有参数检查
Reflector分析：
f="不正确" ----loc.2
i="参数错误"----loc.3
p="?#? ?## ?#??#?##? ?# ?#?#?#? #?# ?#??# ?#?# "
L_0005 .......
![技术分享]()
L_000a stloc.0
L_0046 ldloc.0
L_0047 .......
![技术分享]()
L_004c ldc.i4.8
L_004d beq.s L_0056
检查参数个数是否是8个，相等则跳过输出“参数错误”
str6存放数字字符，逆序转为数字型时==0x145d526db9faad8，顺序十进制转换==00011110303731719
str6="00011110303731719 "
由if(srt3!= str5.reverse()) jmp L_015a
str5为str3的逆序
str5="nTTDffcttRcVrhRghFa "
p="?#? ?## ?#??#?##? ?# ?#?#?#? #?# ?#??# ?#?# "
?->字符
#->数字
输入：n0T T00 D1ff1c11t t0 R3c0V3r 7h3 R1gh7 F1a9
得到flag：EIS{n0T_T00_D1ff1c11t_t0_R3c0V3r_7h3_R1gh7_F1a9}
IL汇编注释：
.method public static void Main()
cil managed
{
.custom instance void [
mscorlib]
System.STAThreadAttribute::
.ctor()
.entrypoint
.maxstack 5
.locals init (
[
0]
class [
mscorlib]
System.Collections.ObjectModel.ReadOnlyCollection`1<
string>
onlys,
[
1]
uint64 num,
[
2]
string str,
[
3]
string str2,
[
4]
string str3,
[
5]
string[]
strArray,
[
6]
string str4,
[
7]
string str5,
[
8]
string str6,
[
9]
int32 num2,
[
10]
int32 num3,
[
11]
int32 num4,
[
12]
int32 num5,
[
13]
char ch)
L_0000:
call class chkflag.My.MyApplication chkflag.My.MyProject::
get_Application()
L_000b:
ldc.i8 0x145d526db9faad8 L_0014:
stloc.1 //num=0x145d526db9faad8
//.custom instance void [mscorlib]System.Reflection.AssemblyDescriptionAttribute::.ctor(string) = { string(‘aFhgRhrVcRttcffDTTn‘) }
//str3="aFhgRhrVcRttcffDTTn"
L_004d:
beq.s L_0056 //if(count==8) jmp L_0056
L_00d7:
br.s L_0115 //jmp L_0115
L_00eb:
brfalse.s L_00ff //if ch不是十进制数字 jmp L_00ff
L_0119:
ble.s L_00d9 //if(num5<=num4) jmp L_00d9
L_0128:
bne.un.s L_015a //if(num!=int(str6)) num=91713730301111000
L_0138:
brfalse.s L_015a //if(srt3!= str5.reverse()) jmp L_015a
}
00011110303731719
nTTDffcttRcVrhRghFa
