网络幻影

int __cdecl main_0(int argc, const char **argv, const char **envp)
{
  char v4; // [esp+0h] [ebp-104h]
  char v5; // [esp+0h] [ebp-104h]
  unsigned int i; // [esp+D0h] [ebp-34h]
  char v7[40]; // [esp+DCh] [ebp-28h] BYREF

  __CheckForDebuggerJustMyCode(&unk_41200F);
  qmemcpy(v7, "PY", 2);
  v7[2] = -94;
  v7[3] = -108;
  v7[4] = 46;
  v7[5] = -114;
  v7[6] = 92;
  v7[7] = -107;
  v7[8] = 121;
  v7[9] = 22;
  v7[10] = -27;
  v7[11] = 54;
  v7[12] = 96;
  v7[13] = -57;
  v7[14] = -24;
  v7[15] = 6;
  v7[16] = 51;
  v7[17] = 120;
  v7[18] = -16;
  v7[19] = -48;
  v7[20] = 54;
  v7[21] = -56;
  v7[22] = 115;
  v7[23] = 27;
  v7[24] = 101;
  v7[25] = 64;
  v7[26] = -75;
  v7[27] = -44;
  v7[28] = -24;
  v7[29] = -100;
  v7[30] = 101;
  v7[31] = -12;
  v7[32] = -70;
  v7[33] = 98;
  v7[34] = -48;
  sub_40108C("Please input the flag:\n", v4);
  sub_4011C2("%s", byte_410158);
  sub_401050(byte_410158, Str);    //魔改RC4 KSA多了一个^0x66,最后的和秘钥流的异或变成了模取
  for ( i = 0; i < 0x23; ++i )
  {
    if ( byte_410158[i] != v7[i] )
    {
      sub_40108C("Wrong flag!\n", v5);
      return 0;
    }
  }
  sub_40108C("Correct flag!\n", v5);
  return 0;
}

// write access to const memory has been detected, the output may be wrong!
void *sub_401500()
{
  void *result; // eax

  result = (void *)(NtCurrentPeb()->NtGlobalFlag & 0x70);
  if ( !result )
  {
    *(&loc_40902A + 1) ^= 0x65u;
    *((_BYTE *)&loc_40902A + 2) ^= 0xFAu;
    *(&loc_407080 + 2) ^= 5u;
    result = &loc_40B077;
    loc_40B077 ^= 0x10u;
  }
  return result;
}

// write access to const memory has been detected, the output may be wrong!
void *__cdecl sub_4015C0(int a1, char a2)
{
  void *result; // eax

  sub_401023("%s", a2);
  if ( CloseHandle((HANDLE)0x1234) || GetLastError() != 6 )
    return 0;
  *(&loc_407080 + 1) ^= 0xD0u;
  *(&loc_40B104 + 2) ^= 0xCBu;
  loc_40B078 ^= 0x61u;
  result = &loc_40B079;
  loc_40B079 ^= 0x5Fu;
  return result;
}

void *__cdecl sub_40B000(int a1, int a2, unsigned int a3)
{
  void *result; // eax
  char v4; // [esp+D3h] [ebp-129h]
  char v5[264]; // [esp+DCh] [ebp-120h] BYREF
  int v6; // [esp+1E4h] [ebp-18h]
  int i; // [esp+1F0h] [ebp-Ch]

  v6 = 0;
  result = memset(v5, 0, 0x100u);
  for ( i = 0; i < 256; ++i )
  {
    *(_BYTE *)(i + a1) = i ^ 0xCF;
    v5[i] = *(_BYTE *)(a2 + i % a3);
    result = (void *)(i + 1);
  }
  for ( i = 0; i < 256; ++i )
  {
    v6 = ((unsigned __int8)v5[i] + v6 + *(unsigned __int8 *)(i + a1)) % 256;
    v4 = *(_BYTE *)(i + a1);
    *(_BYTE *)(i + a1) = *(_BYTE *)(v6 + a1);
    *(_BYTE *)(v6 + a1) = v4 ^ 0xAD;
    result = (void *)(i + 1);
  }
  return result;
}

unsigned int __cdecl sub_401A60(int a1, int a2, unsigned int a3)
{
  unsigned int result; // eax
  int v4; // ecx
  char v5; // al
  char v6; // [esp+D3h] [ebp-35h]
  unsigned int i; // [esp+DCh] [ebp-2Ch]
  int v8; // [esp+F4h] [ebp-14h]
  int v9; // [esp+100h] [ebp-8h]

