crackmes.one - babyrev Writeup

Challenge Overview

• Goal: enter the correct password and secret code to print the flag
• Challenge link: https://crackmes.one/crackme/6784f8a84d850ac5f7dc5173

Recon and Locating the Logic

Inside main we can see a fixed flow:

1. Read a string

fgets(s, 32, stdin);            // keeps the trailing '\n'

2. Read an integer

__isoc99_scanf("%d", &code);    // stored in local_40 / v4

3. Two checks

if (code == 1337)                     // 0x539
  if (!strcmp(s, "Sup3rS3cr3tP455W0rd\n"))
    // print the flag

4. Flag output (XOR loop)

• Hex-Rays:

for (i = 0; i <= 0x1A; ++i)
  putchar((char)(flag[i] ^ (i + 105)));

• Ghidra (semantically identical):

for (i = 0; i < 0x1b; i++)
  putchar( (flag[i] ^ (i + 0x69)) );

0x69 = 105, length 27 (i=0..26).

Winning Input

• secret code: 1337
• password: Sup3rS3cr3tP455W0rd, then press Enter
  (because what fgets compares against is the string with the trailing \n: "Sup3rS3cr3tP455W0rd\n")

└─$ ./babyrev
Welcome to baby rev challenge
Input the password:

Sup3rS3cr3tP455W0rd
Input the secret code now:

1337
Correct!
Here is your flag

CTFlearn{Redacted}

Takeaways

The reason this one made the cut is that the challenge author introduced a really handy tool:

Decompiler Explorer

Decompiler Explorer is an interactive online decompiler which shows equivalent C-like output of decompiled programs from many popular decompilers.

Decompiler Explorer

This tool basically bundles together the decompilers that are out there — including Ghidra, which the author uses all the time. As long as there are no confidentiality concerns, you just upload your file and quickly get decompiled output from all of them.