You can brute force to identify each character of letter by letter.

```=
import subprocess
import os

CSET = '_0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&()*+,-./:;<=>?@[\\]^`{|}~'

def get_cnt(flag: str):
out = subprocess.check_output(f'rm log.txt; LD_PRELOAD=./hook.so ./t_the_weakest \'{flag}\' >/dev/null ; wc -l log.txt', shell=True)
res = int(out.decode().strip().split()[0])
return res

def main():
flag = 'TSGCTF{'
prev_cnt = get_cnt(flag + ';')
print(prev_cnt)
while True:
for c in CSET:
print(f'try : {flag + c}')
cnt = get_cnt(flag + c + ';')
if cnt > prev_cnt:
prev_cnt = cnt
flag += c
break
print(f'[+] flag : {flag}')

if __name__:
main()

# [+] flag : TSGCTF{hint_do_scripting_RdJ5GNjKkUidxjcGN4o7j5Wxz1Feo19Q0_hop3_you_did_no7_s0lve_manu4l1y_vNbwVTKw}
```

```=
// gcc -fPIC -shared -o hook.so hook.c -ldl

#include <unistd.h>
#include <dlfcn.h>
#include <stdio.h>

int g_first = 0;
void *g_h;
ssize_t (*g_f)(int, const void *, size_t);

ssize_t write(int fd, const void *buf, size_t count)
{
if(g_first == 0){
g_first = 1;
g_h = dlopen("libc.so.6", RTLD_LAZY);
g_f = dlsym(g_h, "write");
}
if (fd == 3) {
FILE* log = fopen("log.txt", "a");
fprintf(log, "call\n");
fclose(log);
}
return (*g_f)(fd, buf, count);
}
```