dima_kettle on 2023-08-03 18:04:
Dojas, can you give me some advice on how to solve this problem? I sat for four days but never found what it could be...
It seems that this task is not a crackme at all.
vandoam on 2026-06-22 02:20:
[Click to reveal]Solved it by not trusting the decompiler output alone. Ghidra showed flag() as an empty function, but the assembly revealed many MOV instructions writing constant values to stack offsets.
The immediate values were printable ASCII bytes. After extracting the useful bytes in the correct order, they formed a Base64-looking string ending with "=" padding. Decoding that Base64 produced hexadecimal byte values. Converting those hex bytes to ASCII revealed the final text:
TESTIFICATION_SUCCESS
The trick was that the flag was hidden inside MOV immediates, not stored as a normal string.