  __CheckForDebuggerJustMyCode(&unk_41200F);
  v9 = 0;
  v8 = 0;
  for ( i = 0; ; ++i )
  {
    result = i;
    if ( i >= a3 )
      break;
    v9 = (v9 + 1) % 256;
    v8 = (v8 + v9 * *(unsigned __int8 *)(v9 + a1)) % 256;
    v6 = *(_BYTE *)(v9 + a1);
    *(_BYTE *)(v9 + a1) = *(_BYTE *)(v8 + a1);
    *(_BYTE *)(v8 + a1) = v6;
    v4 = (*(unsigned __int8 *)(v8 + a1) + *(unsigned __int8 *)(v9 + a1)) % 256;
    if ( i % 2 )
      v5 = *(_BYTE *)(v4 + a1) + *(_BYTE *)(i + a2);
    else
      v5 = *(_BYTE *)(i + a2) - *(_BYTE *)(v4 + a1);
    *(_BYTE *)(i + a2) = v5;
  }
  return result;
}

int __cdecl main(int argc, const char **argv, const char **envp)
{
  HMODULE ModuleHandleW; // eax
  int v4; // eax
  _DWORD *v5; // eax
  unsigned int v6; // edx
  _DWORD *v7; // ecx
  unsigned int v8; // ebx
  char *v9; // edi
  unsigned int v10; // esi
  unsigned int v11; // esi
  bool v12; // cf
  unsigned __int8 v13; // al
  unsigned __int8 v14; // al
  unsigned __int8 v15; // al
  int v16; // esi
  void *v17; // ecx
  void *v18; // ecx
  const char *v19; // edx
  int v20; // eax
  int v22; // [esp+0h] [ebp-80h]
  void *Block[5]; // [esp+10h] [ebp-70h] BYREF
  unsigned int v24; // [esp+24h] [ebp-5Ch]
  void *v25[5]; // [esp+28h] [ebp-58h] BYREF
  unsigned int v26; // [esp+3Ch] [ebp-44h]
  char Src[48]; // [esp+40h] [ebp-40h] BYREF
  int v28; // [esp+7Ch] [ebp-4h]

