这题非常棒，刚开始完全看不懂，看完wp后，豁然开朗，让我对reverse又有了新的了解。推荐阅读这个wp
重命名后的代码，逻辑就清楚了。
各段代码细节分析
逆向代码为：
s = open('out', mode='r').read()
# print s
crr = []
for i in s:
crr.append(ord(i))
drr = []
drr.append(((crr[0]) >> 3) | (((crr[len(crr) - 1] & 0x7) << 5)))
for i in range(len(crr) - 1):
# drr.append((crr[i] << 5) & 0xff | (crr[i+1] >> 3))
drr.append(((crr[i] & 0x7) << 5) | (crr[i + 1] >> 3))
print drr
逆向代码为：
#上一步解密得到的数组 arr = [61, 133, 60, 104, 60, 62, 245, 67, 165, 61, 165, 51, 39, 62, 118, 245, 60, 245, 133, 118, 245, 104, 19, 245, 38, 38, 165, 133, 61, 245, 7, 169, 118, 29, 60, 45, 15, 104] #先跑出运算过程中每个位置的index index = 0 new_index_arr = [] while s[index]: new_index_arr.append(index) index = s[index] new_index_arr.append(index) print new_index_arr #用跑出来的过程index，恢复各位置 new_arr = [None] * 38 new_index_arr = [0, 22, 20, 19, 14, 17, 4, 30, 29, 28, 27, 36, 34, 33, 32, 31, 37, 35, 26, 25, 5, 24, 15, 23, 16, 13, 12, 8, 21, 11, 10, 18, 3, 2, 6, 9, 7, 1] tmp = arr[1] for i in range(len(new_index_arr) - 1, -1, -1): arr[new_index_arr[i]] = arr[new_index_arr[i - 1]] arr[0] = tmp
这步是统计各字符出现次数
逆向代码为：
fs = open('that_girl', mode='r')
table = {}
while True:
c = fs.read(1)
if not c:
break
s = c.lower()
if s in table:
table[s] += 1
else:
table[s] = 1
print table
flag = []
for i in arr:
flag.append(list(table.keys())[list(table.values()).index(i)])
print "QCTF{%s}" % ''.join(flag)总体代码：
s = open('out', mode='r').read()
print(s)
rep_data = [0, 22, 20, 19, 14, 17, 4, 30, 29, 28, 27, 36, 34, 33, 32, 31, 37, 35, 26, 25, 5, 24, 15, 23, 16, 13, 12, 8,
21, 11, 10, 18, 3, 2, 6, 9, 7, 1]
data = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 104, 30, 15, 29, 169, 19, 38, 67, 60, 0, 20, 39, 28, 118, 165, 26, 0, 61,
51, 133, 45, 7, 34, 0, 62, 0, 0, 0, 0, 0, 0, 40, 71, 0, 0,
66, 245, 0, 0, 0, 97, 0]
arr = []
brr = []
len_flag = len(s)
# string to array
for i in range(len_flag):
arr.append(ord(s[i]))
# reverse or
temp = arr[len(arr) - 1] & 0x7
for i in range(len(arr)):
brr.append((temp << 5) | (arr[i] >> 3))
temp = arr[i] & 0x7
# reverse replace
tmp = brr[1]
for i in range(len(rep_data) - 1, -1, -1):
brr[rep_data[i]] = brr[rep_data[i - 1]]
brr[0] = tmp
arr = []
flag = ''
for i in range(len(brr)):
arr.append(data.index(brr[i]))
s1 = ''
s2 = ''
for i in range(len(arr)):
tmp = arr[i]
if tmp == 46:
s1 += '_'
s2 += '_'
if tmp == 48:
s1 += '0'
s2 += '0'
if 10 <= tmp <= 36:
s1 += chr(tmp + 55)
if 10 <= tmp <= 36:
s2 += chr(tmp + 87)
print(s1)
print(s2)