Rating:

See here : [https://berryberry.hatenablog.jp/](https://berryberry.hatenablog.jp/entry/2022/03/27/034315)

Opened it with Ghidra.

![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327015855.png)
![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327015905.png)

I found "flag.txt" in line 76, and I needed to input "HELLO" to read flag. It is not simple like just input "HELLO".

![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327012647.png)

In line 73, "HELLO" was compared to the STR variable. The STR variable was empty when input "HELLO", therefore it is failed. In line 40, to put a string into STR variable, we need to use sa pointer used in line 31 and 32. So, we needed to input some symbols first shown in the image below to get FLAG.

![](https://cdn-ak.f.st-hatena.com/images/fotolife/B/Berrys/20220327/20220327015841.png)

In retrospect, I think that you can get FLAG without "+" sign.