解題方法寫在代碼注釋里了
題目：

?

#include

#include

//大概閱讀整體代碼，通過最后幾行代碼我們得知我們需要的flag就是代碼中的hash變量

//此時我們逆向推到hash變量的來源

//1.hash值由fist、second和argv[3]三個變量來決定，那我們就跟蹤這三個變量

//2.fist變量在第二個if語句中，提示如果first不等于0xcafe的話就退出程序，那我們按照作者意思肯定要讓程序執(zhí)行到顯示flag

//那就必須使first=0xcafe

//3.接下來我們再找著second變量，發(fā)現(xiàn)second在第三個if語句，提示如果second % 5 == 3 || second % 17 != 8的話就退出，我們目的

//就是執(zhí)行到最后，那我們就直接用窮舉法找到一個數(shù)滿足second % 5 ！= 3 && second % 17 == 8

//函數(shù)：??????????????? unsigned int GetNum = 0;

//??????????????????????????????? do{

//????????? ??????????????????????????????if(GetNum % 5 ！= 3 && GetNum % 17 == 8)

//??????????????????????????????????????????????????????? {

//??????????????????????????????????????????????????????????????? printf("GetNum:%d",GetNum);

//????????????????????????????? ??????????????????????????????????break;

//??????????????????????????????????????????????????????? }

//??????????????????????????????????????? GetNum++;

//??????????????????????????????????????? }while(1);

//最后得到GetNum = 25,也就是second是25

//4.最后argv[3]可從最后一個if得知argv[3]=h4cky0u

//5.那我們帶進hash中去算

//unsigned int hash =0xcafe * 31337 + (25 % 17) * 11 + strlen("h4cky0u") - 1615810207;

//注意最后一行代碼要以十六進制輸出才能得到flag

//z最后flag為c0ffee

//6.提交顯示正確了

int main(int argc, char *argv[]) {

??????? if (argc != 4) {

??????????????? printf("what?\n");

??????????????? exit(1);

??????? }

?

??????? unsigned int first = atoi(argv[1]);

??????? if (first != 0xcafe) {

??????????????? printf("you are wrong, sorry.\n");

??????????????? exit(2);

??????? }

?

??????? unsigned int second = atoi(argv[2]);

??????? if (second % 5 == 3 || second % 17 != 8) {

??????????????? printf("ha, you won't get it!\n");

??????????????? exit(3);

??????? }

?

??????? if (strcmp("h4cky0u", argv[3])) {

??????????????? printf("so close, dude!\n");

??????????????? exit(4);

??????? }

?

??????? printf("Brr wrrr grr\n");

?

??????? unsigned int hash = first * 31337 + (second % 17) * 11 + strlen(argv[3]) - 1615810207;

?

??????? printf("Get your key: ");

??????? printf("%x\n", hash);

??????? return 0;

}