Use a GDB script to extract instructions executed by the vm. Then reverse them to get the flag.