复现

KCTF 第二题 南冥神功

硬看，发现通关要求是把aS_1全搞成1

然后这里是在aS_1数组里的移动，像是二维平面八方向走一样
有个很智障的地方就是aS_1的起始数值是这个'S'不是0……直接跳过结果搜不出路径

只能走到为0的位置，走过之后就置为1，也就是一笔画路径

搜了一下果然只有一条符合要求的路径，然后根据方向输出每一次case的选项

a=[1,0,1,0,0,1,0,0,1,1,
   1,1,0,0,1,0,0,1,0,0,
   0,0,1,0,1,1,1,1,1,0,
   0,1,1,0,1,0,0,1,0,0,
   0,0,1,0,0,1,0,0,1,1,
   1,1,0,1,1,1,0,1,0,1,
   0,0,1,1,1,1,0,1,0,1,
   0,1,1,0,0,1,0,1,0,1,
   0,0,0,1,0,0,1,1,0,0]
dj=[[-1,0],[0,1],[1,0],[1,-1],[0,-1],[-1,-1]]
du=[[-1,1],[0,1],[+1,+1],[1,0],[0,-1],[-1,0]]
v=150*[0]
s=150*[0]
top=0

def dfs(w,x,y):
    # print(w,x,y)
    global top
    if w==46:
        print(x,y)
        for i in range(46):
            print("%d,"%s[i],end='')
        return
    if x&1:
        for i in range(6):
            if x+dj[i][0]>=0 and x+dj[i][0]<9 and y+dj[i][1]>=0 and y+dj[i][1]<10 and a[(x+dj[i][0])*10+y+dj[i][1]]==0 and v[(x+dj[i][0])*10+y+dj[i][1]]==0:
                v[(x+dj[i][0])*10+y+dj[i][1]]=1
                s[top]=i
                top+=1
                dfs(w+1,x+dj[i][0],y+dj[i][1])
                v[(x+dj[i][0])*10+y+dj[i][1]]=0
                top-=1
    else:
        for i in range(6):
            if x+du[i][0]>=0 and x+du[i][0]<9 and y+du[i][1]>=0 and y+du[i][1]<10 and a[(x+du[i][0])*10+y+du[i][1]]==0 and v[(x+du[i][0])*10+y+du[i][1]]==0:
                v[(x+du[i][0])*10+y+du[i][1]]=1
                s[top]=i
                top+=1
                dfs(w+1,x+du[i][0],y+du[i][1])
                v[(x+du[i][0])*10+y+du[i][1]]=0
                top-=1

if __name__=='__main__':
    # print(a.count(0))
    print(a.count(0))
    v[0]=1
    dfs(0,0,0)
#1,2,3,4,3,2,1,2,3,4,3,2,1,1,0,1,2,1,0,0,5,0,5,4,3,4,5,0,5,0,1,2,1,0,1,2,1,2,3,4,3,2,2,3,2,1,

然后一个flag字符对应走两步，加上这两次的约束条件发现每个flag位置符合要求的字符唯一
脚本：

a=[1,2,3,4,3,2,1,2,3,4,3,2,1,1,0,1,2,1,0,0,5,0,5,4,3,4,5,0,5,0,1,2,1,0,1,2,1,2,3,4,3,2,2,3,2,1]
d='0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
for i in range(0,len(a),2):
    for j in range(len(d)):
        if (i//2+j)%6==5-a[i] and (i//2+j//6)%6==a[i+1]:
            print(d[j],end='')
#GJ0V4LA4VKEVQZSVCNGJ00N

KCTF 第四题 英雄救美

关键函数是这两个

第一个是在一个符号表里查输入串的对应位置（遇到1~9换行）然后导出一个纯数字串

第二个函数先把串依次填进九宫格

然后后面这段是验证数独
已知数独的初始值
0 4 0 7 0 0 0 0 0
9 2 0 0 0 0 6 0 7
8 3 0 0 0 5 4 0 0
0 1 0 0 0 3 0 0 0
0 0 0 2 0 1 0 0 0
0 0 0 5 0 0 0 4 0
0 0 4 9 0 0 0 7 1
3 0 5 0 0 0 0 9 4
0 0 0 0 0 8 0 6 0
手算出来补位连起来就是第一个函数的串，倒推回去就能得到flag
5 4 6 7 1 9 2 3 8
9 2 1 8 3 4 6 5 7
8 3 7 6 2 5 4 1 9
7 1 8 4 6 3 9 2 5
4 5 3 2 9 1 7 8 6
6 9 2 5 8 7 1 4 3
2 8 4 9 5 6 3 7 1
3 6 5 1 7 2 8 9 4
1 7 9 3 4 8 5 6 2

#include<iostream>
#include<cstdio>
#include<string>
using namespace std;
int main()
{
    string s[]={"5619238","18345","76219","7846925","4539786","6928713","28563","61728","1793452"};
    string a="$BPV:ubfYp}]DtN>aT^MGmJQ#*Hr`O'wjic0!hdy{oZz-@n+?&%s_/g<e[W)XUxRFSLRA;.l=CEkvK-(q";
    for(int i=0;i<9;i++)
    {
        for(int j=0;j<s[i].length();j++)
            printf("%c", a[i*9+(s[i][j]-49)]);
        printf("%d",9-s[i].length());
    }
    return 0;
}
//:u$YBPf2pa]Dt4#QM^H4ic'j0`w2y{d-Zzo2%/n_s@+2<UW)e4AR;F.4=-qEkvC2

虎符 redemption_code

先看pre

有个明显要求是len=14，然后看server_check_redemption_code

就是一行256个，第i层能和input[i]相等的位置等于i+1，其他承接上一层
然后下面验证的部分同理，只有"I Love Ninja Must Die 3. Beautiful Art And Motive Operation Is Creative."和input匹配的一段能正常跳转，推出k=20时匹配完，也就是从7开始匹配14个
flag就是flag{Ninja Must Die}
美团CTF-100mazes
patch掉exit，是个迷宫
https://blog.csdn.net/Palmer9/article/details/117350835