本文最后更新于 218 天前，其中的信息可能已经过时，如有错误可以直接在文章下留言
周末打了两天强网杯，最后就出了两道，另外一道 mips 是队友出的，强网杯题量有点多，Reverse 这边总共 6 道，不过其他对我来说感觉确实有些难度，这一道题应该是最简单的一道，但是出的竟然比 mips 少，太不合理了，明显的 py。
自己在做这题的时候还拿了个三血，虽然最后被日成 50 分，额外分可以忽略不记了，但是自己还是挺开心的，人生第一次拿血。
题目描述
#迷宫重重，尝试走出你的地图吧！
题目重点主要还是在代码审计
int __fastcall main(int argc, const char **argv, const char **envp) { char v4; // [rsp+27h] [rbp-9h] BYREF int v5; // [rsp+28h] [rbp-8h] unsigned int i; // [rsp+2Ch] [rbp-4h] sub_4033D0(argc, argv, envp); puts(Buffer); for ( i = 0; (int)i <= 8; ++i ) { sub_401530(i); while ( 1 ) { system("cls"); if ( !dword_40D060[i] ) break; v5 = scanf("%c", &v4); if ( v4 == 'd' ) { sub_40235D(i); } else if ( v4 > 'd' ) { if ( v4 == 's' ) { sub_401F6B(i); } else if ( v4 == 'w' ) { sub_401789(i); } } else if ( v4 == 'a' ) { sub_401B7A(i); } } puts(asc_40A068); } puts(aFlagMd51FlagMd); return 0; }
主函数的逻辑也确实像一个迷宫题，wasd，每个方向对应一个处理的函数。for 循环中的 puts 是成功通关一个关卡的信息。
aFlagMd51FlagMd 循环后即是我们成功通关后的关于 flag 的信息，如下
//flag是每个关卡中每个箱子移动的最短的次数拼接的md5码值和几个字符， //1.flag{四个字符_md5值}，2.注意同一张图箱子不一定只有一个哦3.同一关需要计算所有箱子的总的最小移动次数，将每一关的最短次数拼接 解释：例如第一关是3第二关是5，就是md5(35...)
中间有个 while，想要跳出，必须得满足 dword_40D060 [i] 为 0，它得初始值全为 0，我们将其重命名为 check，看看函数对他有没有什么处理
前面还有个函数 sub_401530，我们先重点分析这个函数
int __fastcall sub_401530(int a1) { _DWORD *v1; // rax int j; // [rsp+28h] [rbp-8h] int i; // [rsp+2Ch] [rbp-4h] LODWORD(v1) = printf(&Format); for ( i = 0; i <= 19; ++i ) { for ( j = 0; j <= 19; ++j ) //a1为for循环的i，故迷宫的每一层就是一个关卡 //此处遍历了整一层迷宫 { if ( dword_404040[400 * a1 + 20 * i + j] == 2 ) //这个dword_404040就是我们的maze，可以点进去看 //根据这里的索引可以大致推出是一个400*20*20的maze //寻找每一层中2的坐标 { dword_40D040 = j; //dword_40D040为2的纵坐标y dword_40D044 = i; //dword_40D040为2的横坐标x } LODWORD(v1) = dword_404040[400 * a1 + 20 * i + j]; if ( (_DWORD)v1 == 3 ) { v1 = check; //若这层迷宫当中存在3，则check[i]的值加1 ++check[a1]; } } } return (int)v1; }
上面的代码注释的很详细，目前我们知道迷宫中有 2，3，我们接着再看 d 的函数 sub_40235D
__int64 __fastcall sub_40235D(int a1) { __int64 result; // rax int v2; // [rsp+8h] [rbp-8h] unsigned int v3; // [rsp+Ch] [rbp-4h] result = (unsigned int)x; if ( x != 19 ) { v3 = x + 1; //d，往右走一格，故v3应该是行动后的横坐标 v2 = y; result = maze[400 * a1 + 1 + 20 * y + x]; //result为行动后的坐标处 if ( (_DWORD)result != 5 ) { result = maze[400 * a1 + 20 * y + v3]; if ( (_DWORD)result != 1 ) //如果行动后的坐标处不为1，则执行后续代码，此处可判定0为路，1为墙。 { if ( maze[400 * a1 + 20 * y + v3] == 3 ) //如果行动后的坐标处为3 { result = maze[400 * a1 + 2 + 20 * y + x]; //设置result的值为行动后的坐标再往右走一格的坐标，即dd的坐标， if ( (_DWORD)result == 1 ) return result; if ( maze[400 * a1 + 2 + 20 * y + x] == 4 ) //判断行动后的坐标的右边的值是不是4 { maze[400 * a1 + 2 + 20 * y + x] = 5; //如果为4，将4的值变为5 maze[400 * a1 + 20 * v2 + v3] = 0; //将行动后的坐标恢复为0 --check[a1]; //check数组减1，那么我们的要进入这里的代码处并执行。 } else { maze[400 * a1 + 2 + 20 * y + x] = 3; //如果不为4，将行动后的坐标的右边值设为3，相当于将3往右推了一格 } } maze[400 * a1 + 20 * y + x] = 0; maze[400 * a1 + 20 * v2 + v3] = 2; result = v3; x = v3; //这里是将走过的地方恢复为路的操作，和将行动后的坐标处的值设置为2，可以判断2就是我们。 } } } return result; }
d 方向的函数代码已经进行详细注释，在弄清楚代码逻辑之后，再结合 aFlagMd51FlagMd 字符串的内容，可以很容易判断这实现的是一个推箱子游戏。
并且 2 是小人，0 是路，1 是墙，3 是箱子，4 是终点，当我们把箱子推到终点之后终点就会变成 5。
我们直接将迷宫数组第一层提取出来，先验证一下我们的想法，因为我们只看了 d 方向的函数，不确定其他 was 方向的函数有没有进行其他处理，如下，起点坐标为 x=4，y=5，如果我们的猜想正确，就会有通关的输出，动态调试输入 dwwaadddssaaaww，就是第一关推箱子的路径
