# babyrev
## Task
We didn’t want to overwhelm you, so let's start with baby rev;
## Solution
```bash$ file babyrev.outbabyrev.out: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=f58c6c1dbfa854af63d64523f4aab912b1a525e7, for GNU/Linux 3.2.0, not stripped```
If we load this up in `radare2` we can see a lot of logic in main, so we start `ghidra` to use the decompiler.
```cundefined8 main(void) {  char cVar1;  int iVar2;  char input [48];  int counterThree;  int counterTwo;  int counter;  char local_9;
  puts("Hello World");  puts(      "Welcome to the Flag checker program. Please enter your flag here, and we will verify whetherit is correct!"      );  __isoc99_scanf(&DAT_00102084,input);  local_9 = '\x01';  counter = 0;  while (counter < 0x2b) {    if ((counter < 0) || (7 < counter)) {      if ((counter < 9) || (0xf < counter)) {        if ((counter < 0x11) || (0x18 < counter)) {          if ((counter < 0x17) || (0x22 < counter)) {            if ((0x25 < counter) && (counter < 0x2c)) {              input[counter] = input[counter] + -0xd;            }          } else {            input[counter] = input[counter] + -0xd;          }        } else {          input[counter] = input[counter] + '\a';        }      } else {        input[counter] = input[counter] + -5;      }    } else {      input[counter] = input[counter] + '\x03';    }    counter = counter + 1;  }  counterTwo = 0;  while (counterTwo < 0x2b) {    cVar1 = input[counterTwo];    if (cVar1 < '\0') {      cVar1 = cVar1 + '\x03';    }    input[counterTwo] = cVar1 >> 2;    counterTwo = counterTwo + 1;  }  counterThree = 0;  while (counterThree < 0x2b) {    input[counterThree] = input[counterThree] * '\x03';    counterThree = counterThree + 1;  }  iVar2 = strcmp(input,"3E3?6]QHKTHQQBEETTNKZQ]K]?K<KHH<BQ<KQT<QHNT");  if (iVar2 != 0) {    local_9 = '\0';  }  if (local_9 == '\0') {    puts("ACCESS DENIED");  }  else {    puts("ACCESS GRANTED");  }  return 0;}```
I already renamed some variables.
We can see three for-loops that modify a char array that is scanned in. Let's clean it up:
```cint main(){  char input [43] =  {"3E3?6]QHKTHQQBEETTNKZQ]K]?K<KHH<BQ<KQT<QHNT"};
  for (int i = 0; i < 43; i++) {    if (i > 7) {      if ((i < 9) || (15 < i)) {        if ((i < 17) || (24 < i)) {          if ((i < 23) || (i > 34)) {            if (i > 37) {              input[i] = input[i] - 13;            }          } else {            input[i] = input[i] - 13;          }        } else {          input[i] = input[i] + 7;        }      } else {        input[i] = input[i] - 5;      }    } else {      input[i] = input[i] + 3;    }  }
  for (int i = 0; i < 43; i++) {    input[i] = (input[i] >> 2) * 3;  }
  if (strcmp(input,"3E3?6]QHKTHQQBEETTNKZQ]K]?K<KHH<BQ<KQT<QHNT") != 0) {    puts("ACCESS DENIED");  }  else {    puts("ACCESS GRANTED");  }
  return 0;}```
In the second for-loop we can see a leftshift 2, so we actually lost the last three bits of the input in the final string. That's a problem but we can fix it.
I copied this code to python to make it easier to work on:
```pythonreq = "3E3?6]QHKTHQQBEETTNKZQ]K]?K<KHH<BQ<KQT<QHNT"has = "3E3?6]QHKTHQQBEETTNKZQ]K]?K<KHH<BQ<KQT<QHNT"input = [ord(x) for x in has];
def change(i):  do = 0  if (i > 7):    if ((i < 9) or (15 < i)):      if ((i < 17) or (24 < i)):        if ((i < 23) or (i > 34)):          if (i > 37) :            do = -13;        else:          do = -13;      else:        do = +7;    else:      do = -5;  else:    do = 3;  return do
def convert(x, i):  return ((x + change(i)) >> 2) * 3
for i in range(43):  input[i] = convert(input[i], i)
poss = [[] for x in range(len(has))]for i in range(len(has)):  for x in range(256):    try:      if chr(convert(x, i)) == req[i] and chr(x) not in ["[","]","^","`"]:        poss[i].append(chr(x))    except Exception as e:      pass
from itertools import productfor p in product(*poss):    print(''.join(p))
print(req)print(''.join([chr(x) for x in input]))```
Instead of inverting the algorithm I just used bruteforce to find all possible characters for a given position. I could've inverted the computation and add 0-3 to the resulting byte too.
We can now set some values in poss and use the last loop to print all possibilities. Since there are a lot we can slice the array at underscores and find one word at a time. We could use an english dictionary to find words but reading all of them was faster than coding.
After some minute we get: `CYCTF{i_guess_basic_rev_was_too_ez_for_you}`