求解按位与方程

Question

如何从以下位置找到变量 local_18：

((int)(char)local_18 & 0x1fffffffU) == 0x30)

我认为它可以像这样关联：

((int)(char)local_18 & 0x1fffffffU) & 0x1fffffffU == 0x30 & 0x1fffffffU)

但是0x1fffffffU & 0x1fffffffU并没有抵消。

以下是变量的类型（以及我要解决的整个系统）：

int difficult_part(void)

{
  int iVar1;
  size_t sVar2;
  byte local_28;
  byte local_27;
  byte local_26;
  byte local_25;
  byte local_24;
  byte local_23;
  byte local_22;
  char local_21;
  byte local_18;
  byte local_17;
  byte local_16;
  byte local_15;
  byte local_14;
  byte local_13;
  byte local_12;
  char local_11;
  
  puts("guess the first eight characters.");
  fgets((char *)&local_18,0x10,stdin);
  sVar2 = strlen((char *)&local_18);
  if (sVar2 == 9) {
    if (((((local_18 == 0x65) && (local_17 == 0x37)) && (local_16 == 0x35)) && // That's pretty easy
        ((local_15 == 0x35 && (local_14 == 0x32)))) && // That's pretty easy
       ((local_13 == 99 && ((local_12 == 0x66 && (local_11 == '6')))))) { // That's pretty easy
      puts("Well done, you can try to guess the next eight characters but it won\'t be so easy.");
      fgets((char *)&local_18,0x10,stdin);
      sVar2 = strlen((char *)&local_18);
      if (sVar2 == 9) {
        if ((((((int)(char)local_18 & 0x7fffffffU) == 0x34) && // Here is where I'm stuck
             (((int)(char)local_17 & 0x7fffffffU) == 99)) && // Here is where I'm stuck
            (((int)(char)local_16 & 0x7fffffffU) == 0x65)) && // Here is where I'm stuck
           (((((int)(char)local_15 & 0x7fffffffU) == 0x32 && // Here is where I'm stuck
             (((int)(char)local_14 & 0x7fffffffU) == 0x65)) && // Here is where I'm stuck
            ((((int)(char)local_13 & 0x7fffffffU) == 0x35 && // Here is where I'm stuck
             ((((int)(char)local_12 & 0x7fffffffU) == 0x61 && (((int)local_11 & 0x7fffffffU) == 100) // Here is where I'm stuck
              ))))))) {
          puts("I see you\'ve got some skills in reversing, but can you guess the next eight ?");
          fgets((char *)&local_18,0x10,stdin);
          sVar2 = strlen((char *)&local_18);
          if (sVar2 == 9) {
            if ((((((int)(char)local_18 & 0x1fffffffU) == 0x30) &&
                 (((int)(char)local_17 & 0x1fffffffU) == 0x62)) &&
                (((int)(char)local_16 & 0x1fffffffU) == 0x62)) &&
               (((((int)(char)local_15 & 0x1fffffffU) == 0x30 &&
                 (((int)(char)local_14 & 0x1fffffffU) == 0x39)) &&
                ((((int)(char)local_13 & 0x1fffffffU) == 0x35 &&
                 ((((int)(char)local_12 & 0x1fffffffU) == 0x34 &&
                  (((int)local_11 & 0x1fffffffU) == 0x66)))))))) {
              puts(
                  "I must say that I\'m impressed but it\'s not over. Will you be able to guess the next eight characters ?"
                  );
              fgets((char *)&local_28,0x10,stdin);
              sVar2 = strlen((char *)&local_28);
              if (sVar2 == 9) {
                if ((((((local_28 ^ local_18) == 1) && ((local_27 ^ local_17) == 0x54)) &&
                     ((local_26 ^ local_16) == 0x55)) &&
                    (((local_25 ^ local_15) == 0x51 && ((local_24 ^ local_14) == 9)))) &&
                   (((local_23 ^ local_13) == 7 &&
                    (((local_22 ^ local_12) == 0x57 && (local_11 == local_21)))))) {
                  puts("You're done !");
                  most_difficult_part();
                  iVar1 = 0;
                }
                else {
                  iVar1 = puts("Wrong guess");
                }
              }
              else {
                iVar1 = puts("Well it seems that someone has trouble counting to eight.");
              }
            }
            else {
              iVar1 = puts("Wrong guess.");
            }
          }
          else {
            iVar1 = puts("Well it seems that someone has trouble counting to eight.");
          }
        }
        else {
          iVar1 = puts("Wrong guess.");
        }
      }
      else {
        iVar1 = puts("Well it seems that someone has trouble counting to eight.");
      }
    }
    else {
      iVar1 = puts("Wrong guess.");
    }
  }
  else {
    iVar1 = puts("Well it seems that someone has trouble counting to eight.");
  }
  return iVar1;
}

Answer 1

您的示例使用了位掩码。您可以使用它来忽略某些选定的位。在您的示例中，您有：

local_18 & 0x1fffffffU

其中 0x1fffffffU 是您的位掩码。如果您以二进制表示形式写入此数字，您将得到 0b00011111111111111111111111111111U、三个 0 后跟 29 个 1。

这等于'忽略 local_18 的前三个二进制值并将其余值与 0x30 进行比较。

如果 local_18 的最后 27 个二进制数字等于 0x30。

，则您的等式为真

您可能想要 google 位掩码，那里有很多很好的教程和解释。

一些例子

local_18 = 0x30 -> true
local_18 = 0x31 -> false
local_18 = 0x80000030 -> true
local_18 = 0x40000030 -> true
local_18 = 0x80001030 -> false

测试代码：

int main()
{
    int local_18 = 0x30;
    if ((local_18 & 0x1fffffffU) == 0x30)
        std::cout << "true";
    else
        std::cout << "false";
   
    return 0;
}

更新

在我看过你的代码后，有一些变化。您正在为 local_18 使用类型 byte，因此掩码非常无用。您有一个字节，将其转换为一个 int（通过在变量前面添加 0 来完成），因此除了最后一个字节之外的所有内容都是零。这意味着在您的情况下，方程式可以简化为

local_18 == 0x30

您可以通过我的示例代码轻松验证它。只需在 if 中添加 (char) 强制转换到 trim int 到一个字节：

int main()
{
    int local_18 = 0x30;
    if (((char)local_18 & 0x1fffffffU) == 0x30)
        std::cout << "true";
    else
        std::cout << "false";
   
    return 0;
}

给出以下内容：

local_18 = 0x30 -> true
local_18 = 0x31 -> false
local_18 = 0x130 -> true, the cast trims the int to one byte, so the 1 will be ignored
local_18 = 0x80000030 -> true
local_18 = 0x40000030 -> true
local_18 = 0x80001030 -> true

求解按位与方程

Solving bitwise AND equation

c

binary

hex

bit-manipulation

boolean-operations