  ModuleHandleW = GetModuleHandleW(0);
  sub_402320(ModuleHandleW);
  sub_4024A0();
  v4 = sub_402870(std::cout, "welcome to 2019 sctf");
  std::ostream::operator<<(v4, sub_402AC0);
  sub_402870(std::cout, "please input your ticket:");
  sub_402AF0(v22);
  v25[4] = 0;
  v26 = 15;
  LOBYTE(v25[0]) = 0;
  sub_401D30(v25, Src, strlen(Src));
  v28 = 0;
  v5 = sub_4020D0(Block, (int)v25);             // AES的CBC模式
  v6 = strlen(aPvfqyc4ttc2uxr);
  v7 = v5;
  if ( v5[5] >= 0x10u )
    v7 = (_DWORD *)*v5;
  v8 = v5[4];
  v9 = aPvfqyc4ttc2uxr;
  v10 = v8;
  if ( v6 < v8 )
    v10 = v6;
  v12 = v10 < 4;
  v11 = v10 - 4;
  if ( v12 )
  {
LABEL_8:
    if ( v11 == -4 )
      goto LABEL_17;
  }
  else
  {
    while ( *v7 == *(_DWORD *)v9 )
    {
      ++v7;
      v9 += 4;
      v12 = v11 < 4;
      v11 -= 4;
      if ( v12 )
        goto LABEL_8;
    }
  }
  v12 = *(_BYTE *)v7 < (unsigned __int8)*v9;
  if ( *(_BYTE *)v7 != *v9
    || v11 != -3
    && ((v13 = *((_BYTE *)v7 + 1), v12 = v13 < (unsigned __int8)v9[1], v13 != v9[1])
     || v11 != -2
     && ((v14 = *((_BYTE *)v7 + 2), v12 = v14 < (unsigned __int8)v9[2], v14 != v9[2])
      || v11 != -1 && (v15 = *((_BYTE *)v7 + 3), v12 = v15 < (unsigned __int8)v9[3], v15 != v9[3]))) )
  {
    v16 = v12 ? -1 : 1;
    goto LABEL_18;
  }
LABEL_17:
  v16 = 0;
LABEL_18:
  if ( !v16 )
  {
    if ( v6 <= v8 )
      v16 = v6 < v8;
    else
      v16 = -1;
  }
  if ( v24 >= 0x10 )
  {
    v17 = Block[0];
    if ( v24 + 1 >= 0x1000 )
    {
      v17 = (void *)*((_DWORD *)Block[0] - 1);
      if ( (unsigned int)(Block[0] - v17 - 4) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    sub_402F05(v17);
  }
  v28 = -1;
  Block[4] = 0;
  v24 = 15;
  LOBYTE(Block[0]) = 0;
  if ( v26 >= 0x10 )
  {
    v18 = v25[0];
    if ( v26 + 1 >= 0x1000 )
    {
      v18 = (void *)*((_DWORD *)v25[0] - 1);
      if ( (unsigned int)(v25[0] - v18 - 4) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    sub_402F05(v18);
  }
  v19 = "Have fun!";
  if ( v16 )
    v19 = "A forged ticket!!";
  v20 = sub_402870(std::cout, v19);
  std::ostream::operator<<(v20, sub_402AC0);
  system("pause");
  return 0;
}

void __thiscall sub_402320(_DWORD *this)
{
  int v1; // eax
  __int16 v2; // bx
  const char *v3; // esi
  int i; // edi
  int v5; // eax

  v1 = this[15];
  v2 = *(_WORD *)((char *)this + v1 + 6);
  v3 = (char *)this + v1 + 248;
  for ( i = 0; i < v2; ++i )
  {
    v5 = strcmp(v3, ".SCTF");
    if ( v5 )
      v5 = v5 < 0 ? -1 : 1;
    if ( !v5 )
    {
      DebugBreak();
      return;
    }
    v3 += 40;
  }
}

int sub_4024A0()
{
  unsigned int NtGlobalFlag; // [esp+10h] [ebp-20h]

  NtGlobalFlag = NtCurrentPeb()->NtGlobalFlag;
  if ( NtCurrentPeb()->BeingDebugged || NtGlobalFlag == 112 )
    exit(-5);
  return ((int (*)(void))dword_404000[0])();
}

int __fastcall sub_402450(int a1, int a2, int a3, int a4)
{
  int result; // eax
  int v7; // edx
  char v8; // cl

  result = 0;
  if ( a2 > 0 )
  {
    while ( 1 )
    {
      v7 = 0;
      if ( a4 > 0 )
        break;
LABEL_5:
      if ( result >= a2 )
        return result;
    }
    while ( result < a2 )
    {
      v8 = aSycloversyclov[v7++];
      *(_BYTE *)(result + a1) = ~(*(_BYTE *)(result + a1) ^ v8);
      ++result;
      if ( v7 >= a4 )
        goto LABEL_5;
    }
  }
  return result;
}

unsigned int sub_404000()
{
  unsigned int i; // edx
  unsigned int v1; // esi
  unsigned int result; // eax
  unsigned int v3; // eax
  char v4; // dl

  for ( i = 0; i < strlen(aPvfqyc4ttc2uxr); ++i )
    --aPvfqyc4ttc2uxr[i];
  v1 = 0;
  result = strlen(aPvfqyc4ttc2uxr);
  if ( (result & 0xFFFFFFFE) != 0 )
  {
    do
    {
      v3 = result - v1;
      v4 = *(_BYTE *)(v3 + 4231191);
      *(_BYTE *)(v3 + 4231191) = aPvfqyc4ttc2uxr[v1];
      aPvfqyc4ttc2uxr[v1++] = v4;
      result = strlen(aPvfqyc4ttc2uxr);
    }
    while ( v1 < result >> 1 );
  }
  return result;
}

