poxi

答：
观察可知：

@echo off
setlocal enableDelayedExpansion
set x=%systemroot:~-7%
for /l %%i in (0 1 6) do (
　if /i "!x:~%%i,1!"=="D" set d=%%i
　if /i "!x:~%%i,1!"=="S" set s=%%i
　if /i "!x:~%%i,1!"=="N" set n=%%i
set "!d!=!d!!n!!s!" 2>nul
)
复制代码

这一段设置了d的值
而

!%d:~,1%!
复制代码

是密码，那就写个p

 @echo off
setlocal enableDelayedExpansion
set x=%systemroot:~-7%
for /l %%i in (0 1 6) do (
　if /i "!x:~%%i,1!"=="D" set d=%%i
　if /i "!x:~%%i,1!"=="S" set s=%%i
　if /i "!x:~%%i,1!"=="N" set n=%%i
set "!d!=!d!!n!!s!" 2>nul
)
echo !%d:~,1%!
pause
复制代码

ok，解决了...密码326