往哪走(迷宫)

题目：

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  _BYTE v3[29]; // [esp+17h] [ebp-35h] BYREF
  int v4; // [esp+34h] [ebp-18h]
  int v5; // [esp+38h] [ebp-14h] BYREF
  int i; // [esp+3Ch] [ebp-10h]
  _BYTE v7[12]; // [esp+40h] [ebp-Ch] BYREF

  __main();
  v3[26] = 0;
  *(_WORD *)&v3[27] = 0;
  v4 = 0;
  strcpy(v3, "*11110100001010000101111#");
  while ( 1 )
  {
    puts("you can choose one action to execute");
    puts("1 up");
    puts("2 down");
    puts("3 left");
    printf("4 right\n:");
    scanf("%d", &v5);
    if ( v5 == 2 )
    {
      ++*(_DWORD *)&v3[25];
    }
    else if ( v5 > 2 )
    {
      if ( v5 == 3 )
      {
        --v4;
      }
      else
      {
        if ( v5 != 4 )
LABEL_13:
          exit(1);
        ++v4;
      }
    }
    else
    {
      if ( v5 != 1 )
        goto LABEL_13;
      --*(_DWORD *)&v3[25];
    }
    for ( i = 0; i <= 1; ++i )
    {
      if ( *(_DWORD *)&v3[4 * i + 25] >= 5u )
        exit(1);
    }
    if ( v7[5 * *(_DWORD *)&v3[25] - 41 + v4] == 49 )
      exit(1);
    if ( v7[5 * *(_DWORD *)&v3[25] - 41 + v4] == 35 )
    {
      puts("\nok, the order you enter is the flag!");
      exit(0);
    }
  }
}

思路：

分析代码，从起点*开始，发现当满足路径的值不是1，并且能到达终点#的路径就是flag。

exp:

s = "*11110100001010000101111#"
l = []
for i in range(0, len(s), 5):
    ll = []
    for j in range(i, i + 5):
        ll.append(s[j])
    l.append(ll)
for i in l:
    print(i)
f = [(-1, 0, 1), (1, 0, 2), (0, -1, 3), (0, 1, 4)]
for dx, dy, b in f:
    print(dx, dy, b)
k = []
visit = []


def cry(x, y):
    visit.append((x, y))
    print("visit>>>", visit)
    if l[x][y] == "#":
        print("k>>>", k)
    for dx, dy, b in f:
        n_x = x + dx
        n_y = y + dy
        if (
            0 <= n_x < 5
            and 0 <= n_y < 5
            and l[n_x][n_y] != "1"
            and (n_x, n_y) not in visit
        ):
            k.append(b)
            print("k>>>", k)
            cry(n_x, n_y)

    return k


if __name__ == "__main__":
    flag = cry(0, 0)
    print("flag>>>", flag)