通过搜索算法解出最优路径的题目平台MoeCTF方向逆向知识点BFS、DFS难度入门一、信息获取题目意图就是让输入字符串走迷宫二、分析从下面分析发现n0x37为行数我更名为rown32为列数我更名为column终点为1532flag的内容为走出迷宫的路径这里可以直观的看出W、A、S、D对应的行和列的变化下面是找地图这里被打了问号是因为要在程序运行的时候这个数组才被赋值而现在是静态分析就没有初始值但是在左边可得知其被sub_1400010E0这个函数引用了因此地图就在这个函数里面打开就有地图了复制下来就行三、EXPfromcollectionsimportdequemap[11111111111111111111111111111111111111111111111111111111,10100000000000000010000011011101011111111101011100000111,10111010111111111010111011000001000001000001000101110111,10000010000010000010001011011111111101110111011101110111,10111111111011101110111011010000000000010100010001110111,10100000001000101000100011010101111111011101110101110111,10101011111110111011101011010101000001000000010101110111,10101010000010100000101011110101110101111101111111110111,10111010111010101111101011100101000100000101000101110111,10000010001010001000001011001111011111010101011101110111,11111011101011111011111111101000100000101100101001110111,10001010001000100010000010001010011000100010010011000001,10111010111110101010111011011001011111010101011101011101,10001010001000001010001011000101000100000101000101011101,11101011101111111011101011110101110111111101110101011101,10001000101000001010001011000100010100000101000101011101,10111111101011101110111011011111110101110111011101011101,10001000001000100000001011000100000100010000000101011001,11101011111011111111101011110101111101111111110101011011,10101000000010001000101011010100000001000100010101011011,10101111111110101010101011010111111111010101010101011011,10100000000000100010101011010000000000010001010101011011,10111111111111111110111011011111111111111111011101011011,10000000001111000000000011110111010000111100011111011011,11101111100000011011011111111010110111011101100001011011,11101111111111111011011111111101110111101101100001011011,10001000111111000010000011111010110111011101100001011011,10111010111111111010111011110111010000111101100001010011,10000010000010000010001011111111111111111101100001010111,10111111111011101110111011110001000110001101100001010001,10100000001000101000100011110111011101111101100001011101,10101011111110111011101011110001000101111101100001011101,10101010000010100000101011111101011101111101100001011101,10111010111010101111101011110001000110001101100001011101,10000010001010101000001011111111111111111101100001011101,11111011101011111011111110000000000000001101100001011101,10001010001000100010000011111111111111111100110011011101,10111010111110101010111010010000000011111110001111011101,10001010001000001010001010110111000001111110100101011101,11101011101111111011101000110011001111111100110111011101,10001000101000001010001011111111111111111111110111010001,10111111101011101110111010100001001100000000000011011011,10001000001000100000001011111111111101011101111001011011,10101011111011111111101011000000000001000100010111011011,10101000000010001000101010010111111111111111111111011011,10101111111110101010101010110111111111111111111101011011,10100000000000100010101011100000000000000000000011011011,10111111111111111110011011111111111111111111111011011011,10000011111111111111000010000000000000000000000000011001,11111011111111111111111111111111111111111111111111111101,11111011100001100110110111000000000000000000000111111101,11111011101111011010000111011111111111111111110111111101,11111011100001000010110110000111111111111111110000000001,11111011101111011010110111101111111111111111111111111111,11110000000000011000110000000000000000000000000000000011,11111111111111111111111111111111111111111111111111111111,]start(1,1)#行列goal(15,32)moves[(W,-1,0),(S,1,0),(A,0,-1),(D,0,1)]qdeque([(start[0],start[1],)])seen{start}whileq:r,c,curq.popleft()if(r,c)goal:pathcurbreakforch,dr,dcinmoves:nr,ncrdr,cdcifnot(0nr55and0nc55):continueifmap[nr][nc]1or(nr,nc)inseen:continueseen.add((nr,nc))q.append((nr,nc,curch))print(path)print(fmoectf{{{path}}})使用广度优先搜索寻找flag四、总结1.我觉得要注意ida给的十六进制数这个可能是数字也可能是对应的ASCII如果判断错误会给使代码理解出现错误看到 32 到 126 之间的立即数先想一下 ASCII。常见的就这几个0x30–0x39 是 ‘0’–‘9’0x41–0x5A 是 ‘A’–‘Z’0x61–0x7A 是 ‘a’–‘z’。在 IDA 里对这个数按 R可以直接切成字符看。2.不重要的变量可以直接忽略