zwesty
Write-ups / Day 2 / Android
Day 2 · Fri, Oct 2 · Android

Deep Link Drift

Prey slaughtered

Static APK inspection (an APK is a zip), reading packaged assets, simple decoding (reverse)

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
mobile-android-day-02-deep-link-drift (+ /time_trial, /mastery)
Solved
2026-10-10, all three modes, 4 min 48 s from first start to last CORRECT
Player
Zwesty (solo), with Claude Code (Opus 5.5)

The challenge

Day 1 taught you the roads. Now learn which ones are actually guarded — tell verified routing apart from a scheme and host that wave everybody through.

One question, answer: “For case MOB-02-15B6E1B835 in package com.huntress.mobile.d02.v15b6e1b8356f: Day 1 taught you the roads. Now learn which ones are actually guarded — tell verified routing apart from a scheme and host that wave everybody through. Submit only the exact backend answer code returned for this case.” Artifact: deep_link_drift.apk. Format: ANS- followed by exactly 16 uppercase hexadecimal characters; no spaces or explanatory text, normalization exact.

How this lane was solved is explained once, in the Network Config Split write-up (Day 10, the first Android solve). Short version: every assigned APK carries assets/huntress_puzzle.json, and decoding it gives the answer. The app never has to run.

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
the roads … which ones are actually guarded deep links (URL schemes and hosts) and which ones verify the caller Same static route as Day 1
a scheme and host that wave everybody through an unverified deep-link filter Not needed: the answer was in assets/huntress_puzzle.json, written backwards

Honest note: the prompts describe real Android attack surface, which would mean installing and driving the app. In this event the answer sat in a packaged JSON file that the app's own code never reads, so none of that was needed.

Safety

Static only. The APKs were opened as zip files on our Kali VM and one JSON asset was read; nothing was installed or run.

What was in the files

deep_link_drift.apk, about 12.7 KB: one classes.dex, the manifest, a few resources, and assets/huntress_puzzle.json:

{"schema":"huntress.mobile.puzzle.v1","day":2,"codec":"reverse","data":"94AEE0A765B0097A-SNA"}

Codec reverse: data is the answer written backwards (it ends in -SNA); reversing it gives ANS-….

The Time Trial and Mastery APKs use the same template with different values.

Single Solve

Started untimed to download the APK, decoded by our shared Android solver, and sent once: ANS-A7900B567A0EEA49 → CORRECT in 1,535 ms (start to submit), flag aebe3160…e319.

Solver: our Android solver from Day 10, shared by Days 1–10. It reads the asset from the zip, checks the schema, decodes the codec, and returns the answer only if it is exactly ANS- + 16 uppercase hex; anything unknown stops the run before sending. Its tests: 10/10.

Time Trial

A 6-second clock. Same puzzle schema and codec as the Single Solve.

started_at 2026-10-10T15:56:21.862Z  deadline 2026-10-10T15:56:27.862Z  answer_ids ['answer']
  artifact deep_link_drift_time_trial.apk 12704 bytes sha256 cb6af40479cce787… (checked)
  answer: ANS-9CEA38235CD66444
  start         485 ms
  artifact      301 ms
  solve           0 ms
  submit        794 ms
  TOTAL        1581 ms
result CORRECT  flag 9b322e5d…ed31

Mastery

A 6-second clock. 3 APKs, one per set; the questions name them delivery N: …_mastery_0N.apk. Same puzzle schema and codec as the Single Solve.

started_at 2026-10-10T15:56:24.611Z  deadline 2026-10-10T15:56:30.611Z  answer_ids ['set1.answer', 'set2.answer', 'set3.answer']
  artifact 01-deep_link_drift_mastery_01.apk 12704 bytes sha256 e5c2b3a7ebf44734… (checked)
  artifact 02-deep_link_drift_mastery_02.apk 12704 bytes sha256 88fae57a5468a98f… (checked)
  artifact 03-deep_link_drift_mastery_03.apk 12704 bytes sha256 398e080dd91f4d2b… (checked)
  set1.answer: ANS-9F43E06FF9C46E82
  set2.answer: ANS-70CC0D78B794F915
  set3.answer: ANS-52C7ED727F7D08E4
  start         599 ms
  artifact      333 ms
  solve           1 ms
  submit        725 ms
  TOTAL        1658 ms
result CORRECT  flag 62ea655c…67f9

Time to solve

All three modes were solved on 2026-10-10 by 15:56:25 UTC, 4 min 48 s after the first start; each mode went through on its first submit, and both timed runs were ranked.

Takeaways

  • Read every packaged file before assuming the app must run. The answer sat in assets/, unread by the app's code.
  • The answer format is a strong check. ANS- + 16 uppercase hex rules out wrong decodings (Day 10's other split reading, a wrong Caesar direction) before anything is sent.