是否可以解码邮件标头中的 SPAMCAUSE 字段？

Question

我想解码这个字符串：

X-OVH-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeelgedrvdduucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfenuceurghilhhouhhtmecufedttdenucgohfhorhgsihguuggvnhfjughrucdlhedttddm

我该怎么做？

Answer 1

有一个 Tor 隐藏服务可用于解码位于 http://6jbnmws2zq2m2fsfmpwnssgsrxovohgggphymkd4df2pgcw7ccrdy6ad.onion

的标签

根据它，您给出的 X-OVH-SPAMCAUSE 翻译为：

Vade Retro 01.394.21 AS+AV+AP+RT Profile: OVH; Bailout: 300; ^ForbiddenHdr (500)

Answer 2

我通过 Ikraider 和 DoubleYou 改进了给定的 Python 解决方案，并添加了 JavaScript 解决方案。

Python：

def Decode(msg):
    return ''.join([chr(ord(msg[i * 2]) + ord(msg[i * 2 + 1]) - 1768 + ord(msg[i * 2 + 1 - (i & 1)]) * 16) for i in range(len(msg) // 2)])

print(Decode('gggruggvucftvghtrhho'))

JavaScript：

function Decode(msg)
{
    return Array(msg.length >> 1).fill(0).map((_, i) => String.fromCharCode(msg[i * 2].charCodeAt(0) + msg[i * 2 + 1].charCodeAt(0) - 1768 + (msg[i * 2 + 1 - (i & 1)].charCodeAt(0) << 4))).join('');
}

console.log(Decode('gggruggvucftvghtrhho'));

Answer 3

从 lkraider 很棒的 Python 答案开始，我提高了准确性。事实证明，偏移字符 (

c

..

g

) 是交替附加和前置的。因此，不仅检查其中一个是否在该对中，还需要通过跟踪偶数对或奇数对来区分，例如

fh

和

hf

。

def decode(msg):
    text = ""
    for i in range(0, len(msg), 2):
        # add position as extra parameter
        text += unrot(msg[i: i + 2], i // 2)
    return text


def unrot(pair, pos, key=ord('x')):
    # "even" position => 2nd char is offset
    if pos % 2 == 0:
        # swap letters in pair
        pair = pair[1] + pair[0]
    # treat 1st char as offset
    offset = (ord('g') - ord(pair[0])) * 16
    # map to original character
    return chr(sum(ord(c) for c in pair) - key - offset)

print(decode('gggruggvucftvghtrhho'))

https://gist.github.com/DoubleYouEl/e3de97293ce3d5452b3be7a336a06ad7

Answer 4

旋转字符看起来有些混乱。我用Python做了一次尝试。它并不完美，但大部分似乎都能工作：

def decode(msg):
    text = []
    for i in range(0, len(msg), 2):
        text.append(unrot(msg[i: i + 2]))
    return str.join('', text)


def unrot(pair, key=ord('x')):
    offset = 0
    for c in 'cdefgh':
        if c in pair:
            offset = (ord('g') - ord(c)) * 16
            break
    return chr(sum(ord(c) for c in pair) - key - offset)


print(decode('gggruggvucftvghtrhho'))

https://gist.github.com/lkraider/9530798a695586fc1580d0728966f6f0

Answer 5

请问我如何解码这个字符串 X-VR-垃圾邮件原因：gggruggvucftvghtrhhoucdtuddrgedviedrudeiiedgkeduucetufdoteggodetrfdotffvucf rhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecuhedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephf hsvfgjufffkfggtgfgofhtsehnjehgtddvtddtnecuhfhrohhmpedfshgvphhtihhmrgcuphhlrghnthgrfdcuoehsrdhnthhuthhumhusehsohhnrghgrghsqdhgvgdrtghomheqnecuggftrfgrthhtvghrnhepjeefgfejveffhfejfefghfekudevudffu efgteevkedtgeeikeegudejudeghfelnecukfhppeduvdejrddtrddtrddupdduleeirddvhedurddvgedtrddvfeegpdefjedrheelrddugedvrddutdeknecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepuddvjedrtddrtddruddpmhgrihhlfhhrohhmpeeoqedpnhgsp ghrtghpthhtohepuddprhgtphhtthhopegtvggsohhtrghusegvghhlnhhgrdgtohhmpdfovfetjfhoshhtpehmohehkeefpdhmohguvgepshhmthhpohhuth X-CLX-响应：1TFkXGBsSEQpMehcaEQpZRBdjGxpHXURRY10bbxEKWFgXemYfXxtFBRpEcFA RCnhOF2NeeRJZGGlFGGtlEQp5TBd6e2xyRWhwWmcYcBEKQ0gXGxEKQ1kXBxgaHhEKQ0kXGgQaGh oRCllNF2d mchEKWUkXGnEaEBp3BhsTENEbExoQGncGGBoGGhEKWV4XaGN5EQpJRhdHS1hLXkJFR HVCRVleT04RCklHF3hPTREKQ04XGVhNQ0NkQ0UdUnBFa1oHWkRgfk0cSERsfHh6WRJfb0wRClhc Fx8EGgQZGB0FGxoEGxoaBBsZHgQZHhAbHhofGhEKXlkXSWRCE18RCk1cFxwfEQpMWhdsbWtNaxE K TEYXaGtrEQpCTxdpTxtkUn1eT2dwWREKQ1oXGxISBBscHwQfGwQSGBEKQl4XGxEKQkUXaV9CH1 NAWF5keVorckJOF2NeeRJZGGlFGGtlEQpCTBd6Zh9fG0UFGkRwUBEKQmwXZEt5XUZbc3IaQ24RC kJAF2J4TgFjAX9hZBwFEQpCWBduWGNfQ2lrYEZ8QxEKTV4XGxEKWlgXGBEKeUMXYmxtQRJEe2th XV gRCnBnF25tTF9HXURaZxxfEBkaEQpwaBdjbl1HUxNlf0hgHxAZGhEKcGgXYRkdXWFwGxIdAXA QGRoRCnBoF2ZbYE9tYHNbHUBEEBkaEQpwbBdueE9dXwUbS2USWhAZGhEKcEwXZ2sfTQUYQU8cUn wQGRoRCnBDF21TZWVTf0VPeVNlEBsaHhEKbX4XGxEKWE0XSxEg