The challenge has some output depending of the input like "wrong" or "correct"... the input must be 16 plus '\n'. In cases like this angr should works well... so a first script WITHOUT any kinda of optimization gave me the flag... so even if it could be optimized, it works!
```pythonimport angr, claripy
base_addr = 0x0
proj = angr.Project("./a.out", main_opts={'base_addr': base_addr})
input_len = 16inp = [claripy.BVS('flag_%d' %i, 8) for i in range(input_len)]flag = claripy.Concat(*inp + [claripy.BVV(b'\n')])
# find_addr = 0x0000000000001482# avoid_addr = [0x0000000000001461, 0x00000000000012AC]
state = proj.factory.full_init_state(stdin=flag)
for k in inp:    state.solver.add(k < 0x7f)    state.solver.add(k > 0x20)
simgr = proj.factory.simulation_manager(state)simgr.run()for i in simgr.deadended:    print(i.solver.eval(flag, cast_to=bytes))#simgr.explore(find=find_addr, avoid=avoid_addr)```
The script produces 5 output, one is the correct flag:```shellb'(0("0$!!"$((0$0"\n'b'n0_50@@@@@@@@@@0\n'b'n0_5ymb0`00@@@@@\n'b'n0_5ymb0l1c,3x30\n'b'n0_5ymb0l1c,0@@!\n'```
# FLAG`darkCTF{n0_5ymb0l1c,3x30}`