mazelayerone=[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,4,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,0,3,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,0,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 0,0,0,0,2,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 0,1,1,0,0,1,1,0,0,0,1,0,0,0,1,0,0,0,1,0,#2 0,1,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,1,0,0,0,1,1,1,1,1,0,#dwwaadddssaaaww 0,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,1,0, 0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0, 0,0,0,0,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1,0, 0,0,0,0,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,1,1,1,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0]
发现我们的猜想正确，那就可以直接将所有迷宫提取出来手搓，题目要求的是每个箱子移动的最短的次数，所以其实主要看箱子就行，注意以下几点
#有些层不止有一个箱子，并且有几个箱子3，就会有几个终点4，并不是只有一个终点，因为要让check[i]减为0，故所有箱子都要推到终点 #小人2的位置也要关注，因为推箱子游戏的性质可能导致，箱子推到靠墙的位置后无法返回 #maze长度为5600，真正用到的迷宫长度为3600，题目要求的四个字符在多余的全1部分，为qwb!，四个字符全部由0组成，如下图
下面代码为手搓过程
maze=[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,4,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,0,3,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,0,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 0,0,0,0,2,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 0,1,1,0,0,1,1,0,0,0,1,0,0,0,1,0,0,0,1,0, #2 0,1,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,1,0,0,0,1,1,1,1,1,0,#dwwaadddssaaaww 0,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,1,0, 0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0, 0,0,0,0,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1,0, 0,0,0,0,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,1,1,1,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0, 0,1,2,0,0,3,0,0,0,4,0,0,0,0,0,0,0,0,1,0,#ddddddd 4+8=12 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0, 0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,0, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0, 0,1,0,0,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1,0, 0,1,0,0,0,0,1,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,1,1,1,1,1,1,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,1,0, 0,0,1,1,1,1,1,0,0,0,1,0,0,0,1,1,1,1,1,0, 0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0, 0,0,1,0,0,0,1,0,1,1,1,0,0,0,1,1,1,1,1,0, 0,0,1,0,0,0,3,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,0,1,1,1,1,0,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,0,4,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0, 0,1,1,1,1,1,1,1,1,1,1,0,0,0,1,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,#dssaaaawwwwww 13 1,0,1,0,3,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1, 1,0,1,1,1,0,1,1,1,0,1,1,1,1,1,0,0,0,0,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,1,1, 1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1, 1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,1, 1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,1,0,0,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,0,0,0,0,0,1,1,1,1,1,1,1,0,0,0,0,0,1, 1,0,0,0,0,0,0,0,3,0,0,0,0,1,0,0,0,0,0,1, 1,0,0,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,0,1, 1,0,0,0,0,0,0,1,0,0,0,0,2,1,0,0,0,0,0,1,#wwaaaaaaaaaasaww 1,0,0,0,0,0,0,1,1,1,1,1,1,1,0,0,0,0,0,1, #9 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1, 1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,1,1, 1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0, 1,0,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,1,0,0, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1, 1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1, 