Embarking on Games

2026 年 10 月 17 日

要叠满500层，f12阅读一下html，大概率在game.min.js里，发现全部是16进制，找0x1f2(500)，找到

fetch(_0xd8d602(0x1f9), {
            'method': _0xd8d602(0x1c1),
            'headers': {
                'Secret-Code': encodeURIComponent('海月の虚空に秋涼し時鳥')
            }
        })[_0xd8d602(0x1d0)](_0x592092 => {
            const _0x9d02a5 = _0xd8d602;
            if (_0x592092[_0x9d02a5(0x1c6)] === 0xc8)
                return _0x592092[_0x9d02a5(0x1db)]();
        }
        )['then'](_0x311d7c => {
            const _0x4ebf11 = _0xd8d602;
            instructions[_0x4ebf11(0x1f8)] = _0x311d7c?.['flag'];
        }

搜索_0xd8d60锁定到全局定义域下叫_0x564a,经过简单代码阅读发现这是一个函数，在console中解码出url，method，‘innerHTML’。学习一些js语法后发现上述可以被翻译为

fetch('/0n_th3_t0p_of_toweR,st4nds_th3_fl4g', {
    method: 'GET',
    headers: {
        'Secret-Code': encodeURIComponent('海月の虚空に秋涼し時鳥')
    }
})

.then(response => {
    if (response.status === 200)
        return response.json();
})
.then(data => {
    instructions.innerHTML = data?.flag;
});

在console中写入

fetch('/0n_th3_t0p_of_toweR,st4nds_th3_fl4g', {
    method: 'GET',
    headers: {
        'Secret-Code': encodeURIComponent('海月の虚空に秋涼し時鳥')
    }
})
.then(response => response.json())
.then(data => console.log(data.flag))

拿到flag。

第一题做得我好辛苦我什么也不会。T T