Each byte of argv[1] ( flag ) is authenticated in some routine.
Just set two breakpoints and bruteforce it.

Original writeup (https://github.com/vngkv123/CTF/blob/master/ctf_in_2017/tuctf/unknown.py).