1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,1,0,1, 1,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1, 1,0,0,0,0,0,0,1,1,1,1,1,1,1,1,0,1,1,0,1, 1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, #21 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,1, 1,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,0,1,0,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,1, 1,1,1,1,1,0,1,1,1,1,1,1,1,1,1,0,1,1,1,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,4,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,1, 1,0,1,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,1, 1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,0,1,1,0,1, 1,0,1,0,1,0,0,0,0,0,1,0,0,0,0,0,1,0,0,1,#6+7=13 1,0,1,0,1,0,1,1,1,1,1,0,1,1,1,0,1,0,0,1, 1,0,0,0,1,0,1,0,0,0,1,0,1,0,0,0,1,0,0,1, 1,0,1,1,1,0,1,0,1,0,1,0,1,0,1,0,1,1,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,1, 1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,0,0,0,0,0,1,1,1,1,1,1,1,0,1,1,1,0,1, 1,0,0,0,0,0,0,1,0,0,0,0,0,0,3,0,1,0,0,1, 1,1,1,1,1,1,1,1,4,0,0,0,0,0,0,0,1,0,0,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1, 1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,1,0,0,0,0,2,1,0,0,0,0,0,0,0,0,1, 1,0,1,0,1,0,1,1,1,1,1,0,1,1,1,1,1,1,0,1, 1,0,1,0,1,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1, 1,0,0,0,1,0,1,0,1,1,1,1,1,0,1,1,1,1,0,1, 1,1,1,1,1,0,1,0,1,0,0,0,0,0,1,0,0,0,0,1, 1,0,0,0,0,0,1,0,1,0,1,1,1,1,1,0,1,1,0,1, 1,0,1,1,1,1,1,0,1,0,1,0,0,0,0,0,1,0,0,1,#25 1,0,1,0,0,0,0,0,1,0,1,0,1,1,1,1,1,0,0,1, 1,0,1,0,1,1,1,1,1,0,1,0,1,0,0,0,0,0,0,1, 1,0,0,0,3,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1, 1,1,1,1,1,0,1,1,1,1,1,0,1,0,1,0,0,0,0,1, 1,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,1,1,1,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,0,0,0,1,0,0,1, 1,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,4,0,0,0,0,0,0,0,0,0,0,0,2,0,0,3,0,0,1, 1,0,1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,0,1,1,1,1,1,1,1,0,1,1,1,1,1,0,0,1, 1,0,1,0,1,4,0,0,0,0,1,0,0,0,0,0,1,0,0,1, 1,0,1,0,1,0,1,1,1,1,1,0,1,0,1,0,1,0,0,1, 1,0,1,0,1,0,1,0,0,0,1,0,1,0,1,0,1,0,0,1, 1,0,1,0,1,0,1,0,1,1,1,0,1,0,1,0,1,1,0,1, 1,0,0,0,3,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,0,1, 1,0,0,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,#5+15+11=31 1,0,0,0,3,0,0,0,0,0,0,0,0,0,0,4,1,0,0,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1, 1,0,1,0,1,1,1,1,1,1,1,0,1,1,1,1,1,1,0,1, 1,0,1,0,1,0,0,0,0,0,1,0,0,0,0,0,1,0,0,1, 1,0,1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1, 1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1, 1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,0,1,1,1,0,1,1,1,0,1,1,1,1,1,1,0,1, 1,0,0,0,1,0,1,3,0,0,1,0,1,0,0,0,1,0,0,1, 1,1,1,1,1,0,0,2,1,1,1,0,1,0,1,0,1,0,0,1, 1,0,0,0,0,0,1,0,1,0,0,0,0,0,1,0,1,0,0,1, 1,0,1,1,1,1,1,4,1,0,1,1,1,1,1,1,1,0,0,1, 1,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,#3 1,0,1,0,1,1,1,1,1,0,1,1,1,1,1,1,1,1,0,1, 1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1, 1,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,1, 1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,0,1, 1,0,1,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, ] print(len(maze)) #x=4 y=5 #flag{qwb!_md5(212139211325313)} #flag{qwb!_fec2d316d20dbacbe0cdff8fb6ff07b9}
故 flag 为 flag {qwb!_fec2d316d20dbacbe0cdff8fb6ff07b9}
