After mildly overengeneering the previous challenge, Pyjail ATricks, I had already created some extremely shoddy code that let me encode arbitrary text to the requirements of the filter.
As a first step, it substituted a hardcoded list of numbers and a database of `__doc__` strings from the interpreter:
```STRING_SOURCES = (    ("().__doc__", "tuple() -> empty tuple\ntuple(iterable) -> tuple initialized from iterable's items\n\nIf the argument is a tuple, the return value is the same object."),    ("''.__doc__", "str(object='') -> str\nstr(bytes_or_buffer[, encoding[, errors]]) -> str\n\nCreate a new string object from the given object. If encoding or\nerrors is specified, then the object must expose a data buffer\nthat will be decoded using the given encoding and error handler.\nOtherwise, returns the result of object.__str__() (if defined)\nor repr(object).\nencoding defaults to sys.getdefaultencoding().\nerrors defaults to 'strict'."),)[...]```
These also revealed the python version as python 3.6, which will be relevant later on.
As a fallback, for this challenge I added `eval` of the hex escape in a string:
```hex_escape = f"'\\x{ord(letter):x}'"escaped = f"eval({escape_text(hex_escape)})"```
Armed with this, I could iterate quickly. I first implemented a quick loop thatwould let me type lines directly into the challenge instead of needing clumsycopy pasting. My first experiments were around trying to get importing to work, which wereunsuccessful because it appeared `__builtins__`, which `__import__` is part of,was horribly broken.
Earlier, lacking a `dir()`  or `globals()` function, I had simply tried all globalvariables available on my local python. This left me with the following list:
```    repr    print    str    __loader__    __spec__    all    bin    eval```
Of special interest to me was `__loader__`, which is part of python's importmachinery. I quickly discovered the `SourceFileLoader.get_data(fname)` method,which is a wrapper around file reading, as well as it's sibling`set_data(fname, data)`. I used the former to explore and download the sourcecode of the PyJail, which revealed that the `__builtin__` object was actuallybeing globally overwritten, instead of just not being passed to `exec` aspython sandbox challenges would usually do:
```def make_secure():    original = __builtins__.__dict__.copy()    __builtins__.__dict__.clear()    safe_builtins = ["dir", "repr", "str", "print", "eval", "input", "any", "exec", "all", "Exception"]    for func in safe_builtins:        __builtins__.__dict__[func] = original[func]```
Obtaining this also let me iterate even more quickly by running the programlocally without any of the checks (and also working repl history!).
I eventually figured out that to progress, I'd probably need either `listdir()`or `system()`, for which I'd need the `os` module. Alternatively, `sys` wouldlikely allow me to rebuild `__builtins__` or importing.
Checking the source code for `__loader__`, which surely must use `os` or `sys`somehow, I discovered special variables named `_os` and `_sys` that `importlib` uses to boostrap itself, which I couldaccess though the `SourceFileLoader.get_data.__globals__` map. One quick `_os.system("sh")` `ls`and `cat [RANDOM NAME].txt` later the flag was mine.
