拿到这道题是个应用程序，经过上次的经验就跟程序交互了一下，结果根本交互不了，输入什么东西都没有反应
然后打开ida分析发现有几个函数还有一堆的操作数，看到这一堆东西就没心思分析了，后面才知道原来就是要简化函数
别人的wp
一共有sub_291000、sub_291100和sub_291220三个函数 ，导致程序执行不下去的代码就在这三个函数中，简化函数，重新编写main函数即可得到flag
在这里我就没有那么细心去重新观察函数了，在这里参考了wp的解释
另外，我也学到1）while（）括号里面是可以存在负数的而且是可以运行的
也就意味着最后ans=ans+cnt，以后遇到这种情况可以自己再本地ide模拟一下
sub_291000：
sub_291100：
sub_291220：
通过分析了解了三个函数的具体作用，重新写整体的main函数的脚本即可：
1 def add(a,b): 2 return a+b 3 def mul(a,b): 4 return a*b 5 def sub(a,b): 6 return a-b 7 flag = [1 for i in range(32)] 8 v121 = 0 9 print("Your flag is:") 10 v3 = mul(flag[0], 1000000000) 11 v4 = sub(v3, 999999950) 12 flag[0] =mul(v4, 2) 13 v5 = add(flag[1], 5000000) 14 v6 = sub(v5, 6666666) 15 v7 = add(v6, 1666666) 16 v8 = add(v7, 45) 17 v9 = mul(v8, 2) 18 flag[1] = add(v9, 5) 19 v10 = mul(flag[2], 1000000000) 20 v11 = sub(v10, 999999950) 21 v12 = mul(v11, 2) 22 flag[2] =add(v12, 2) 23 v13 = add(flag[3], 55) 24 v14 = sub(v13, 3) 25 v15 = add(v14, 4) 26 flag[3] =sub(v15, 1) 27 v16 = mul(flag[4], 100000000) 28 v17 = sub(v16, 99999950) 29 v18 = mul(v17, 2) 30 flag[4] =add(v18, 2) 31 v19 = sub(flag[5], 1) 32 v20 = mul(v19, 1000000000) 33 v21 = add(v20, 55) 34 flag[5] =sub(v21, 3) 35 v22 = mul(flag[6], 1000000) 36 v23 = sub(v22, 999975) 37 flag[6] =mul(v23, 4) 38 v24 = add(flag[7], 55) 39 v25 = sub(v24, 33) 40 v26 = add(v25, 44) 41 flag[7] =sub(v26, 11) 42 v27 = mul(flag[8], 10) 43 v28 = sub(v27, 5) 44 v29 = mul(v28, 8) 45 flag[8] =add(v29, 9) 46 v30 = add(flag[9], 0) 47 v31 = sub(v30, 0) 48 v32 = add(v31, 11) 49 v33 = sub(v32, 11) 50 flag[9] =add(v33, 53) 51 v34 = add(flag[10], 49) 52 v35 = sub(v34, 2) 53 v36 = add(v35, 4) 54 flag[10] =sub(v36, 2) 55 v37 = mul(flag[11], 1000000) 56 v38 = sub(v37, 999999) 57 v39 = mul(v38, 4) 58 flag[11] =add(v39, 50) 59 v40 = add(flag[12], 1) 60 v41 = add(v40, 1) 61 v42 = add(v41, 1) 62 v43 = add(v42, 1) 63 v44 = add(v43, 1) 64 v45 = add(v44, 1) 65 v46 = add(v45, 10) 66 flag[12] =add(v46, 32) 67 v47 = mul(flag[13], 10) 68 v48 = sub(v47, 5) 69 v49 = mul(v48, 8) 70 v50 = add(v49, 9) 71 flag[13] =add(v50, 48) 72 v51 = sub(flag[14], 1) 73 v52 = mul(v51, -294967296) 74 v53 = add(v52, 55) 75 flag[14] =sub(v53, 3) 76 v54 = add(flag[15], 1) 77 v55 = add(v54, 2) 78 v56 = add(v55, 3) 79 v57 = add(v56, 4) 80 v58 = add(v57, 5) 81 v59 = add(v58, 6) 82 v60 = add(v59, 7) 83 flag[15] =add(v60, 20) 84 v61 = mul(flag[16], 10) 85 v62 = sub(v61, 5) 86 v63 = mul(v62, 8) 87 v64 = add(v63, 9) 88 flag[16] =add(v64, 48) 89 v65 = add(flag[17], 7) 90 v66 = add(v65, 6) 91 v67 = add(v66, 5) 92 v68 = add(v67, 4) 93 v69 = add(v68, 3) 94 v70 = add(v69, 2) 95 v71 = add(v70, 1) 96 flag[17] =add(v71, 20) 97 v72 = add(flag[18], 7) 98 v73 = add(v72, 2) 99 v74 = add(v73, 4) 100 v75 = add(v74, 3) 101 v76 = add(v75, 6) 102 v77 = add(v76, 5) 103 v78 = add(v77, 1) 104 flag[18] =add(v78, 20) 105 v79 = mul(flag[19], 1000000) 106 v80 = sub(v79, 999999) 107 v81 = mul(v80, 4) 108 v82 = add(v81, 50) 109 flag[19] =sub(v82, 1) 110 v83 = sub(flag[20], 1) 111 v84 = mul(v83, -294967296) 112 v85 = add(v84, 49) 113 flag[20] =sub(v85, 1) 114 v86 = sub(flag[21], 1) 115 v87 = mul(v86, 1000000000) 116 v88 = add(v87, 54) 117 v89 = sub(v88, 1) 118 v90 = add(v89, 1000000000) 119 flag[21] =sub(v90, 1000000000) 120 v91 = add(flag[22], 49) 121 v92 = sub(v91, 1) 122 v93 = add(v92, 2) 123 flag[22] =sub(v93, 1) 124 v94 = mul(flag[23], 10) 125 v95 = sub(v94, 5) 126 v96 = mul(v95, 8) 127 v97 = add(v96, 9) 128 flag[23] =add(v97, 48) 129 v98 = add(flag[24], 1) 130 v99 = add(v98, 3) 131 v100 = add(v99, 3) 132 v101 = add(v100, 3) 133 v102 = add(v101, 6) 134 v103 = add(v102, 6) 135 v104 = add(v103, 6) 136 flag[24] =add(v104, 20) 137 v105 = add(flag[25], 55) 138 v106 = sub(v105, 33) 139 v107 = add(v106, 44) 140 v108 = sub(v107, 11) 141 flag[25] =add(v108, 42) 142 flag[26] =add(flag[26], flag[25]) 143 flag[27] =add(flag[27], flag[12]) 144 v115 = flag[27] 145 v109 = sub(flag[28], 1) 146 v110 = add(v109, v115) 147 flag[28] =sub(v110, 1) 148 v116 = flag[23] 149 v111 = sub(flag[29], 1) 150 v112 = mul(v111, 1000000) 151 flag[29] =add(v112, v116) 152 v117 = flag[27] 153 v113 = add(flag[30], 1) 154 flag[30] =mul(v113, v117) 155 flag[31] =add(flag[31], flag[30]) 156 print("CTF{"+"".join(map(chr,flag))+"}")