solve.py

#!/usr/bin/env python
# coding: utf-8

import angr
import claripy
import time

def main():
    p = angr.Project('./chall')

    flag_chars = [claripy.BVS('flag{%d}' % i, 8) for i in range(46)]
    flag = claripy.Concat(*flag_chars + [claripy.BVV(b'\n')] )

    st = p.factory.full_init_state(
            args=['./chall'],
            stdin=flag,
    )

    for k in flag_chars:
        st.solver.add(k != 0)
        st.solver.add(k != 10)
        st.solver.add(k >= 32)
        st.solver.add(k <= 128)

    sm = p.factory.simulation_manager(st)
    sm.run()

    for pp in sm.deadended:
        stdin = pp.posix.dumps(0)
        stdout = pp.posix.dumps(1)
        if 'Yay!' in stdout:
            print stdin


if __name__ == "__main__":
    main()