![](https://blog-1309321804.cos.ap-nanjing.myqcloud.com/blog/re.png)
The flag appears at a fixed position in the function, and you can use IDAPYTHON to iterate.```pythonimport idautilsadr=0x0000000000001161for i in range(999):    tmp=adr+0x28    next=Dword(adr+0x35)+adr+0x39    a=Byte(tmp)    if a!=0:        print(chr(a),end='')    adr=next&0xffff```