Rating:

```
#!/usr/bin/env python
from subprocess import *
import re

flag = ''

# Script assumes all the files and the script are in the same directory

for i in range(1,1000):
file = str(i).zfill(3) + '.c.out'
p = Popen("objdump -d -M intel " + file + "|grep '0f b6 05' ", stdout=PIPE, shell=True)
objdump = p.communicate()
address = objdump[0].rstrip().split('ds:')[1]
p1 = Popen("objdump -d -M intel " + file + "|grep " + address, stdout=PIPE, shell=True)
objdump2 = p1.communicate()
value_tuples = objdump2[0].split('\n')
val = int(value_tuples[len(value_tuples)-3].split(',')[1],16)

# Check if input is correct

process = Popen('./' + file, stdin=PIPE, stdout=PIPE)
if 'OK!' == process.communicate(input=chr(val))[0].split('\n')[1].rstrip():
flag += chr(val)
else:
print 'ERROR! ' + file
print 'Input: ' + chr(val) + ':' + str(hex(val))
break

print 'FLAG :' + re.search(r'RITSEC{.*}',flag).group(0)
```