> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# crackmes.one - babyrev Writeup
- URL: https://taiwanding.com/en/crackmes-one-babyrev-writeup/
- Published: 2025-09-22T08:09:44.000Z
- Updated: 2026-07-15T02:49:52.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Challenge Overview

- Goal: enter the correct **password** and **secret code** to print the flag
- Challenge link: [https://crackmes.one/crackme/6784f8a84d850ac5f7dc5173](https://crackmes.one/crackme/6784f8a84d850ac5f7dc5173?ref=taiwanding.com)

## Recon and Locating the Logic

Inside `main` we can see a fixed flow:

1. Read a string

```c
fgets(s, 32, stdin);            // keeps the trailing '\n'

```

1. Read an integer

```c
__isoc99_scanf("%d", &code);    // stored in local_40 / v4

```

1. Two checks

```c
if (code == 1337)                     // 0x539
  if (!strcmp(s, "Sup3rS3cr3tP455W0rd\n"))
    // print the flag

```

1. Flag output (XOR loop)
- Hex-Rays:

```c
for (i = 0; i <= 0x1A; ++i)
  putchar((char)(flag[i] ^ (i + 105)));

```

- Ghidra (semantically identical):

```c
for (i = 0; i < 0x1b; i++)
  putchar( (flag[i] ^ (i + 0x69)) );

```

> `0x69 = 105`, length 27 (`i=0..26`).

## Winning Input

- **secret code**: `1337`
- **password**: `Sup3rS3cr3tP455W0rd`, then press Enter  
(because what `fgets` compares against is the string with the trailing `\n`: `"Sup3rS3cr3tP455W0rd\n"`)

```bash
└─$ ./babyrev
Welcome to baby rev challenge
Input the password:

Sup3rS3cr3tP455W0rd
Input the secret code now:

1337
Correct!
Here is your flag

CTFlearn{Redacted}
```

## Takeaways

The reason this one made the cut is that the challenge author introduced a really handy tool:

[Decompiler ExplorerDecompiler Explorer is an interactive online decompiler which shows equivalent C-like output of decompiled programs from many popular decompilers.![](https://taiwanding.com/content/images/icon/apple-touch-icon.png)Decompiler Explorer![](https://taiwanding.com/content/images/thumbnail/dogbolt.0138e8c3255b.png)](https://dogbolt.org/?ref=taiwanding.com)

This tool basically bundles together the decompilers that are out there — including Ghidra, which the author uses all the time. As long as there are no confidentiality concerns, you just upload your file and quickly get decompiled output from all of them.

![](https://taiwanding.com/content/images/2025/09/image-15.png)