源代码 ：

#include
#include
#include
#include

unsigned char submit[];

void play(){

int i;  
printf("Submit your 6 lotto bytes : ");  
fflush(stdout);

int r;  
r = read(, submit, );

printf("Lotto Start!\\n");  
//sleep(1);

// generate lotto numbers  
int fd = open("/dev/urandom", O\_RDONLY);  
if(fd==-){  
    printf("error. tell admin\\n");  
    exit(-);  
}  
unsigned char lotto\[\];  
if(read(fd, lotto, ) != ){  
    printf("error2. tell admin\\n");  
    exit(-);  
}  
for(i=; i<; i++){  
    lotto\[i\] = (lotto\[i\] % ) + ;        // 1 ~ 45  
}  
close(fd);

// calculate lotto score  
int match = , j = ;  
for(i=; i<; i++){  
    for(j=; j<; j++){  
        if(lotto\[i\] == submit\[j\]){  
            match++;  
        }  
    }  
}

// win!  
if(match == ){  
    system("/bin/cat flag");  
}  
else{  
    printf("bad luck...\\n");  
}

}

void help(){
printf("- nLotto Rule -\n");
printf("nlotto is consisted with 6 random natural numbers less than 46\n");
printf("your goal is to match lotto numbers as many as you can\n");
printf("if you win lottery for *1st place*, you will get reward\n");
printf("for more details, follow the link below\n");
printf("http://www.nlotto.co.kr/counsel.do?method=playerGuide#buying_guide01\n\n");
printf("mathematical chance to win this game is known to be 1/8145060.\n");
}

int main(int argc, char* argv[]){

// menu  
unsigned int menu;

while(){

    printf("- Select Menu -\\n");  
    printf("1. Play Lotto\\n");  
    printf("2. Help\\n");  
    printf("3. Exit\\n");

    scanf("%d", &menu);

    switch(menu){  
        case :  
            play();  
            break;  
        case :  
            help();  
            break;  
        case :  
            printf("bye\\n");  
            return ;  
        default:  
            printf("invalid menu\\n");  
            break;  
    }  
}  
return ;  

}

关键程序 ：

int match = , j = ;
for(i=; i<; i++){
for(j=; j<; j++){
if(lotto[i] == submit[j]){
match++;
}
}
}

 // win!  
 if(match == ){  
     system("/bin/cat flag");  
 }

题中让输入的Lotto在1-45范围之内，并且当lotto等于submit的时候，match加1，当match回到6的时候得到flag。而lotto是本地生成的，那么看一下它是怎么生成的：

for(i=; i<; i++){
lotto[i] = (lotto[i] % ) + ; // 1 ~ 45
}
close(fd);

思路是在1-45范围内随机生成。

看一下assic表：

真正符号输入是从33开始的，那我们在这个范围内选择字符输入。

如图选择一个字符一直输入，总能找到相等的字符，达到6个得到flag:

sorry mom… I FORGOT to check duplicate numbers… :(