#define _CRT_SECURE_NO_WARNINGS
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#define MAX_INPUT_LEN 1024

typedef struct {
    unsigned char S[256];
    unsigned char i;  // 改为 unsigned char 避免转换问题
    unsigned char j;  // 改为 unsigned char 避免转换问题
} RC4_CTX;

/* 初始化函数 */
void rc4_init(RC4_CTX* ctx, const unsigned char* key, size_t key_len) {
    int i;  // 使用 int 避免 size_t 转换警告
    unsigned char j = 0;
    unsigned char temp;

    for (i = 0; i < 256; i++) {
        ctx->S[i] = (unsigned char)i;
    }

    ctx->i = 0;
    ctx->j = 0;

    for (i = 0; i < 256; i++) {
        j = (unsigned char)(j + ctx->S[i] + key[i % key_len]);  // 显式转换
        temp = ctx->S[i];
        ctx->S[i] = ctx->S[j];
        ctx->S[j] = temp;
    }
}

/* 生成密钥流字节 */
unsigned char rc4_generate_byte(RC4_CTX* ctx) {
    unsigned char temp;
    ctx->i = (unsigned char)(ctx->i + 1);
    ctx->j = (unsigned char)(ctx->j + ctx->S[ctx->i]);
    temp = ctx->S[ctx->i];
    ctx->S[ctx->i] = ctx->S[ctx->j];
    ctx->S[ctx->j] = temp;
    return ctx->S[(ctx->S[ctx->i] + ctx->S[ctx->j]) & 0xFF];  // 使用位操作避免转换
}

/* 加密函数 */
void rc4_crypt(RC4_CTX* ctx, const unsigned char* input,
    unsigned char* output, size_t len) {
    size_t n;
    for (n = 0; n < len; n++) {
        output[n] = input[n] ^ rc4_generate_byte(ctx);
    }
}

/* 二进制转十六进制 */
char* bin2hex(const unsigned char* bin, size_t len) {
    if (len == 0) return NULL;

    char* hex = (char*)malloc(len * 2 + 1);
    if (!hex) return NULL;

    for (size_t i = 0; i < len; i++) {
        sprintf_s(hex + i * 2, 3, "%02X", bin[i]);  // 使用安全的 sprintf_s
    }
    hex[len * 2] = '\0';
    return hex;
}

/* 安全获取输入 */
void get_input(const char* prompt, char* buffer, size_t max_len) {
    printf("%s", prompt);
    if (fgets(buffer, (int)max_len, stdin) == NULL) {  // 显式转换
        buffer[0] = '\0';
        return;
    }

    // 移除换行符
    size_t len = strlen(buffer);
    if (len > 0 && buffer[len - 1] == '\n') {
        buffer[len - 1] = '\0';
    }
}

int main() {
    char key[MAX_INPUT_LEN];
    char plaintext[MAX_INPUT_LEN];

    printf("=== RC4 加密工具 ===\n");

    // 获取用户输入
    get_input("请输入密钥: ", key, sizeof(key));
    get_input("请输入明文: ", plaintext, sizeof(plaintext));

    size_t len = strlen(plaintext);
    if (len == 0) {
        printf("错误: 明文不能为空\n");
        return 1;
    }

    // 分配内存
    unsigned char* ciphertext = (unsigned char*)malloc(len);
    if (!ciphertext) {
        fprintf(stderr, "错误: 内存分配失败\n");
        return 1;
    }

    // 加密过程
    RC4_CTX ctx;
    rc4_init(&ctx, (const unsigned char*)key, strlen(key));
    rc4_crypt(&ctx, (const unsigned char*)plaintext, ciphertext, len);

