You can brute force to identify each character of letter by letter.
```=import subprocessimport os
CSET = '_0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&()*+,-./:;<=>?@[\\]^`{|}~'
def get_cnt(flag: str):    out = subprocess.check_output(f'rm log.txt; LD_PRELOAD=./hook.so ./t_the_weakest \'{flag}\' >/dev/null ; wc -l log.txt', shell=True)    res = int(out.decode().strip().split()[0])    return res
def main():    flag = 'TSGCTF{'    prev_cnt = get_cnt(flag + ';')    print(prev_cnt)    while True:        for c in CSET:            print(f'try : {flag + c}')            cnt = get_cnt(flag + c + ';')            if cnt > prev_cnt:                prev_cnt = cnt                flag += c                break        print(f'[+] flag : {flag}')
if __name__:    main()
# [+] flag : TSGCTF{hint_do_scripting_RdJ5GNjKkUidxjcGN4o7j5Wxz1Feo19Q0_hop3_you_did_no7_s0lve_manu4l1y_vNbwVTKw}```
```=// gcc -fPIC -shared -o hook.so hook.c -ldl
#include <unistd.h>#include <dlfcn.h>#include <stdio.h>
int g_first = 0;void *g_h;ssize_t (*g_f)(int, const void *, size_t);
ssize_t write(int fd, const void *buf, size_t count){    if(g_first == 0){        g_first = 1;        g_h = dlopen("libc.so.6", RTLD_LAZY);        g_f = dlsym(g_h, "write");    }    if (fd == 3) {        FILE* log = fopen("log.txt", "a");        fprintf(log, "call\n");        fclose(log);    }    return (*g_f)(fd, buf, count);}```