BTLO CTF - BARCODE

Introduction

Do you know the history of barcodes?

After downloading and extracting the challenge file, we get a folder named Barcode_World:

Inside this folder there are thousands of PNG barcode images, approximately 9374 files.

So how should we handle all these image files? Obviously, manually scanning each file with a tool one by one would be a huge waste of time and effort.

The solution is to write a Python script that automates the scanning of the entire Barcode_World folder and prints all the output directly in the Terminal. The script I used:

import cv2
from pyzbar.pyzbar import decode
import os

folder = "./Barcode_World"

barcode_data = []

for i in range(1, 9375):

    image_path = os.path.join(folder, f"{i}.png")

    image = cv2.imread(image_path)

    # Skip if the image is not found
    if image is None:
        print(f"[!] Image not found: {image_path}")
        continue

    # Decode barcodes in the image
    decoded = decode(image)

    for barcode in decoded:
        # barcode.data is in bytes
        barcode_data.extend(barcode.data)

# Convert bytes to ASCII characters
result_text = "".join(chr(b) for b in barcode_data)

# Print the final combined message
print(result_text)

A brief explanation of this code:

• Library imports: Uses cv2 (OpenCV) to read images and pyzbar to handle barcode decoding.
• Scanning each image one by one: The for loop iterates through all 9374 images in order by filename from 1.png, 2.png, etc. inside the Barcode_World folder.
• Reading and decoding: At each iteration, cv2.imread() loads the image. If the file exists, the decode(image) function extracts the barcode data hidden inside and sequentially appends it to the barcode_data list (the data at this point is in integer - byte form).
• Converting and displaying: Finally, we iterate through all the collected data, convert it into text characters (ASCII) via the chr() function, join them into a complete string, and print the result to the screen.

Quick note:

To run the script above, you must first install the required Python libraries using the following 2 commands:

pip install opencv-python
pip install pyzbar

After running the script, we get a long sequence of numbers as follows:

I’m writing it out here so that readers can verify it themselves:

65 32 98 97 114 99 111 100 101 32 40 97 108 115 111 32 115 112 101 108 108 101 100 32 98 97 114 32 99 111 100 101 41 32 105 115 32 97 32 109 101 116 104 111 100 32 111 102 32 114 101 112 114 101 115 101 110 116 105 110 103 32 100 97 116 97 32 105 110 32 97 32 118 105 115 117 97 108 44 32 109 97 99 104 105 110 101 45 114 101 97 100 97 98 108 101 32 102 111 114 109 46 32 73 110 105 116 105 97 108 108 121 44 32 98 97 114 99 111 100 101 115 32 114 101 112 114 101 115 101 110 116 101 100 32 100 97 116 97 32 98 121 32 118 97 114 121 105 110 103 32 116 104 101 32 119 105 100 116 104 115 32 97 110 100 32 115 112 97 99 105 110 103 115 32 111 102 32 112 97 114 97 108 108 101 108 32 108 105 110 101 115 46 32 84 104 101 115 101 32 98 97 114 99 111 100 101 115 44 32 110 111 119 32 99 111 109 109 111 110 108 121 32 114 101 102 101 114 114 101 100 32 116 111 32 97 115 32 108 105 110 101 97 114 32 111 114 32 111 110 101 45 100 105 109 101 110 115 105 111 110 97 108 32 40 49 68 41 44 32 99 97 110 32 98 101 32 115 99 97 110 110 101 100 32 98 121 32 115 112 101 99 105 97 108 32 111 112 116 105 99 97 108 32 115 99 97 110 110 101 114 115 44 32 99 97 108 108 101 100 32 98 97 114 99 111 100 101 32 114 101 97 100 101 114 115 46 32 76 97 116 101 114 44 32 116 119 111 45 100 105 109 101 110 115 105 111 110 97 108 32 40 50 68 41 32 118 97 114 105 97 110 116 115 32 119 101 114 101 32 100 101 118 101 108 111 112 101 100 44 32 117 115 105 110 103 32 114 101 99 116 97 110 103 108 101 115 44 32 100 111 116 115 44 32 104 101 120 97 103 111 110 115 32 97 110 100 32 111 116 104 101 114 32 103 101 111 109 101 116 114 105 99 32 112 97 116 116 101 114 110 115 44 32 99 97 108 108 101 100 32 109 97 116 114 105 120 32 99 111 100 101 115 32 111 114 32 50 68 32 98 97 114 99 111 100 101 115 44 32 97 108 116 104 111 117 103 104 32 116 104 101 121 32 100 111 32 110 111 116 32 117 115 101 32 98 97 114 115 32 97 115 32 115 117 99 104 46 32 50 68 32 98 97 114 99 111 100 101 115 32 99 97 110 32 98 101 32 114 101 97 100 32 111 114 32 100 101 99 111 110 115 116 114 117 99 116 101 100 32 117 115 105 110 103 32 97 112 112 108 105 99 97 116 105 111 110 32 115 111 102 116 119 97 114 101 32 111 110 32 109 111 98 105 108 101 32 100 101 118 105 99 101 115 32 119 105 116 104 32 105 110 98 117 105 108 116 32 99 97 109 101 114 97 115 44 32 115 117 99 104 32 97 115 32 115 109 97 114 116 112 104 111 110 101 115 46 32 84 104 101 32 98 97 114 99 111 100 101 32 119 97 115 32 105 110 118 101 110 116 101 100 32 98 121 32 78 111 114 109 97 110 32 74 111 115 101 112 104 32 87 111 111 100 108 97 110 100 32 97 110 100 32 66 101 114 110 97 114 100 32 83 105 108 118 101 114 32 97 110 100 32 112 97 116 101 110 116 101 100 32 105 110 32 116 104 101 32 85 83 32 105 110 32 49 57 53 49 32 40 85 83 32 80 97 116 101 110 116 32 50 44 54 49 50 44 57 57 52 41 46 32 84 104 101 32 105 110 118 101 110 116 105 111 110 32 119 97 115 32 98 97 115 101 100 32 111 110 32 77 111 114 115 101 32 99 111 100 101 91 49 93 32 116 104 97 116 32 119 97 115 32 101 120 116 101 110 100 101 100 32 116 111 32 116 104 105 110 32 97 110 100 32 116 104 105 99 107 32 98 97 114 115 46 32 72 111 119 101 118 101 114 44 32 105 116 32 116 111 111 107 32 111 118 101 114 32 116 119 101 110 116 121 32 121 101 97 114 115 32 98 101 102 111 114 101 32 116 104 105 115 32 105 110 118 101 110 116 105 111 110 32 98 101 99 97 109 101 32 99 111 109 109 101 114 99 105 97 108 108 121 32 115 117 99 99 101 