    // 转换为十六进制
    char* hex_cipher = bin2hex(ciphertext, len);
    if (!hex_cipher) {
        fprintf(stderr, "错误: 十六进制转换失败\n");
        free(ciphertext);
        return 1;
    }

    // 输出结果
    printf("\n加密结果:\n");
    printf("密钥: %s\n", key);
    printf("明文: %s\n", plaintext);
    printf("密文(HEX): %s\n", hex_cipher);

    // 清理内存
    free(ciphertext);
    free(hex_cipher);

    printf("\n按 Enter 键退出...");
    getchar();  // 忽略返回值
    return 0;
}

#define _CRT_SECURE_NO_WARNINGS
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>

#define MAX_INPUT_LEN 2048

typedef struct {
    unsigned char S[256];
    unsigned char i;  // 改为 unsigned char 避免转换问题
    unsigned char j;  // 改为 unsigned char 避免转换问题
} RC4_CTX;

/* 初始化函数 */
void rc4_init(RC4_CTX* ctx, const unsigned char* key, size_t key_len) {
    int i;  // 使用 int 避免 size_t 转换警告
    unsigned char j = 0;
    unsigned char temp;

    for (i = 0; i < 256; i++) {
        ctx->S[i] = (unsigned char)i;
    }

    ctx->i = 0;
    ctx->j = 0;

    for (i = 0; i < 256; i++) {
        j = (unsigned char)(j + ctx->S[i] + key[i % key_len]);  // 显式转换
        temp = ctx->S[i];
        ctx->S[i] = ctx->S[j];
        ctx->S[j] = temp;
    }
}

/* 生成密钥流字节 */
unsigned char rc4_generate_byte(RC4_CTX* ctx) {
    unsigned char temp;
    ctx->i = (unsigned char)(ctx->i + 1);
    ctx->j = (unsigned char)(ctx->j + ctx->S[ctx->i]);
    temp = ctx->S[ctx->i];
    ctx->S[ctx->i] = ctx->S[ctx->j];
    ctx->S[ctx->j] = temp;
    return ctx->S[(ctx->S[ctx->i] + ctx->S[ctx->j]) & 0xFF];  // 使用位操作避免转换
}

/* 解密函数 */
void rc4_crypt(RC4_CTX* ctx, const unsigned char* input,
    unsigned char* output, size_t len) {
    size_t n;
    for (n = 0; n < len; n++) {
        output[n] = input[n] ^ rc4_generate_byte(ctx);
    }
}

/* 十六进制转二进制 */
unsigned char* hex2bin(const char* hex, size_t* len) {
    size_t hex_len = strlen(hex);

    // 检查十六进制长度
    if (hex_len % 2 != 0) {
        fprintf(stderr, "错误: 无效的十六进制长度\n");
        return NULL;
    }

    *len = hex_len / 2;
    if (*len == 0) {
        return NULL;
    }

    unsigned char* bin = (unsigned char*)malloc(*len);
    if (!bin) return NULL;

    for (size_t i = 0; i < *len; i++) {
        char hex_byte[3] = { 0 };
        hex_byte[0] = hex[i * 2];
        hex_byte[1] = hex[i * 2 + 1];

        char* endptr;
        unsigned long value = strtoul(hex_byte, &endptr, 16);

        if (*endptr != '\0' || value > 255) {
            fprintf(stderr, "错误: 无效的十六进制字节 '%s'\n", hex_byte);
            free(bin);
            return NULL;
        }

        bin[i] = (unsigned char)value;
    }

    return bin;
}

/* 安全获取输入 */
void get_input(const char* prompt, char* buffer, size_t max_len) {
    printf("%s", prompt);
    if (fgets(buffer, (int)max_len, stdin) == NULL) {  // 显式转换
        buffer[0] = '\0';
        return;
    }

    // 移除换行符
    size_t len = strlen(buffer);
    if (len > 0 && buffer[len - 1] == '\n') {
        buffer[len - 1] = '\0';
    }
}

int main() {
    char key[MAX_INPUT_LEN];
    char hex_cipher[MAX_INPUT_LEN];

    printf("=== RC4 解密工具 ===\n");

