攻防世界WP-reverse-BUUCTF-2019-Mysterious

直接看伪代码

GetDlgItemTextA(hWnd, 1002, &String, 260);
      strlen(&String);
      if ( strlen(&String) > 6 )
        ExitProcess(0);
      v10 = atoi(&String) + 1;
      if ( v10 == 123 && v12 == 120 && v14 == 122 && v13 == 121 )
      {
        strcpy(Text, "flag");
        memset(&v7, 0, 0xFCu);
        v8 = 0;
        v9 = 0;
        _itoa(v10, &v5, 10);
        strcat(Text, "{");
        strcat(Text, &v5);
        strcat(Text, "_");
        strcat(Text, "Buff3r_0v3rf|0w");
        strcat(Text, "}");
        MessageBoxA(0, Text, "well done", 0);

以为很简单（其实也很简单），但是最开始弄错了，把itoa和atoi这两个函数弄错了，以为是int和ascii之间的转换，实际上是数字和字符串之间的转换。看c++官方文档。
itoa

itoa

char * itoa ( int value, char * str, int base );

Convert integer to string (non-standard function) Converts an integer
value to a null-terminated string using the specified base and stores
the result in the array given by str parameter.

If base is 10 and value is negative, the resulting string is preceded
with a minus sign (-). With any other base, value is always considered
unsigned.

str should be an array long enough to contain any possible value:
(sizeof(int)*8+1) for radix=2, i.e. 17 bytes in 16-bits platforms and
33 in 32-bits platforms.

所以flag就是flag{123_Buff3r_0v3rf|0w}