# Ostrich Algorithm
`utflag{d686e9b8f13bef2a3078c324ceafd25d}`
# Maps

from pwn import*
context.log_level = "CRITICAL"  
c=4934849349493674935749360493664940249346493534935849348493574936549351493644937449348493464936449365493744935349360493464935449364493574935749374493494935349358493594935449404
l='1020009200095001010013700081000880009300083000920010000086000990010900083000810009900100001090008800095000810008900099000920009200109000840008800093000940008900139'
flag=b'ut'
for i in range(0,len(l),5):
    p=process('./utctf')
    p=process('./utctf')
    (p.recvuntil(b' '))
    p.sendline(flag)
    o=int((p.recvline()[:-1]))
    p.close()
    for s in range(33,128):
        #print(chr(s),end='')
        p=process('./utctf')
        (p.recvuntil(b' '))
        p.sendline(flag+chr(s).encode())
        n=int((p.recvline()[:-1]))
        h=int(l[i:i+5]+'0'*(len(l[i:])-len(l[i:i+5])))
        j=int(n-o)
        #print('h= ',h)
        #print('j= ',j)
        if h==j:
            flag=flag+chr(s).encode()
            print(flag)
            
            p.close()
            break
        
        #print(n)
        p.close()
        #exit()
#utflag{shouldve_used_haskell_thonk}

Flag=`utflag{shouldve_used_haskell_thonk}`
# Safe Word
cách 1: bruteforce

#!/usr/bin/env python3

import pwn

pwn.context.log_level = "CRITICAL"  


def get_updated_value(flag_input,i) :
    PROMPT = b"(gdb)"
    io: pwn.tube
    with pwn.process(["gdb", "-q", "--nx", "./safe_word"]) as io:
        io.sendlineafter(PROMPT, b"b *0x00005555555673d5")
        io.sendlineafter(PROMPT, b"run")
        io.sendline(flag_input.encode())
        #io.sendlineafter(PROMPT, b"continue")
        (io.recvline())
        (io.recvline())
        (io.recvline())
        (io.recvline())
        #print(io.recv(1000000))
        #print(io.recv(1000000))
        #print(io.recv(1000000))
        print('--------------')
        for j in range(i+3):
            io.sendline( b"continue")
            #io.sendline(b'continue')
            (io.recvline())
            (io.recvline())
            n=(io.recvline())

            (n)
            
        #print(io.recvline())
        #print(io.recvline())

        #n=(io.recvline())
        #io.close()

    return n
        
sym=b'tlag{abcdefghijklmnopqrstuvwxyz_0123456789}'
flag = "utflag{1_w4nna_pl4"
for i in range(len(flag),32):
    for s in sym:
        print(flag,chr(s),end='')
        u = get_updated_value(flag+chr(s),i)
        print("u=",u)
        #exit()
        if b' Continuing.\n'in u:
            flag=flag+chr(s)
            print("\n flag= ",(flag))
            break
print(flag)