115 115 102 117 108 46 32 65 110 32 101 97 114 108 121 32 117 115 101 32 111 102 32 111 110 101 32 116 121 112 101 32 111 102 32 98 97 114 99 111 100 101 32 105 110 32 97 110 32 105 110 100 117 115 116 114 105 97 108 32 99 111 110 116 101 120 116 32 119 97 115 32 115 112 111 110 115 111 114 101 100 32 98 121 32 116 104 101 32 65 115 115 111 99 105 97 116 105 111 110 32 111 102 32 65 109 101 114 105 99 97 110 32 82 97 105 108 114 111 97 100 115 32 105 110 32 116 104 101 32 108 97 116 101 32 49 57 54 48 115 46 32 68 101 118 101 108 111 112 101 100 32 98 121 32 71 101 110 101 114 97 108 32 84 101 108 101 112 104 111 110 101 32 97 110 100 32 69 108 101 99 116 114 111 110 105 99 115 32 40 71 84 69 41 32 97 110 100 32 99 97 108 108 101 100 32 75 97 114 84 114 97 107 32 65 67 73 32 40 65 117 116 111 109 97 116 105 99 32 67 97 114 32 73 100 101 110 116 105 102 105 99 97 116 105 111 110 41 44 32 116 104 105 115 32 115 99 104 101 109 101 32 105 110 118 111 108 118 101 100 32 112 108 97 99 105 110 103 32 99 111 108 111 114 101 100 32 115 116 114 105 112 101 115 32 105 110 32 118 97 114 105 111 117 115 32 99 111 109 98 105 110 97 116 105 111 110 115 32 111 110 32 115 116 101 101 108 32 112 108 97 116 101 115 32 119 104 105 99 104 32 119 101 114 101 32 97 102 102 105 120 101 100 32 116 111 32 116 104 101 32 115 105 100 101 115 32 111 102 32 114 97 105 108 114 111 97 100 32 114 111 108 108 105 110 103 32 115 116 111 99 107 46 32 84 119 111 32 112 108 97 116 101 115 32 119 101 114 101 32 117 115 101 100 32 112 101 114 32 99 97 114 44 32 111 110 101 32 111 110 32 101 97 99 104 32 115 105 100 101 44 32 119 105 116 104 32 116 104 101 32 97 114 114 97 110 103 101 109 101 110 116 32 111 102 32 116 104 101 32 99 111 108 111 114 101 100 32 115 116 114 105 112 101 115 32 101 110 99 111 100 105 110 103 32 105 110 102 111 114 109 97 116 105 111 110 32 115 117 99 104 32 97 115 32 111 119 110 101 114 115 104 105 112 44 32 116 121 112 101 32 111 102 32 101 113 117 105 112 109 101 110 116 44 32 97 110 100 32 105 100 101 110 116 105 102 105 99 97 116 105 111 110 32 110 117 109 98 101 114 46 91 50 93 32 84 104 101 32 112 108 97 116 101 115 32 119 101 114 101 32 114 101 97 100 32 98 121 32 97 32 116 114 97 99 107 115 105 100 101 32 115 99 97 110 110 101 114 44 32 108 111 99 97 116 101 100 32 102 111 114 32 105 110 115 116 97 110 99 101 44 32 97 116 32 116 104 101 32 101 110 116 114 97 110 99 101 32 116 111 32 97 32 99 108 97 115 115 105 102 105 99 97 116 105 111 110 32 121 97 114 100 44 32 119 104 105 108 101 32 116 104 101 32 99 97 114 32 119 97 115 32 109 111 118 105 110 103 32 112 97 115 116 46 91 51 93 32 84 104 105 115 32 105 115 32 116 104 101 32 102 108 97 103 32 45 32 66 52 114 99 48 100 51 95 72 49 53 55 48 114 89 46 32 84 104 101 32 112 114 111 106 101 99 116 32 119 97 115 32 97 98 97 110 100 111 110 101 100 32 97 102 116 101 114 32 97 98 111 117 116 32 116 101 110 32 121 101 97 114 115 32 98 101 99 97 117 115 101 32 116 104 101 32 115 121 115 116 101 109 32 112 114 111 118 101 100 32 117 110 114 101 108 105 97 98 108 101 32 97 102 116 101 114 32 108 111 110 103 45 116 101 114 109 32 117 115 101 46 91 50 93 32 66 97 114 99 111 100 101 115 32 98 101 99 97 109 101 32 99 111 109 109 101 114 99 105 97 108 108 121 32 115 117 99 99 101 115 115 102 117 108 32 119 104 101 110 32 116 104 101 121 32 119 101 114 101 32 117 115 101 100 32 116 111 32 97 117 116 111 109 97 116 101 32 115 117 112 101 114 109 97 114 