> [name=Curious] ## Train Of Thought & Solution After downloading, it turned out to be a zip file. Let's try extracting it first ![](https://hackmd.io/_uploads/S1kLVDSdh.png) It can be noticed that although there was an error reported by `unzip`, a file named `chemistry.png` was still extracted from the archive. > My original intention was to create a pseudo-encrypted zip file, but it seems that `unzip` is a bit clever and directly extracted it QQ If you try to open `chemistry.png` directly, you will find that it cannot be opened. Let's use the `file` to examine the file ![](https://hackmd.io/_uploads/BJo0VPSuh.png) You will find that when using the `file` command, this file is identified as an ELF file. Let's use `xxd` to examine the file. ![](https://hackmd.io/_uploads/HkGrrPSd3.png) It appears that the original PNG's magic number has been changed to that of an ELF file. Let's change the magic number back to `8950 4e47 0d0a 1a0a` ![](https://hackmd.io/_uploads/S1g_LPBdh.png) > Here, you can use `vim chemistry.png` to open the file, then enter `:%! xxd` to directly modify the hexadecimal content. After making the changes, enter `:%! xxd -r` to return to normal editing mode. Finally, save the file and exit After opening the image, you can see a compound that you're unsure about. You can use Google's reverse image search feature to find more information about it. ![](https://hackmd.io/_uploads/S1gyuvHdn.png) ![](https://hackmd.io/_uploads/B1gkAOPBdn.png) After visually comparing, it appears that the compound is Leucine. Following the format of the flag `LoTuX{[A-Z][a-z]*}`, you can fill in the English name of Leucine with the first letter capitalized and the rest in lowercase to obtain the correct flag. {%hackmd M1bgOPoiQbmM0JRHWaYA1g %}