    // 获取用户输入
    get_input("请输入密钥: ", key, sizeof(key));
    get_input("请输入密文(HEX): ", hex_cipher, sizeof(hex_cipher));

    // 验证十六进制输入
    for (size_t i = 0; hex_cipher[i]; i++) {
        if (!isxdigit((unsigned char)hex_cipher[i])) {  // 显式类型转换
            fprintf(stderr, "错误: 无效的十六进制字符 '%c'\n", hex_cipher[i]);
            return 1;
        }
    }

    // 转换为二进制
    size_t cipher_len;
    unsigned char* ciphertext = hex2bin(hex_cipher, &cipher_len);
    if (!ciphertext || cipher_len == 0) {
        fprintf(stderr, "错误: 十六进制转换失败\n");
        return 1;
    }

    // 分配解密缓冲区
    unsigned char* decrypted = (unsigned char*)calloc(cipher_len + 1, 1);
    if (!decrypted) {
        fprintf(stderr, "错误: 内存分配失败\n");
        free(ciphertext);
        return 1;
    }

    // 解密过程
    RC4_CTX ctx;
    rc4_init(&ctx, (const unsigned char*)key, strlen(key));
    rc4_crypt(&ctx, ciphertext, decrypted, cipher_len);

    // 确保字符串终止
    decrypted[cipher_len] = '\0';

    // 输出结果
    printf("\n解密结果:\n");
    printf("密钥: %s\n", key);
    printf("密文(HEX): %s\n", hex_cipher);
    printf("解密文本: %s\n", decrypted);

    // 清理内存
    free(ciphertext);
    free(decrypted);

    printf("\n按 Enter 键退出...");
    getchar();  // 忽略返回值
    return 0;
}

j = 0
for i from 0 to 255:
    j = (j + S[i] + key[i % key_length]) % 256
    swap(S[i], S[j])

i = (i + 1) % 256
j = (j + S[i]) % 256
swap(S[i], S[j])
K = S[(S[i] + S[j]) % 256]
return K

void rc4_init(RC4_CTX *ctx, const unsigned char *key, size_t key_len) {
    unsigned char j = 0;
    // 初始化S盒
    for (int i = 0; i < 256; i++) {
        ctx->S[i] = (unsigned char)i;
    }
    
    // 重置索引
    ctx->i = 0;
    ctx->j = 0;
    
    // 使用密钥打乱S盒
    for (int i = 0; i < 256; i++) {
        j = (j + ctx->S[i] + key[i % key_len]) % 256;
        // 交换S[i]和S[j]
        unsigned char temp = ctx->S[i];
        ctx->S[i] = ctx->S[j];
        ctx->S[j] = temp;
    }
}

unsigned char rc4_generate_byte(RC4_CTX *ctx) {
    // 更新索引
    ctx->i = (ctx->i + 1) % 256;
    ctx->j = (ctx->j + ctx->S[ctx->i]) % 256;
    
    // 交换S[i]和S[j]
    unsigned char temp = ctx->S[ctx->i];
    ctx->S[ctx->i] = ctx->S[ctx->j];
    ctx->S[ctx->j] = temp;
    
    // 计算密钥流字节
    return ctx->S[(ctx->S[ctx->i] + ctx->S[ctx->j]) % 256];
}

void rc4_crypt(RC4_CTX *ctx, const unsigned char *input, 
               unsigned char *output, size_t len) {
    for (size_t n = 0; n < len; n++) {
        // 生成密钥流字节并与输入字节异或
        output[n] = input[n] ^ rc4_generate_byte(ctx);
    }
}

int ctfshow()
{
  char s[28]; // [esp+8h] [ebp-20h] BYREF

  puts("What's your name?");
  fflush(stdout);
  fgets(s, 50, stdin);
  printf("Hello %s.", s);
  return fflush(stdout);
}