107 101 116 32 99 104 101 99 107 111 117 116 32 115 121 115 116 101 109 115 44 32 97 32 116 97 115 107 32 102 111 114 32 119 104 105 99 104 32 116 104 101 121 32 104 97 118 101 32 98 101 99 111 109 101 32 97 108 109 111 115 116 32 117 110 105 118 101 114 115 97 108 46 32 84 104 101 105 114 32 117 115 101 32 104 97 115 32 115 112 114 101 97 100 32 116 111 32 109 97 110 121 32 111 116 104 101 114 32 116 97 115 107 115 32 116 104 97 116 32 97 114 101 32 103 101 110 101 114 105 99 97 108 108 121 32 114 101 102 101 114 114 101 100 32 116 111 32 97 115 32 97 117 116 111 109 97 116 105 99 32 105 100 101 110 116 105 102 105 99 97 116 105 111 110 32 97 110 100 32 100 97 116 97 32 99 97 112 116 117 114 101 32 40 65 73 68 67 41 46 32 84 104 101 32 118 101 114 121 32 102 105 114 115 116 32 115 99 97 110 110 105 110 103 32 111 102 32 116 104 101 32 110 111 119 45 117 98 105 113 117 105 116 111 117 115 32 85 110 105 118 101 114 115 97 108 32 80 114 111 100 117 99 116 32 67 111 100 101 32 40 85 80 67 41 32 98 97 114 99 111 100 101 32 119 97 115 32 111 110 32 97 32 112 97 99 107 32 111 102 32 87 114 105 103 108 101 121 32 67 111 109 112 97 110 121 32 99 104 101 119 105 110 103 32 103 117 109 32 105 110 32 74 117 110 101 32 49 57 55 52 46 91 52 93 32 81 82 32 99 111 100 101 115 44 32 97 32 115 112 101 99 105 102 105 99 32 116 121 112 101 32 111 102 32 50 68 32 98 97 114 99 111 100 101 44 32 104 97 118 101 32 114 101 99 101 110 116 108 121 32 98 101 99 111 109 101 32 118 101 114 121 32 112 111 112 117 108 97 114 46 91 53 93 32 79 116 104 101 114 32 115 121 115 116 101 109 115 32 104 97 118 101 32 109 97 100 101 32 105 110 114 111 97 100 115 32 105 110 32 116 104 101 32 65 73 68 67 32 109 97 114 107 101 116 44 32 98 117 116 32 116 104 101 32 115 105 109 112 108 105 99 105 116 121 44 32 117 110 105 118 101 114 115 97 108 105 116 121 32 97 110 100 32 108 111 119 32 99 111 115 116 32 111 102 32 98 97 114 99 111 100 101 115 32 104 97 115 32 108 105 109 105 116 101 100 32 116 104 101 32 114 111 108 101 32 111 102 32 116 104 101 115 101 32 111 116 104 101 114 32 115 121 115 116 101 109 115 44 32 112 97 114 116 105 99 117 108 97 114 108 121 32 98 101 102 111 114 101 32 116 101 99 104 110 111 108 111 103 105 101 115 32 115 117 99 104 32 97 115 32 114 97 100 105 111 45 102 114 101 113 117 101 110 99 121 32 105 100 101 110 116 105 102 105 99 97 116 105 111 110 32 40 82 70 73 68 41 32 98 101 99 97 109 101 32 97 118 97 105 108 97 98 108 101 32 97 102 116 101 114 32 49 57 57 53 46

In CTF challenges, when I see a long sequence of numbers like this, I usually think of decoding it from Decimal. Why?

Because most of these numbers fall in the range of 32 to 126. This is exactly the decimal value range representing printable characters (letters, digits, punctuation) in the ASCII table.

By copying this number sequence and using a tool like CyberChef to convert from Decimal to Text, you can read the entire passage summarizing the history of barcodes, which also contains the Flag we are looking for:

Full flag: SBT{B4rc0d3_H1570rY}

Conclusion

And that wraps up the BTLO CTF - BARCODE challenge. Through this challenge, beyond practicing the mindset of writing Python scripts to automate the processing of large amounts of data (scanning thousands of barcode images), I also reinforced my experience in recognizing and decoding decimal number sequences — a type of problem very commonly seen in CTF competitions.

See ya~!