0040124F > \66:B8 0800 mov ax, 0x8
00401253 . 66:35 0700 xor ax, 0x7
00401257 . 0FBE45 E6 movsx eax, byte ptr [ebp-0x1A]
0040125B . 2BC1 sub eax, ecx
0040125D . 8945 FC mov dword ptr [ebp-0x4], eax
00401260 . 0FBE45 E4 movsx eax, byte ptr [ebp-0x1C]
00401264 . DB45 FC fild dword ptr [ebp-0x4]
00401267 . 2BC1 sub eax, ecx
00401269 . 8945 FC mov dword ptr [ebp-0x4], eax
0040126C . 0FBE45 E5 movsx eax, byte ptr [ebp-0x1B]
00401270 . DB45 FC fild dword ptr [ebp-0x4]
00401273 . 2BC1 sub eax, ecx
00401275 . 8945 FC mov dword ptr [ebp-0x4], eax
00401278 . DA75 FC fidiv dword ptr [ebp-0x4] ; x = sn[0] / sn[1]
0040127B . 0FBE45 E7 movsx eax, byte ptr [ebp-0x19]
0040127F . 2BC1 sub eax, ecx
00401281 . 8945 FC mov dword ptr [ebp-0x4], eax
00401284 . DEE9 fsubp st(1), st ; y = sn[2] - x
00401286 . DA4D FC fimul dword ptr [ebp-0x4] ; y *= sn[3]
00401289 D80D 1C714000 fmul dword ptr [0x40711C] ; y *= 16
0040128F . D95D FC fstp dword ptr [ebp-0x4]
00401292 . 74 03 je short 00401297
00401294 . 75 01 jnz short 00401297
00401296 E8 db E8
00401297 > 66:B8 0800 mov ax, 0x8
0040129B . 66:35 0700 xor ax, 0x7
0040129F . D945 FC fld dword ptr [ebp-0x4]
004012A2 . D81D 18714000 fcomp dword ptr [0x407118] ; == 384
004012A8 . 6A 00 push 0x0
004012AA . 68 64804000 push 00408064 ; crackme 2017 ctf
004012AF . DFE0 fstsw ax
004012B1 . 9E sahf
004012B2 . 75 0E jnz short 004012C2
004012B4 . 68 48804000 push 00408048 ; registration successful !
004012B9 . EB 0C jmp short 004012C7
004012BB > 6A 00 push 0x0
004012BD . 68 64804000 push 00408064 ; crackme 2017 ctf
004012C2 > 68 40804000 push 00408040 ; error !
004012C7 > FF35 24AA4000 push dword ptr [0x40AA24] ; |hOwner = NULL
004012CD . FF15 AC704000 call dword ptr [<&USER32.MessageBoxA>>; \MessageBoxA
004012D3 . C9 leave
004012D4 . C3 retn
得到384 / 16 = 24 = (sn[2] - (sn[0] / sn[1])) * sn[3]
上面提到的sn[n]都是-0x30之后的
然后穷举
for x1 in range(1, 1000):
for x2 in range(1, 1000):
for x3 in range(1, 1000):
for x4 in range(1, 1000):
if (x3 - (x1 / x2)) * x4 == 24:
print(x1, x2, x3, x4)
结果：
1 1 2 24
1 1 3 12
1 1 4 8
1 1 5 6
1 1 7 4
1 1 9 3
1 1 13 2
1 1 25 1
1 2 1 48
1 2 2 16
1 3 3 9
1 4 1 32
1 5 1 30
1 5 5 5
1 7 1 28
1 9 1 27
....
挑一个1148提交成功
我挑的正好是能提交成功的？还是现在WEB提交答案改进了，多解也能成功提交？
