@redford The flag is stored in `uint bd_inject_key(ulong param_1,undefined4 param_2,int param_3,uint param_4)` somewhere, better figure it out!