int __fastcall main(int argc, const char **argv, const char **envp)
{
  int v4; // [rsp+8h] [rbp-18h] BYREF
  int v5; // [rsp+Ch] [rbp-14h]
  __int64 v6[2]; // [rsp+10h] [rbp-10h] BYREF

  v6[1] = __readfsqword(0x28u);
  setbuf(_bss_start, 0LL);
  printf("Where What?");
  v5 = __isoc99_scanf("%llx %d", v6, &v4);
  if ( v5 != 2 )
    return 0;
  *(_BYTE *)v6[0] = v4;
  if ( v4 == 0xFF )
    puts("No flag for you");
  return 0;
}

int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char buf[8]; // [rsp+0h] [rbp-10h] BYREF
  unsigned __int64 v5; // [rsp+8h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  init(argc, argv, envp);
  logo();
  while ( 1 )
  {
    while ( 1 )
    {
      menu();
      read(0, buf, 8uLL);
      v3 = atoi(buf);
      if ( v3 != 3 )
        break;
      delete_heap();
    }
    if ( v3 > 3 )
    {
      if ( v3 == 4 )
        exit(0);
      if ( v3 == 114514 )
      {
        if ( (unsigned __int64)magic <= 0x1BF52 ) //修改magic大于0x1BF52即可达到后门函数
        {
          puts("So sad !");
        }
        else
        {
          puts("Congrt !");
          TaT();   //后门函数
        }
      }
      else
      {
LABEL_17:
        puts("Invalid Choice");
      }
    }
    else if ( v3 == 1 )
    {
      create_heap();
    }
    else
    {
      if ( v3 != 2 )
        goto LABEL_17;
      edit_heap();
    }
  }
}

unsigned __int64 edit_heap()
{
  int v1; // [rsp+4h] [rbp-1Ch]
  __int64 v2; // [rsp+8h] [rbp-18h]
  char buf[4]; // [rsp+14h] [rbp-Ch] BYREF
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  printf("Index :");
  read(0, buf, 4uLL);
  v1 = atoi(buf);
  if ( (unsigned int)v1 >= 0xA )
  {
    puts("Out of bound!");
    _exit(0);
  }
  if ( heaparray[v1] )
  {
    printf("Size of Heap : ");
    read(0, buf, 8uLL);
    v2 = atoi(buf);
    printf("Content of heap : ");
    read_input(heaparray[v1], v2);
    puts("Done !");
  }
  else
  {
    puts("No such heap !");
  }
  return __readfsqword(0x28u) ^ v4;
}

unsigned __int64 edit()
{
  int v1; // [rsp+Ch] [rbp-24h]
  int v2; // [rsp+10h] [rbp-20h]
  char buf[8]; // [rsp+18h] [rbp-18h] BYREF
  char nptr[8]; // [rsp+20h] [rbp-10h] BYREF
  unsigned __int64 v5; // [rsp+28h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  if ( num )
  {
    printf("Please enter the index:");
    read(0, buf, 8uLL);
    v1 = atoi(buf);
    if ( *((_QWORD *)&unk_6020A8 + 2 * v1) )
    {
      printf("Please enter the length of name:");
      read(0, nptr, 8uLL);
      v2 = atoi(nptr);
      printf("Please enter the new name:");
      *(_BYTE *)(*((_QWORD *)&unk_6020A8 + 2 * v1) + (int)read(0, *((void **)&unk_6020A8 + 2 * v1), v2)) = 0;
    }
    else
    {
      puts("Invaild index");
    }
  }
  else
  {
    puts("Nothing here~");
  }
  return __readfsqword(0x28u) ^ v5;
}

void __noreturn fffffffffffffffffffffffffffffffffflag()
{
  int fd; // [rsp+Ch] [rbp-74h]
  char buf[104]; // [rsp+10h] [rbp-70h] BYREF
  unsigned __int64 v2; // [rsp+78h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  fd = open("/flag", 0);
  read(fd, buf, 0x64uLL);
  close(fd);
  printf("%s", buf);
  exit(0);
}