题目给出了这样一串字符:
d4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9e1e6b3e3b9e4b3b7b7e2b6b1e4b2b6b9e2b1b1b3b3b7e6b3b3b0e3b9b3b5e6fd
因为最大为f所以很明显可以看出来是16进制
而看到16进制就该想到ASCII了。而且字符刚好是134位。可以将其分为两个一组。
分组脚本：
#!/usr/bin/env python
# encoding:utf-8
# by i3ekr payload = "d4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9e1e6b3e3b9e4b3b7b7e2b6b1e4b2b6b9e2b1b1b3b3b7e6b3b3b0e3b9b3b5e6fd"
s = ""
for i in range(0,len(payload),2):
s += "0x"
s += payload[i:i+2]
s += "," print s
0xd4,0xe8,0xe1,0xf4,0xa0,0xf7,0xe1,0xf3,0xa0,0xe6,0xe1,0xf3,0xf4,0xa1,0xa0,0xd4,0xe8,0xe5,0xa0,0xe6,0xec,0xe1,0xe7,0xa0,0xe9,0xf3,0xba,0xa0,0xc4,0xc4,0xc3,0xd4,0xc6,0xfb,0xb9,0xe1,0xe6,0xb3,0xe3,0xb9,0xe4,0xb3,0xb7,0xb7,0xe2,0xb6,0xb1,0xe4,0xb2,0xb6,0xb9,0xe2,0xb1,0xb1,0xb3,0xb3,0xb7,0xe6,0xb3,0xb3,0xb0,0xe3,0xb9,0xb3,0xb5,0xe6,0xfd,
但是就目测而言，0xd4此类的都是大于127的所以很可能是移位，而且要用减的，因为这里的数字都比127来的大。
所以再有以下移位脚本：
#简单文字分析一下代码,就是s里的然后每次-1,-2,-3 一直减下去就可以了。直到128的时候得出正解。
#!/usr/bin/env python
# encoding:utf-8
# by i3ekr s = [0xd4,0xe8,0xe1,0xf4,0xa0,0xf7,0xe1,0xf3,0xa0,0xe6,0xe1,0xf3,0xf4,0xa1,0xa0,0xd4,0xe8,0xe5,0xa0,0xe6,0xec,0xe1,0xe7,0xa0,0xe9,0xf3,0xba,0xa0,0xc4,0xc4,0xc3,0xd4,0xc6,0xfb,0xb9,0xe1,0xe6,0xb3,0xe3,0xb9,0xe4,0xb3,0xb7,0xb7,0xe2,0xb6,0xb1,0xe4,0xb2,0xb6,0xb9,0xe2,0xb1,0xb1,0xb3,0xb3,0xb7,0xe6,0xb3,0xb3,0xb0,0xe3,0xb9,0xb3,0xb5,0xe6,0xfd]
for i in range(135):
flag = ""
for j in range(len(s)):
flag += chr(s[j]-i)
print("第%s移位：%s")%(i,flag)
第128次跑出来了。