,0x2B] d = 'L3t_ME_T3ll_Y0u_S0m3th1ng_1mp0rtant_A_{FL4G}_W0nt_b3_3X4ctly_th4t_345y_t0_c4ptur3_H0wev3r_1T_w1ll_b3_C00l_1F_Y0u_g0t_1t' flag = '' for i in s: flag += d[i] print flag #ALEXCTF{W3_L0v3_C_W1th_CL45535}