题目给出了这样一串字符:
d4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9e1e6b3e3b9e4b3b7b7e2b6b1e4b2b6b9e2b1b1b3b3b7e6b3b3b0e3b9b3b5e6fd
因为最大为f所以很明显可以看出来是16进制
而看到16进制就该想到ASCII了。而且字符刚好是134位。可以将其分为两个一组。
分组脚本：
1 #!/usr/bin/env python 2 # encoding:utf-8 3 # by i3ekr 4 5 payload = "d4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9e1e6b3e3b9e4b3b7b7e2b6b1e4b2b6b9e2b1b1b3b3b7e6b3b3b0e3b9b3b5e6fd" 6 s = "" 7 for i in range(0,len(payload),2): 8 s += "0x" 9 s += payload[i:i+2] 10 s += "," 11 12 print s
0xd4,0xe8,0xe1,0xf4,0xa0,0xf7,0xe1,0xf3,0xa0,0xe6,0xe1,0xf3,0xf4,0xa1,0xa0,0xd4,0xe8,0xe5,0xa0,0xe6,0xec,0xe1,0xe7,0xa0,0xe9,0xf3,0xba,0xa0,0xc4,0xc4,0xc3,0xd4,0xc6,0xfb,0xb9,0xe1,0xe6,0xb3,0xe3,0xb9,0xe4,0xb3,0xb7,0xb7,0xe2,0xb6,0xb1,0xe4,0xb2,0xb6,0xb9,0xe2,0xb1,0xb1,0xb3,0xb3,0xb7,0xe6,0xb3,0xb3,0xb0,0xe3,0xb9,0xb3,0xb5,0xe6,0xfd,
但是就目测而言，0xd4此类的都是大于127的所以很可能是移位，而且要用减的，因为这里的数字都比127来的大。
所以再有以下移位脚本：
#简单文字分析一下代码,就是s里的然后每次-1,-2,-3 一直减下去就可以了。直到128的时候得出正解。
1 #!/usr/bin/env python 2 # encoding:utf-8 3 # by i3ekr 4 5 s = [0xd4,0xe8,0xe1,0xf4,0xa0,0xf7,0xe1,0xf3,0xa0,0xe6,0xe1,0xf3,0xf4,0xa1,0xa0,0xd4,0xe8,0xe5,0xa0,0xe6,0xec,0xe1,0xe7,0xa0,0xe9,0xf3,0xba,0xa0,0xc4,0xc4,0xc3,0xd4,0xc6,0xfb,0xb9,0xe1,0xe6,0xb3,0xe3,0xb9,0xe4,0xb3,0xb7,0xb7,0xe2,0xb6,0xb1,0xe4,0xb2,0xb6,0xb9,0xe2,0xb1,0xb1,0xb3,0xb3,0xb7,0xe6,0xb3,0xb3,0xb0,0xe3,0xb9,0xb3,0xb5,0xe6,0xfd] 6 for i in range(135): 7 flag = "" 8 for j in range(len(s)): 9 flag += chr(s[j]-i) 10 print("第%s移位：%s")%(i,flag)
第128次跑出来了。