Babyrev is reversing challenge on CSAW «Red team competition» where have to pass 99 rounds of input 4-digits code based on some check function. 

Main graph on IDA: 

Disassembly of check():

 Dump of assembler code for function check:
   0x0000000000400893 <+0>:	push   rbp
   0x0000000000400894 <+1>:	mov    rbp,rsp
   0x0000000000400897 <+4>:	mov    QWORD PTR [rbp-0x8],rdi
   0x000000000040089b <+8>:	mov    QWORD PTR [rbp-0x10],rsi
   0x000000000040089f <+12>:	mov    rcx,QWORD PTR [rbp-0x8]
   0x00000000004008a3 <+16>:	movabs rdx,0xa3d70a3d70a3d70b
   0x00000000004008ad <+26>:	mov    rax,rcx
   0x00000000004008b0 <+29>:	imul   rdx
   0x00000000004008b3 <+32>:	lea    rax,[rdx+rcx*1]
   0x00000000004008b7 <+36>:	sar    rax,0x6
   0x00000000004008bb <+40>:	mov    rdx,rax
   0x00000000004008be <+43>:	mov    rax,rcx
   0x00000000004008c1 <+46>:	sar    rax,0x3f
   0x00000000004008c5 <+50>:	sub    rdx,rax
   0x00000000004008c8 <+53>:	mov    rax,rdx
   0x00000000004008cb <+56>:	shl    rax,0x2
   0x00000000004008cf <+60>:	add    rax,rdx
   0x00000000004008d2 <+63>:	lea    rdx,[rax*4+0x0]
   0x00000000004008da <+71>:	add    rax,rdx
   0x00000000004008dd <+74>:	shl    rax,0x2
   0x00000000004008e1 <+78>:	sub    rcx,rax
   0x00000000004008e4 <+81>:	mov    rdx,rcx
   0x00000000004008e7 <+84>:	xor    rdx,QWORD PTR [rbp-0x10]
   0x00000000004008eb <+88>:	mov    rax,rdx
   0x00000000004008ee <+91>:	add    rax,rax
   0x00000000004008f1 <+94>:	add    rax,rdx
   0x00000000004008f4 <+97>:	cmp    rax,0x1338
   0x00000000004008fa <+103>:	sete   al
   0x00000000004008fd <+106>:	pop    rbp
   0x00000000004008fe <+107>:	ret    
End of assembler dump.

Check in pseudo-code from IDA:

Per each round is generating a XOR key and with our input must be 0x1338 value. Something like:

3*(input^key[i])=0x1338

So can define a hook stop on gdb for printing all XOR values on all the rounds, setting $rax as 0x1338. It’s important to make outside the hook a break on cmp statement inside check function(b *check+84). Thanks to Manuel Blanco (@Manuelbp01) for collaborating on this steps.

gdb-peda$ define hook-stop
Type commands for definition of "hook-stop".
End with a line saying just "end".
>p/d $rdx ^ 1640
>set $rax = 0x1338
>set $rip = check+97
>end
gdb-peda$ b *check+84
Breakpoint 1 at 0x4008e7

Now we can continue to see all 99 4-digits values running with:

 gdb-peda$ r <<< $(python -c 'print "\n" * 99')

 Welcome to BabyRev can you crack the code???

$2 = 1595
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ c
$3 = 1598
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$4 = 1573
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$5 = 1639
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$6 = 1589
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$7 = 1611
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$8 = 1598
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$9 = 1588
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$10 = 1625
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$11 = 1661
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$12 = 1622
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$13 = 1651
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$14 = 1586
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$15 = 1619
YAAAY Keep GOING !!

Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$16 = 1623
YAAAY Keep GOING !!
[...]
Breakpoint 1, 0x00000000004008e7 in check ()
gdb-peda$ 
$101 = 1615
YAAAY Keep GOING !!
ERROR: no flag found. If you're getting this error on the remote system, please message the admins. If you're seeing this locally, run it on the remote system! You solved the challenge, and need to get the flag from there!
[Inferior 1 (process 8607) exited normally]

Have all codes to submit on the target machine. Prepare a script to do that:

#!/usr/bin/python
from pwn import *

def main():
    nums = [1595, 1598, 1573, 1639, 1589, 1611, 1598, 1588, 1625, 1661,
            1622, 1651, 1586, 1619, 1623, 1650, 1600, 1650, 1568, 1612,
            1635, 1580, 1579, 1653, 1594, 1654, 1622, 1663, 1579, 1611,
            1653, 1642, 1662, 1618, 1581, 1579, 1589, 1616, 1635, 1602,
            1653, 1569, 1661, 1659, 1596, 1613, 1546, 1648, 1639, 1582,
            1637, 1650, 1587, 1592, 1616, 1569, 1622, 1582, 1544, 1593,
            1645, 1649, 1596, 1651, 1612, 1645, 1606, 1653, 1637, 1617,
            1648, 1591, 1594, 1605, 1638, 1579, 1610, 1576, 1603, 1626,
            1599, 1632, 1572, 1574, 1584, 1596, 1643, 1627, 1630, 1547,
            1608, 1620, 1572, 1580, 1615, 1636, 1650, 1598, 1590, 1615]

    p = remote("reversing.chal.csaw.io", 10102)
    numbers = ''.join([str(num) + '\n' for num in nums])
    p.send(numbers)
    data = p.recvline()
    while "flag" not in data:
        p.recvline()
        p.interactive()  # avoid EOF error

if __name__ == "__main__":
    main()

Here's your flag, friend: flag{60od_job_B4by_r3VeRzyng_C0mPl3tE!}

Si queréis probar el babyrev lo tenéis aquí