#!/usr/bin/env python3

# Try using angr or z3 for symbolic execution, or just brute force intelligently
# Let's try a smarter brute force - building the flag character by character

import subprocess
import string

def test_flag(flag):
    """Test if a flag passes validation"""
    result = subprocess.run(
        ["python", "baby.py"],
        input=flag,
        capture_output=True,
        text=True,
        timeout=2
    )
    output = result.stdout + result.stderr
    return "not the flag" not in output.lower()

def get_output_size(flag):
    """Get output size for debugging"""
    result = subprocess.run(
        ["python", "baby.py"],
        input=flag,
        capture_output=True,
        text=True,
        timeout=2
    )
    return len(result.stdout + result.stderr)

# Build flag character by character
# Start with common flag prefixes
prefixes = ["flag{", "FLAG{", "ctf{", "CTF{", ""]

charset = string.ascii_letters + string.digits + "_{}-"

print("Trying to build flag character by character...")
print("Testing which prefix works...\n")

for prefix in prefixes:
    size = get_output_size(prefix)
    passes = test_flag(prefix)
    print(f"Prefix '{prefix}': size={size}, passes={passes}")

print("\n" + "="*80)
print("Now trying to build from empty string...\n")

# Try building from scratch
flag = ""
max_length = 50

for pos in range(max_length):
    print(f"\nPosition {pos}: Testing characters...")
    found = False
    
    for char in charset:
        test = flag + char
        if test_flag(test):
            flag = test
            print(f"  ✓ Found: '{char}' -> current flag: '{flag}'")
            found = True
            break
        elif pos == 0 and char in "fFcC{":  # Log interesting chars
            size = get_output_size(test)
            print(f"  - '{char}': size={size}")
    
    if not found:
        print(f"  ✗ No valid character found at position {pos}")
        print(f"  Final flag: '{flag}'")
        break

print(f"\n{'='*80}")
print(f"RESULT: '{flag}'")