flag = 'xxxxxxxxxxxxxxxxxxxxx'
s = 'wesyvbniazxchjko1973652048@$+-&*<>'
result = ''
for i in range(len(flag)):
s1 = ord(flag[i])//17
s2 = ord(flag[i])%17
result += s[(s1+i)%34]+s[-(s2+i+1)%34]
print(result)
# result = 'v0b9n1nkajz@j0c4jjo3oi1h1i937b395i5y5e0e$i'
方法1:爆破
flagg=''
result = 'v0b9n1nkajz@j0c4jjo3oi1h1i937b395i5y5e0e$i'
s = 'wesyvbniazxchjko1973652048@$+-&*<>'
num=0
for i in range(0,len(result),2):
for j in range(255): #(32,127)也行
if s[(j//17+num)%34] == result[i] and s[-(j%17+num+1)%34]==result[i+1]:
print(chr(j),end="")
num=num+1
运行结果:
NSSCTF{Fake_RERE_QAQ}
方法2:分析
# s1 = ord(flag[i])//17
# s2 = ord(flag[i])%17
这里可以看出s1,s2都是对flag进行操作,flag都是可见字符,所以ascii范围在[32-126]之间
# result += s[(s1+i)%34]+s[-(s2+i+1)%34]
# print(result)
flagg=''
result = 'v0b9n1nkajz@j0c4jjo3oi1h1i937b395i5y5e0e$i'
result的结果和计算方法已知,可以轻松得到flag的长度为len(result)/2即21,所以i的取值为[0,20],所以s1最大值为126//17+20==27,此时有如下结论:
(s1+i)%34就等价于s1+i
-(s2+i+1)%34就等价于34-(s2+i+i)
后续我们就可以通过result以及s的值算出s1和s2,而s1*17+s2就是flag[i]的ascii,最后整理一下得到flag
flagg=''
result = 'v0b9n1nkajz@j0c4jjo3oi1h1i937b395i5y5e0e$i'
s = 'wesyvbniazxchjko1973652048@$+-&*<>'
num=0
for i in range(0,len(result),2):
a1=s.index(result[i]) #a1==s1+num
a2=s.index(result[i+1]) #a2==34-(s2+1+num)
flag_tmp=(a1-num)*17+(33-num-a2)
flagg=flagg+chr(flag_tmp)
num=num+1
print(flagg)
#运行结果
#NSSCTF{Fake_RERE_QAQ}