Explanation on GitHub: https://github.com/csivitu/CTF-Write-ups/tree/master/DUCTF/crypto/hex-cipher-shift

```py
ALPHABET = '0123456789abcdef'

def gen_rules(ciphertext, plaintext):
x = plaintext
y = ciphertext[:len(plaintext)]
s = 7

xor_rules = []
xor_res = []
for i in range(len(plaintext)):
tmp = f"k.index('{x[i]}') ^ {s} = k.index('{y[i]}')".split(' = ')
xor_rules.append(tmp[0])
xor_res.append(tmp[1])
s = f"k.index('{x[i]}')"

return xor_rules, xor_res

def decrypt(ciphertext, key):
s = 7
plaintext = ''
for i in range(len(ciphertext)):
p = key[key.index(ciphertext[i]) ^ s]
s = key.index(ciphertext[i]) ^ s
plaintext += p

return plaintext

def rotate(l, n):
return l[-n:] + l[:-n]

def get_key(xor_rules, xor_res, plaintext):
k = list(ALPHABET)

while plaintext not in decrypt(ciphertext, k):
k = rotate(k, 1)

for i in range(len(xor_rules)):
xorred = eval(xor_rules[i])

if xorred != eval(xor_res[i]):
tmp = k[xorred]
tmp_ind = eval(xor_res[i])

k[xorred] = xor_res[i][9]
k[tmp_ind] = tmp
return k

plaintext = b'The secret message is:'.hex()

ciphertext = '85677bc8302bb20f3be728f99be0002ee88bc8fdc045b80e1dd22bc8fcc0034dd809e8f77023fbc83cd02ec8fbb11cc02cdbb62837677bc8f2277eeaaaabb1188bc998087bef3bcf40683cd02eef48f44aaee805b8045453a546815639e6592c173e4994e044a9084ea4000049e1e7e9873fc90ab9e1d4437fc9836aa80423cc2198882a'

xor_rules, xor_res = gen_rules(ciphertext, plaintext)

k = get_key(xor_rules, xor_res, plaintext)

print('[Key]\n' + ''.join(k))
msg = decrypt(ciphertext, k)
print('[MESSAGE]\n' + bytes.fromhex(msg).decode())
```

Original writeup (https://github.com/csivitu/CTF-Write-ups/tree/master/DUCTF/crypto/hex-cipher-shift).