```bashobjdump --disassemble=main -CM intel chall | grep 'mov    DWORD PTR \[rbp-0x4\],0x0' | awk '{print $1}' | tr -d ":" > avoid```
```python3import angrimport claripyimport logging
logging.getLogger('claripy').setLevel('CRITICAL')proj = angr.Project("./chall")argv = claripy.BVS('argv',8*42)initial_state = proj.factory.entry_state(args=["./chall",argv],add_options=angr.options.unicorn)
for i in range(42):    initial_state.add_constraints(argv.get_byte(i) >= '\x20')    initial_state.add_constraints(argv.get_byte(i) <= '\x7e')
sm = proj.factory.simulation_manager(initial_state)
with open("avoid","r") as avoid:	avoid=avoid.read().split("\n")[:-1]	av = [ 0x400000 + int(a,16) for a in avoid]	sm.explore(find=0x400000+0x2887, avoid=av)
flag = sm.found[0].solver.eval(argv,cast_to=bytes).decode()print(flag)```
flag: `GLUG{C01nc1d3nc3_c4n_b3_fr3aky_T6LSERDYB6}`