See here : [https://berryberry.hatenablog.jp/](https://berryberry.hatenablog.jp/entry/2022/03/27/034315)

Opened with Ghidra.


You can see the process function does something using the number from 16 to 20 in the main function.


The display_number function returns a number from 16 to 20.


In the process function, you can see that the number of the argument is compared with the input number. You can get the FLAG if all the input is correct. You need to do same thing as the C function and the f function for the input value.
I used the pwntools.
```
from pwn import *

elf = ELF("./pascal", checksec=False)

host = '143.198.224.219'
port = 25030

def func2(num):
tmp = 1
for j in range(num):
tmp *= num - j
return tmp

def func1(num, i):
return int(func2(num) / (func2(i) * func2(num - i)))

r = remote(host, port)

# receice a random number
now = r.recvline()
a = now.decode('utf-8')

for i in range(int(a) + 1):
r.sendline(str(func1(int(a), i)).encode())

r.interactive()

```
FInally, you can get the FLAG.