题目复现地址：https://buuoj.cn/challenges#[INSHack2018](not)%20so%20deep

题解：

下载得到一个wav后缀的文件，通过音频分析软件查看频谱图：
如果看不到上面频谱图效果，可以尝试把最高频率调高。
由上可以看到flag，但好像只有一半。
后面则需要用到一个新的工具，DeepSound：链接：https://pan.baidu.com/s/1wsY5d2fp6cQJiDyUj2KWZA
提取码：dqlu
这是老外做的一款文件隐藏工具，可以在歌曲中隐藏文件。

提示需要Password，所以我们需要先破解他的密码
这里需要用到Root.大佬的一个脚本:

#!/usr/bin/env python3
'''
deepsound2john extracts password hashes from audio files containing encrypted
data steganographically embedded by DeepSound (http://jpinsoft.net/deepsound/).
This method is known to work with files created by DeepSound 2.0.
Input files should be in .wav format. Hashes can be recovered from audio files
even after conversion from other formats, e.g.,ffmpeg -i input output.wav
Usage:python3 deepsound2john.py carrier.wav > hashes.txtjohn hashes.txt
This software is copyright (c) 2018 Ryan Govostes <rgovostes@gmail.com>, and
it is hereby released to the general public under the following terms:
Redistribution and use in source and binary forms, with or without
modification, are permitted.
'''import logging
import os
import sys
import textwrapdef decode_data_low(buf):return buf[::2]def decode_data_normal(buf):out = bytearray()for i in range(0, len(buf), 4):out.append((buf[i] & 15) << 4 | (buf[i + 2] & 15))return outdef decode_data_high(buf):out = bytearray()for i in range(0, len(buf), 8):out.append((buf[i] & 3) << 6     | (buf[i + 2] & 3) << 4 \| (buf[i + 4] & 3) << 2 | (buf[i + 6] & 3))return outdef is_magic(buf):# This is a more efficient way of testing for the `DSCF` magic header without# decoding the whole bufferreturn (buf[0] & 15)  == (68 >> 4) and (buf[2]  & 15) == (68 & 15) \and (buf[4] & 15)  == (83 >> 4) and (buf[6]  & 15) == (83 & 15) \and (buf[8] & 15)  == (67 >> 4) and (buf[10] & 15) == (67 & 15) \and (buf[12] & 15) == (70 >> 4) and (buf[14] & 15) == (70 & 15)def is_wave(buf):return buf[0:4] == b'RIFF' and buf[8:12] == b'WAVE'def process_deepsound_file(f):bname = os.path.basename(f.name)logger = logging.getLogger(bname)# Check if it's a .wav filebuf = f.read(12)if not is_wave(buf):global convert_warnlogger.error('file not in .wav format')convert_warn = Truereturnf.seek(0, os.SEEK_SET)# Scan for the marker...hdrsz = 104hdr = Nonewhile True:off = f.tell()buf = f.read(hdrsz)if len(buf) < hdrsz: breakif is_magic(buf):hdr = decode_data_normal(buf)logger.info('found DeepSound header at offset %i', off)breakf.seek(-hdrsz + 1, os.SEEK_CUR)if hdr is None:logger.warn('does not appear to be a DeepSound file')return# Check some header fieldsmode = hdr[4]encrypted = hdr[5]modes = {2: 'low', 4: 'normal', 8: 'high'}if mode in modes:logger.info('data is encoded in %s-quality mode', modes[mode])else:logger.error('unexpected data encoding mode %i', modes[mode])returnif encrypted == 0:logger.warn('file is not encrypted')returnelif encrypted != 1:logger.error('unexpected encryption flag %i', encrypted)returnsha1 = hdr[6:6+20]print('%s:$dynamic_1529$%s' % (bname, sha1.hex()))if __name__ == '__main__':import argparseparser = argparse.ArgumentParser()parser.add_argument('--verbose', '-v', action='store_true')parser.add_argument('files', nargs='+', metavar='file',type=argparse.FileType('rb', bufsize=4096))args = parser.parse_args()if args.verbose:logging.basicConfig(level=logging.INFO)else:logging.basicConfig(level=logging.WARN)convert_warn = Falsefor f in args.files:process_deepsound_file(f)if convert_warn:print(textwrap.dedent('''---------------------------------------------------------------Some files were not in .wav format. Try converting them to .wavand try again. You can use: ffmpeg -i input output.wav---------------------------------------------------------------'''.rstrip()), file=sys.stderr)

取出文件hash值，接着通过john进行破解。

读取到后一半flag

拼接：

flag{Aud1o_st3G4n0_1s_4lwayS_Th3_S4me}